macOS Default Sandbox Debug - HackTricks

# macOS Default Sandbox Debug

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

In this page you can find how to create an app to launch arbitrary commands from inside the default macOS sandbox:

1. Compile the application:

    #include <Foundation/Foundation.h>

    int main(int argc, const char * argv[]) {
        @autoreleasepool {
            while (true) {
                char input[512];

                printf("Enter command to run (or 'exit' to quit): ");
                if (fgets(input, sizeof(input), stdin) == NULL) {
                    break;
                }

                // Remove newline character
                size_t len = strlen(input);
                if (len > 0 && input[len - 1] == '\n') {
                    input[len - 1] = '\0';
                }

                if (strcmp(input, "exit") == 0) {
                    break;
                }

                system(input);
            }
        }
        return 0;
    }

Compile it running: `clang -framework Foundation -o SandboxedShellApp main.m`

2. Build the `.app` bundle

    mkdir -p SandboxedShellApp.app/Contents/MacOS
    mv SandboxedShellApp SandboxedShellApp.app/Contents/MacOS/

    cat << EOF > SandboxedShellApp.app/Contents/Info.plist
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
        <key>CFBundleIdentifier</key>
        <string>com.example.SandboxedShellApp</string>
        <key>CFBundleName</key>
        <string>SandboxedShellApp</string>
        <key>CFBundleVersion</key>
        <string>1.0</string>
        <key>CFBundleExecutable</key>
        <string>SandboxedShellApp</string>
    </dict>
    </plist>
    EOF

3. Define the entitlements

{{#tabs}} {{#tab name="sandbox"}}

    cat << EOF > entitlements.plist
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
        <key>com.apple.security.app-sandbox</key>
        <true/>
    </dict>
    </plist>
    EOF

{{#endtab}}

{{#tab name="sandbox + downloads"}}

    cat << EOF > entitlements.plist
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
        <key>com.apple.security.app-sandbox</key>
        <true/>
        <key>com.apple.security.files.downloads.read-write</key>
        <true/>
    </dict>
    </plist>
    EOF

{{#endtab}} {{#endtabs}}

4. Sign the app (you need to create a certificate in the keychain)

    codesign --entitlements entitlements.plist -s "YourIdentity" SandboxedShellApp.app
    ./SandboxedShellApp.app/Contents/MacOS/SandboxedShellApp

    # An d in case you need this in the future
    codesign --remove-signature SandboxedShellApp.app

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.