macOS持久化机制与检测深度分析

ls -la /Library/LaunchDaemons/
ls -la /Library/LaunchAgents/
ls -la ~/Library/LaunchAgents/
ls -la /System/Library/LaunchDaemons/
ls -la /System/Library/LaunchAgents/
ls -la /Library/Preferences/
profiles list -type configuration
sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db "SELECT client,service,auth_value FROM access;"
spctl --status
csrutil status
kextstat | grep -v com.apple
crontab -l
atq
ls -la ~/Library/Application\ Support/com.apple.loginitems/

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.apple.updates</string>
    <key>ProgramArguments</key>
    <array>
        <string>/Library/Application Support/.hidden/backdoor</string>
        <string>--daemon</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>KeepAlive</key>
    <true/>
    <key>StandardOutPath</key>
    <string>/tmp/.updates.log</string>
    <key>StandardErrorPath</key>
    <string>/tmp/.updates.err</string>
    <key>WorkingDirectory</key>
    <string>/Library/Application Support/.hidden</string>
</dict>
</plist>

launchctl load /Library/LaunchDaemons/com.malicious.plist
launchctl unload /Library/LaunchDaemons/com.malicious.plist
launchctl start com.malicious
launchctl stop com.malicious
launchctl list | grep -i suspicious
launchctl print system/com.malicious
launchctl print gui/$(id -u)/com.malicious

launchctl bootstrap system/ /Library/LaunchDaemons/com.malicious.plist
launchctl bootout system/com.malicious
launchctl enable system/com.malicious
launchctl disable system/com.malicious
launchctl kickstart -k system/com.malicious

echo "=== System Daemons ===" && ls -la /Library/LaunchDaemons/ && echo ""
echo "=== System Agents ===" && ls -la /Library/LaunchAgents/ && echo ""
echo "=== User Agents ===" && ls -la ~/Library/LaunchAgents/ && echo ""
echo "=== Loaded Services ===" && launchctl list 2>/dev/null | head -50
echo "=== Suspicious Labels ===" && launchctl list 2>/dev/null | grep -iE "(update|service|helper|agent|daemon)" | grep -v com.apple

plutil -p /Library/LaunchDaemons/com.apple.alf.agent.plist 2>/dev/null
diff <(plutil -p /Library/LaunchDaemons/com.apple.alf.agent.plist) \
     <(plutil -p /Library/LaunchDaemons/com.suspicious.plist)

osascript -e 'tell application "System Events" to make login item at end with properties {path:"/Applications/Malicious.app", hidden:false}'

osascript -e 'tell application "System Events" to get the name of every login item'
ls -la ~/Library/Application\ Support/com.apple.loginitems/
plutil -p ~/Library/Preferences/com.apple.loginitems.plist 2>/dev/null

import ServiceManagement

func registerMaliciousService() {
    let service = SMAppService.loginItem(identifier: "com.malicious.helper")
    do {
        try service.register()
    } catch {
        print("Registration failed: \(error)")
    }
}

sfltool dumpbtm 2>/dev/null
ls -la /private/var/db/com.apple.backgroundtaskmanagement/
plutil -p /private/var/db/com.apple.backgroundtaskmanagement/*.plist 2>/dev/null

sfltool dumpbtm | grep -i "BundleIdentifier"
ls -la /private/var/db/com.apple.backgroundtaskmanagement/BackgroundItems-v4.btm

sfltool resetbtm 2>/dev/null
log show --predicate 'eventMessage contains "SMAppService"' --last 7d --style compact
log show --predicate 'process == "btmd"' --last 24h

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadType</key>
            <string>com.apple.loginwindow</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>PayloadIdentifier</key>
            <string>com.malicious.loginwindow</string>
            <key>com.apple.loginwindow.DisablePassword_autofill</key>
            <true/>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>Enterprise Security Update</string>
    <key>PayloadIdentifier</key>
    <string>com.malicious.profile</string>
    <key>PayloadOrganization</key>
    <string>Apple Inc.</string>
    <key>PayloadRemovalDisallowed</key>
    <true/>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>12345678-1234-1234-1234-123456789012</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

profiles show -type configuration
profiles list -type all
profiles list -output stdout-xml

profiles status -type enrollment
profiles show -type enrollment
defaults read /Library/Preferences/com.apple.MCX 2>/dev/null

profiles list -type configuration -output stdout-xml | \
    plutil -p - 2>/dev/null

profiles show -type configuration 2>&1 | \
    grep -A5 "PayloadIdentifier\|PayloadDisplayName\|PayloadOrganization"

sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \
    "INSERT INTO access (client,service,auth_value,auth_reason,auth_version,indirect_object_identifier_type,indirect_object_identifier,flags,system_version) \
    VALUES ('/Library/Application Support/.malicious/app','kTCCServiceAccessibility',2,0,1,0,'UNUSED',0,'23.0.0');"

sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db \
    "SELECT client, service, auth_value, auth_reason FROM access WHERE auth_value=2 ORDER BY client;"

sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \
    "SELECT client, service, auth_value FROM access WHERE auth_value=2 AND client NOT LIKE '%com.apple%';"

sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" \
    "SELECT client, service, auth_value FROM access WHERE service='kTCCServiceSystemPolicyAllFiles';"

sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db \
    "SELECT client, service, auth_value FROM access WHERE service='kTCCServiceSystemPolicyAllFiles';"

sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db \
    "SELECT client, service, auth_value FROM access WHERE service='kTCCServiceAccessibility';"

tccutil reset Accessibility
tccutil reset ScreenCapture
log show --predicate 'subsystem == "com.apple.TCC"' --last 24h
log show --predicate 'eventMessage contains "TCC"' --last 1h --style compact

for db in ~/Library/Application\ Support/com.apple.TCC/TCC.db \
          /Library/Application\ Support/com.apple.TCC/TCC.db; do
    if [ -f "$db" ]; then
        echo "Checking: $db"
        stat -f "%Sm %Su" "$db"
        sqlite3 "$db" "SELECT client, service, auth_value FROM access WHERE auth_value=2;" 2>/dev/null
    fi
done

codesign --force --deep --sign - /Applications/Suspicious.app
codesign -dv --verbose=4 /Applications/Suspicious.app
spctl --assess --verbose /Applications/Suspicious.app

spctl --status
spctl --assess --type execute --verbose /path/to/binary
spctl --assess --type execute --verbose --ignore-cache /path/to/binary

xattr -l /Applications/Downloaded.app
xattr -p com.apple.quarantine /Applications/Downloaded.app
xattr -d com.apple.quarantine /Applications/Downloaded.app
xattr -cr /Applications/Downloaded.app

find /Applications -name "*.app" -exec xattr -l {} \; 2>/dev/null | grep -B5 "com.apple.quarantine"
find ~/Downloads -type f -exec xattr -l {} \; 2>/dev/null | head -50

spctl --master-disable
spctl --master-enable
spctl --list --type execute 2>/dev/null | head -20

csrutil status
spctl --status
log show --predicate 'process == "syspolicyd"' --last 24h --style compact | \
    grep -i "reject\|deny\|block" | head -20

kextstat | grep -v com.apple
kextstat -l | grep -v "com.apple"
systemextensionsctl list 2>/dev/null

ls -la /Library/Extensions/
kmutil log show --filter subsystem == "com.apple.kext" 2>/dev/null | head -30
kmutil dumpstate 2>/dev/null | head -50

systemextensionsctl list 2>/dev/null
systemextensionsctl uninstall <team-id> <extension-id>
log show --predicate 'subsystem == "com.apple.system-extension"' --last 7d

systemextensionsctl list 2>&1
log show --predicate 'subsystem == "com.apple.DriverKit"' --last 7d
ls -la /Library/SystemExtensions/

crontab -l
crontab -e
echo "*/5 * * * * /Library/Application Support/.hidden/backdoor.sh" | crontab -

ls -la /var/at/tabs/
cat /var/at/tabs/*
cat /etc/crontab
ls -la /etc/cron.*

atq
atrm 1
echo "/Library/Application Support/.hidden/payload.sh" | at now + 5 minutes

ls -la /etc/periodic/
ls -la /etc/periodic/daily/
ls -la /etc/periodic/weekly/
ls -la /etc/periodic/monthly/
cat /etc/periodic/daily/*

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.apple.periodic.maintenance</string>
    <key>ProgramArguments</key>
    <array>
        <string>/Library/Application Support/.hidden/payload</string>
    </array>
    <key>StartInterval</key>
    <integer>3600</integer>
    <key>RunAtLoad</key>
    <true/>
</dict>
</plist>

echo "=== User crontab ===" && crontab -l 2>/dev/null
echo "=== System crontab ===" && cat /etc/crontab 2>/dev/null
echo "=== at jobs ===" && atq 2>/dev/null
echo "=== periodic ===" && find /etc/periodic -type f -exec ls -la {} \;
echo "=== launchd timers ===" && launchctl list 2>/dev/null | grep -v "com.apple"
echo "=== login items ===" && osascript -e 'tell application "System Events" to get name of every login item' 2>/dev/null

SELECT path, name, username, groupname, mode, atime, mtime, ctime,
       CASE
           WHEN path LIKE '/Library/LaunchDaemons/%' THEN 'system_daemon'
           WHEN path LIKE '/Library/LaunchAgents/%' THEN 'system_agent'
           WHEN path LIKE '%/Library/LaunchAgents/%' THEN 'user_agent'
           ELSE 'unknown'
       END as persistence_type
FROM file
WHERE (path LIKE '/Library/LaunchDaemons/%'
    OR path LIKE '/Library/LaunchAgents/%'
    OR path LIKE '%/Library/LaunchAgents/%')
  AND path NOT LIKE '/System/Library/%'
  AND name LIKE '%.plist'
ORDER BY mtime DESC;

SELECT kext_path, kext_id, kext_version, kext_daemon
FROM kernel_extensions
WHERE kext_path NOT LIKE '%com.apple.%'
  AND kext_path NOT LIKE '%/System/Library/%';

SELECT username, event, command, minutes, hours, day_of_month, month, day_of_week
FROM crontab;

SELECT identifier, name, version, path, category
FROM system_extensions
WHERE identifier NOT LIKE 'com.apple.%';

SELECT client, service, auth_value,
       CASE auth_value
           WHEN 0 THEN 'denied'
           WHEN 1 THEN 'not_determined'
           WHEN 2 THEN 'allowed'
       END as status
FROM access
WHERE auth_value = 2
  AND client NOT LIKE 'com.apple.%'
  AND client NOT LIKE '%/usr/libexec/%';

#!/bin/bash
echo "=========================================="
echo "  macOS Persistence Hunter v1.0"
echo "=========================================="

echo "[*] Checking LaunchDaemons..."
ls -la /Library/LaunchDaemons/ 2>/dev/null | grep -v "^total"

echo "[*] Checking LaunchAgents..."
ls -la /Library/LaunchAgents/ 2>/dev/null | grep -v "^total"
ls -la ~/Library/LaunchAgents/ 2>/dev/null | grep -v "^total"

echo "[*] Checking loaded services for persistence..."
launchctl list 2>/dev/null | grep -v "com.apple" | grep -v "^\s*$"

echo "[*] Checking SIP status..."
csrutil status 2>/dev/null

echo "[*] Checking Gatekeeper status..."
spctl --status 2>/dev/null

echo "[*] Checking for ad-hoc signed binaries in applications..."
find /Applications -name "*.app" -exec sh -c '
    for app; do
        sig=$(codesign -dv "$app" 2>&1 | grep "Signature=")
        if echo "$sig" | grep -q "adhoc"; then
            echo "[!] Ad-hoc signed: $app"
        fi
    done
' sh {} + 2>/dev/null

echo "[*] Checking TCC.db for non-Apple Full Disk Access..."
sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" \
    "SELECT client, service, auth_value FROM access WHERE auth_value=2 AND service='kTCCServiceSystemPolicyAllFiles' AND client NOT LIKE 'com.apple.%';" 2>/dev/null

echo "[*] Checking for suspicious cron entries..."
crontab -l 2>/dev/null | grep -v "^#" | grep -v "^$"
cat /etc/crontab 2>/dev/null | grep -v "^#" | grep -v "^$"

echo "[*] Checking periodic scripts..."
find /etc/periodic -type f ! -name "README" 2>/dev/null

echo "[*] Checking System Extensions..."
systemextensionsctl list 2>/dev/null | grep -v "com.apple"

echo "[*] Checking KEXTs..."
kextstat 2>/dev/null | grep -v "com.apple"

echo "[*] Checking login items..."
osascript -e 'tell application "System Events" to get name of every login item' 2>/dev/null

echo "[*] Checking DYLD_INSERT_LIBRARIES..."
defaults read .GlobalPreferences 2>/dev/null | grep -i "dyld"
env | grep -i "dyld"
launchctl print system/ 2>/dev/null | grep -i "DYLD"

echo "[*] Checking Profiles..."
profiles list -type configuration 2>/dev/null

echo "[*] Checking BTM (Background Task Management)..."
sfltool dumpbtm 2>/dev/null | head -50

echo ""
echo "=========================================="
echo "  Scan complete. Review findings above."
echo "=========================================="

