macOS Useful Commands - HackTricks

# macOS Useful Commands

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

### MacOS Automatic Enumeration Tools

- MacPEAS: https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
- Metasploit: https://github.com/rapid7/metasploit-framework/blob/master/modules/post/osx/gather/enum_osx.rb
- SwiftBelt: https://github.com/cedowens/SwiftBelt

### Specific MacOS Commands

    #System info
    date
    cal
    uptime #show time from starting
    w #list users
    whoami #this user
    finger username #info about user
    uname -a #sysinfo
    cat /proc/cpuinfo #processor
    cat /proc/meminfo #memory
    free #check memory
    df #check disk

    launchctl list #List services
    atq #List "at" tasks for the user
    sysctl -a #List kernel configuration
    diskutil list #List connected hard drives
    nettop #Monitor network usage of processes in top style

    system_profiler SPSoftwareDataType #System info
    system_profiler SPPrintersDataType #Printer
    system_profiler SPApplicationsDataType #Installed Apps
    system_profiler SPFrameworksDataType #Instaled framework
    system_profiler SPDeveloperToolsDataType #Developer tools info
    system_profiler SPStartupItemDataType #Startup Items
    system_profiler SPNetworkDataType #Network Capabilities
    system_profiler SPFirewallDataType #Firewall Status
    system_profiler SPNetworkLocationDataType #Known Network
    system_profiler SPBluetoothDataType #Bluetooth Info
    system_profiler SPEthernetDataType #Ethernet Info
    system_profiler SPUSBDataType #USB info
    system_profiler SPAirPortDataType #Airport Info

    #Searches
    mdfind password #Show all the files that contains the word password
    mfind -name password #List all the files containing the word password in the name

    #Open any app
    open -a <Application Name> --hide #Open app hidden
    open some.doc -a TextEdit #Open a file in one application

    #Computer doesn't go to sleep
    caffeinate &

    #Screenshot
    # This will ask for permission to the user
    screencapture -x /tmp/ss.jpg #Save screenshot in that file

    #Get clipboard info
    pbpaste

    #system_profiler
    system_profiler --help #This command without arguments take lot of memory and time.
    system_profiler -listDataTypes
    system_profiler SPSoftwareDataType SPNetworkDataType

    #Network
    arp -i en0 -l -a #Print the macOS device's ARP table
    lsof -i -P -n | grep LISTEN
    smbutil statshares -a #View smb shares mounted to the hard drive

    #networksetup - set or view network options: Proxies, FW options and more
    networksetup -listallnetworkservices #List network services
    networksetup -listallhardwareports #Hardware ports
    networksetup -getinfo Wi-Fi #Wi-Fi info
    networksetup -getautoproxyurl Wi-Fi #Get proxy URL for Wifi
    networksetup -getwebproxy Wi-Fi #Wifi Web proxy
    networksetup -getftpproxy Wi-Fi #Wifi ftp proxy

    #Brew
    brew list #List installed
    brew search <text> #Search package
    brew info <formula>
    brew install <formula>
    brew uninstall <formula>
    brew cleanup #Remove older versions of installed formulae.
    brew cleanup <formula> #Remove older versions of specified formula.

    #Make the machine talk
    say hello -v diego
    #spanish: diego, Jorge, Monica
    #mexican: Juan, Paulina
    #french: Thomas, Amelie

    ########### High privileges actions
    sudo purge #purge RAM
    #Sharing preferences
    sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist (enable ssh)
    sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist (disable ssh)
    #Start apache
    sudo apachectl (start|status|restart|stop)
     ##Web folder: /Library/WebServer/Documents/
    #Remove DNS cache
    dscacheutil -flushcache
    sudo killall -HUP mDNSResponder

### Installed Software & Services

Check for suspicious applications installed and privileges over the.installed resources:

    system_profiler SPApplicationsDataType #Installed Apps
    system_profiler SPFrameworksDataType #Instaled framework
    lsappinfo list #Installed Apps
    launchctl list #Services

### User Processes

    # will print all the running services under that particular user domain.
    launchctl print gui/<users UID>

    # will print all the running services under root
    launchctl print system

    # will print detailed information about the specific launch agent. And if it’s not running or you’ve mistyped, you will get some output with a non-zero exit code: Could not find service “com.company.launchagent.label” in domain for login
    launchctl print gui/<user's UID>/com.company.launchagent.label

### Create a user

Without prompts

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.