macOS xattr-acls extra stuff

最后更新于1年前

从零开始学习 AWS 黑客技术，成为 ！

支持 HackTricks 的其他方式：

如果您想在 HackTricks 中看到您的公司广告 或 下载 HackTricks 的 PDF 版本，请查看！
获取
探索，我们独家的
加入 💬 或或在 Twitter 🐦 上关注我。
通过向 和 github 仓库提交 PR 来分享您的黑客技巧。

```bash rm -rf /tmp/test* echo test >/tmp/test chmod +a "everyone deny write,writeattr,writeextattr,writesecurity,chown" /tmp/test ./get_acls test ACL for test: !#acl 1 group:ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000000C:everyone:12:deny:write,writeattr,writeextattr,writesecurity,chown

ACL in hex: \x21\x23\x61\x63\x6c\x20\x31\x0a\x67\x72\x6f\x75\x70\x3a\x41\x42\x43\x44\x45\x46\x41\x42\x2d\x43\x44\x45\x46\x2d\x41\x42\x43\x44\x2d\x45\x46\x41\x42\x2d\x43\x44\x45\x46\x30\x30\x30\x30\x30\x30\x30\x43\x3a\x65\x76\x65\x72\x79\x6f\x6e\x65\x3a\x31\x32\x3a\x64\x65\x6e\x79\x3a\x77\x72\x69\x74\x65\x2c\x77\x72\x69\x74\x65\x61\x74\x74\x72\x2c\x77\x72\x69\x74\x65\x65\x78\x74\x61\x74\x74\x72\x2c\x77\x72\x69\x74\x65\x73\x65\x63\x75\x72\x69\x74\x79\x2c\x63\x68\x6f\x77\x6e\x0a

```bash # Lets add the xattr com.apple.xxx.xxxx with the acls mkdir start mkdir start/protected ./set_xattr start/protected echo something > start/protected/something ```

set_xattr 的代码

```c // gcc -o set_xattr set_xattr.c #include #include #include #include #include

void print_xattrs(const char *filepath) { ssize_t buflen = listxattr(filepath, NULL, 0, XATTR_NOFOLLOW); if (buflen < 0) { perror("listxattr"); return; }

char *buf = malloc(buflen); if (buf == NULL) { perror("malloc"); return; }

buflen = listxattr(filepath, buf, buflen, XATTR_NOFOLLOW); if (buflen < 0) { perror("listxattr"); free(buf); return; }

printf("All current extended attributes for %s:\n", filepath); for (char *name = buf; name < buf + buflen; name += strlen(name) + 1) { printf("%s: ", name); ssize_t valuelen = getxattr(filepath, name, NULL, 0, 0, XATTR_NOFOLLOW); if (valuelen < 0) { perror("getxattr"); continue; }

char *value = malloc(valuelen + 1); if (value == NULL) { perror("malloc"); continue; }

valuelen = getxattr(filepath, name, value, valuelen, 0, XATTR_NOFOLLOW); if (valuelen < 0) { perror("getxattr"); free(value); continue; }

value[valuelen] = '\0'; // Null-terminate the value printf("%s\n", value); free(value); }

free(buf); }

int main(int argc, char *argv[]) { if (argc != 2) { fprintf(stderr, "Usage: %s \n", argv[0]); return 1; }

const char *hex = "\x21\x23\x61\x63\x6c\x20\x31\x0a\x67\x72\x6f\x75\x70\x3a\x41\x42\x43\x44\x45\x46\x41\x42\x2d\x43\x44\x45\x46\x2d\x41\x42\x43\x44\x2d\x45\x46\x41\x42\x2d\x43\x44\x45\x46\x30\x30\x30\x30\x30\x30\x30\x43\x3a\x65\x76\x65\x72\x79\x6f\x6e\x65\x3a\x31\x32\x3a\x64\x65\x6e\x79\x3a\x77\x72\x69\x74\x65\x2c\x77\x72\x69\x74\x65\x61\x74\x74\x72\x2c\x77\x72\x69\x74\x65\x65\x78\x74\x61\x74\x74\x72\x2c\x77\x72\x69\x74\x65\x73\x65\x63\x75\x72\x69\x74\x79\x2c\x63\x68\x6f\x77\x6e\x0a"; const char *filepath = argv[1];

int result = setxattr(filepath, "com.apple.xxx.xxxx", hex, strlen(hex), 0, 0); if (result == 0) { printf("Extended attribute set successfully.\n\n"); } else { perror("setxattr"); return 1; }

print_xattrs(filepath);

return 0; }