# Hunt Macos

> macOS attack hunting - foothold to root/persistence on a macOS host. TCC/Gatekeeper/SIP bypass, keychain + credential loot, code-signing/entitlements abuse, XPC/dylib/library injection, launch-constraint evasion, MDM/installer abuse. Wiki-first, FIND schema output.

- Skill: `encod3d-sec/hunt-macos` (Agent Skill)
- Install (CLI): `npx skillmds@latest add encod3d-sec/hunt-macos`
- Raw SKILL.md: https://api.skillmd.com/api/skills/encod3d-sec/hunt-macos/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Encod3d-Sec (https://skillmd.com/u/encod3d-sec)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/encod3d-sec/hunt-macos

---


# Hunt: macOS

**Assumes `hunt-core`** for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.

## Wiki

```
qmd_query "macOS TCC SIP Gatekeeper AMFI keychain XPC dylib injection sandbox escape code signing entitlements" via wiki-search MCP
```

Hub: [[macos-moc]] (live index). Primary page: [[macos-tcc]]. Payload arsenal: `wiki/payloads/macos-app-injection.md`.
Anchors: [[macos-privesc]] (general privesc checklist), [[macos-keychain]] (credential/DB harvest).

## Environment note

macOS boxes on THM/HTB are usually a VM (not real Apple hardware) - SIP/Gatekeeper/TCC still apply as
shipped, but device-specific protections (Secure Enclave, T2) generally do not. Confirm root/admin vs a
sandboxed app context before picking an escalation path - the sandbox-escape and TCC-bypass techniques
below assume different starting points.

## Attack surface signals

Detected via: SSH/service banner (`Darwin`, `Mac OS X 10.`, `macOS 1[1-5]`), a `.app` bundle / `.plist`
delivered as a foothold vector, Bonjour/mDNS (5353), ARD/screen-sharing (5900/3283), SMB served by
`smbd` with a macOS-flavoured share layout, or a CTF prompt naming macOS/Darwin explicitly.
Footholds: a delivered `.pkg`/`.dmg`/`.app` (installer/Gatekeeper abuse), a web app or service running
as a low-priv user, physical/VNC/screen-sharing access to a logged-in session.

**Rank the surface** once you have a foothold:

- **TCC / SIP / Gatekeeper / AMFI** - the macOS-specific security stack; a bypass here is the signature
  finding of this class and the primary path to protected data or unsigned code exec.
- **Keychain / credential loot** - highest reward-per-effort; a login-keychain dump or a reused hash
  often beats grinding a hardened control (see chaining note).
- **XPC / dylib / library injection** - inherit a privileged or entitled process's rights; the main
  local-privesc lever once enumeration finds a vulnerable service or a hijackable load path.
- **Sandbox escape** - only relevant from a sandboxed app context; escapes to the full user context.
- **MDM / installer abuse** - a `.pkg` postinstall runs as root at install time; MDM enrollment reaches
  the whole fleet. Highest blast radius when either is present.

