Skip to content

Instantly share code, notes, and snippets.

@D00MFist

D00MFist/entitle.sh

Last active July 26, 2023 08:08
Show Gist options
  • Save D00MFist/feca65673d78a0bc0333f826eeb80956 to your computer and use it in GitHub Desktop.
Save D00MFist/feca65673d78a0bc0333f826eeb80956 to your computer and use it in GitHub Desktop.
Download ZIP
Entitlement checker
Raw
entitle.sh
for file in /Applications/*
do
echo "--------------" >>results.out
echo "$file" >>results.out
codesign -d --entitlements - "$file" >> results.out
done
Raw
newone.sh
search_dir=/Applications/
for entry in "$search_dir"/*
do
echo "$entry"
echo "------------" >> results.out
codesign -d --entitlements - "$entry" >> results.out
done
@D00MFist
Copy link
Author

D00MFist commented Sep 15, 2020 •
edited
Loading

  • If the application doesn’t have the hardened runtime turned on -> try DYLD_INSERT_LIBRARIES

  • If the application has the hardened runtime turned on:

--look also for the com.apple.security.get-task-allow entitlement. If it’s set to true then inject via task_for_pid (libinject in poseidon)
--look also for the pair of com.apple.security.cs.allow-dyld-environment-variables & com.apple.security.cs.disable-library-validation entitlements. If they are both set to true use the DYLD_INSERT_LIBRARIES
--find an older version of the application without the hardened runtime and use the DYLD_INSERT_LIBRARIES
--find another app signed by the same developer without the hardened runtime and use the DYLD_INSERT_LIBRARIES

https://wojciechregula.blog/post/learn-xpc-exploitation-part-3-code-injections/
https://knight.sc/malware/2019/03/15/code-injection-on-macos.html

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment