oscp/Necronomicon/Mac OS/Hardened Runtime.md

• Protects apps against code injection via library hijacking, env vars, and task port injection.
• List app entitlements:
  • codesign -d --entitlements :- <file>
  • Poseidon: list_entitlements
  • Look for any of the following:
    • com.apple.security.cs.disable-library-validation
      • Allows any dynlib to be loaded into the process
    • com.apple.security.cs.allow-dyld-environment-variables
      • Allows dynlibs to be loaded from DYLD_INSERT_LIBRARIES env var.
      • Code signing requirements still apply unless the previous setting is also applied.
      • Injection:
        • DYLD_INSERT_LIBRARIES=malicious.dylib ./app
    • com.apple.security.get-task-allow
      • Allows other apps to get task port; similar to a handle on Windows. Accessing a task port requires root.
      • Enables classic create thread process injection