## Methodology

1. **Enumerate the foothold first** - `Skill(arsenal)` then [[macos-enumeration]]: users, running
   processes/services (launchd agents/daemons), installed `.app` bundles, network map, SIP status
   (`csrutil status`), Gatekeeper status (`spctl --status`), TCC database location + entries.
```bash
csrutil status                          # SIP enabled/disabled - gates which privesc paths are live
spctl --status                          # Gatekeeper assessment on/off
sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db "select * from access"   # per-app TCC grants
```
2. **Credential / secret loot** - [[macos-keychain]] (login keychain dump, `security` CLI, keychain
   ACL bypass) then the wider sweep in [[macos-loot-locations]] (local password hashes under
   `/var/db/dslocal/`, browser/app credential stores, sensitive DBs) - crack recovered hashes with
   hashcat `-m 7100` (salted SHA512-PBKDF2).
3. **Evasion / bypass the OS security stack** (pick per what's actually gating you):
   - [[macos-gatekeeper]] - quarantine-attribute stripping, unsigned/ad-hoc-signed app execution.
   - [[macos-code-signing]] - signature/entitlement inspection and abuse (`codesign`, ad-hoc re-signing).
   - [[macos-amfi]] - AppleMobileFileIntegrity internals underlying code-signing enforcement, and its bypasses.
   - [[macos-launch-constraints]] - trust-cache / launch-constraint evasion on newer macOS.
   - [[macos-dirty-nib]] - NIB-file injection into a signed app to gain its entitlements.
4. **Privilege escalation / sandbox escape** - [[macos-privesc]] (the general checklist: SUID, sudo,
   cron/launchd, writable app bundles) alongside:
   - [[macos-sandbox-escape]] - escape an app sandbox profile to the full user context.
   - [[macos-xpc-abuse]] - abuse a privileged XPC service's exposed Mach interface.
   - [[macos-function-hooking]] / [[macos-library-injection]] / [[macos-thread-injection]] /
     [[macos-app-injection]] (payload) - `DYLD_INSERT_LIBRARIES`/dylib hijack/thread-injection into a
     privileged or entitled process to inherit its rights.
   - [[macos-authorization-db]] - Authorization Services rights-database manipulation for a privesc.
   - [[macos-tcc]] - TCC bypass to reach protected data (contacts/photos/full-disk-access/camera) or
     ride a TCC-granted app's entitlement.
   - [[macos-installers-abuse]] - `.pkg` postinstall-script / `.dmg` abuse for root-run code at install time.
   - [[macos-chromium-injection]] - inject into a Chromium-based app (Electron/Chrome) via its debug/CEF
     surface for code exec in that app's context.
5. **Persistence + lateral** - [[macos-persistence]] (launch agents/daemons, login items, cron) and
   [[macos-mdm]] (enrolled-MDM abuse for fleet-wide reach, if the host is MDM-managed).

**Chaining.** Foothold -> keychain/credential loot -> privesc is the reliable macOS chain: a
low-priv shell first dumps the login keychain and `/var/db/dslocal/` hashes ([[macos-keychain]] /
[[macos-loot-locations]]), a cracked or reused admin password then unlocks sudo/`security` and the
privileged XPC/dylib paths in step 4. Loot before you grind a hardened control.

**Evasion.** Prefer the least-noisy path that clears the gate: strip the `com.apple.quarantine`
xattr rather than fully re-sign, ride an already-TCC-granted app's entitlement rather than defeating
TCC head-on, and load via a hijackable dylib search path before touching AMFI/launch-constraint
internals. Escalate to heavier bypasses ([[macos-amfi]], [[macos-launch-constraints]]) only when the
lighter path is actually blocked.

Distill a confirmed reusable macOS technique per hunt-core: `python3 scripts/wiki-stage.py --kind technique --slug <slug> --target-page techniques/macos/macos-privesc.md`.

## Confirmation gate

**NOT confirmation:** a permissive entitlement (`com.apple.security.*`, a `get-task-allow` or a
private-framework entitlement) present in a plist; an unsigned or ad-hoc-signed binary sitting on
disk; a world-writable app bundle or launchd plist; `csrutil`/`spctl` reporting a control as present;
a `DYLD_INSERT_LIBRARIES` that the loader ignored on a hardened process. A capability that *exists*
is not a control that was *bypassed*.

**IS confirmation:** the control was actually defeated and demonstrated - TCC bypassed and the
protected resource (contacts/photos/full-disk/camera) actually read; SIP-protected path written or
`csrutil`-guarded action performed; Gatekeeper/AMFI/launch-constraint bypassed and your unsigned code
*ran* past it; an injected dylib/thread executing inside the privileged/entitled process and
exercising its rights; a `.pkg` postinstall or XPC call yielding a root-context action you performed -
each re-verified in a clean session and reproduced from your own written steps.

## Severity

| Severity | Class |
|---|---|
| CRITICAL | root / SIP-disabled code exec, MDM fleet compromise |
| HIGH | sandbox escape, XPC privesc, keychain-wide credential dump |
| MEDIUM | TCC bypass to a single data class, Gatekeeper bypass with no privilege gain |