#!/usr/bin/env python3
import os
import subprocess
import sqlite3
import plistlib
import json
from pathlib import Path

class MacPersistenceScanner:
    def __init__(self):
        self.findings = []
        self.persistence_paths = {
            "system_daemon": "/Library/LaunchDaemons/",
            "system_agent": "/Library/LaunchAgents/",
            "user_agent": str(Path.home() / "Library/LaunchAgents/"),
        }

    def scan_launchd(self):
        results = []
        for ptype, path in self.persistence_paths.items():
            if not os.path.exists(path):
                continue
            for f in os.listdir(path):
                if not f.endswith(".plist"):
                    continue
                full_path = os.path.join(path, f)
                try:
                    with open(full_path, "rb") as fp:
                        plist_data = plistlib.load(fp)
                    label = plist_data.get("Label", "unknown")
                    program = plist_data.get("ProgramArguments", [])
                    run_at_load = plist_data.get("RunAtLoad", False)
                    keep_alive = plist_data.get("KeepAlive", False)
                    risk = "low"
                    if any(t in full_path for t in ["/tmp/", "/dev/"]):
                        risk = "critical"
                    elif keep_alive and not any(app in label for app in ["com.apple."]):
                        risk = "high"
                    elif program and not any(app in program[0] if program else "" for app in ["/usr/", "/bin/", "/sbin/", "/System/"]):
                        risk = "medium"
                    results.append({
                        "type": ptype,
                        "path": full_path,
                        "label": label,
                        "program": program,
                        "RunAtLoad": run_at_load,
                        "KeepAlive": keep_alive,
                        "risk": risk,
                    })
                except Exception as e:
                    results.append({"type": ptype, "path": full_path, "error": str(e)})
        return results

    def scan_tcc(self):
        results = []
        db_paths = [
            "/Library/Application Support/com.apple.TCC/TCC.db",
            str(Path.home() / "Library/Application Support/com.apple.TCC/TCC.db"),
        ]
        high_risk_services = [
            "kTCCServiceSystemPolicyAllFiles",
            "kTCCServiceAccessibility",
            "kTCCServiceScreenCapture",
        ]
        for db_path in db_paths:
            if not os.path.exists(db_path):
                continue
            try:
                conn = sqlite3.connect(f"file:{db_path}?mode=ro", uri=True)
                cursor = conn.cursor()
                cursor.execute(
                    "SELECT client, service, auth_value FROM access WHERE auth_value=2"
                )
                for client, service, auth_value in cursor.fetchall():
                    is_apple = "com.apple" in client or "/usr/libexec/" in client
                    risk = "normal" if is_apple else "high"
                    if service in high_risk_services and not is_apple:
                        risk = "critical"
                    results.append({
                        "db": db_path,
                        "client": client,
                        "service": service,
                        "risk": risk,
                    })
                conn.close()
            except Exception as e:
                results.append({"db": db_path, "error": str(e)})
        return results

    def scan_gatekeeper(self):
        results = []
        try:
            output = subprocess.check_output(
                ["spctl", "--status"], text=True, stderr=subprocess.DEVNULL
            ).strip()
            if "assessments disabled" in output.lower():
                results.append({"check": "gatekeeper", "status": "disabled", "risk": "critical"})
            else:
                results.append({"check": "gatekeeper", "status": "enabled", "risk": "normal"})
        except Exception:
            results.append({"check": "gatekeeper", "status": "unknown"})
        try:
            output = subprocess.check_output(
                ["csrutil", "status"], text=True, stderr=subprocess.DEVNULL
            ).strip()
            if "disabled" in output.lower():
                results.append({"check": "sip", "status": "disabled", "risk": "critical"})
            else:
                results.append({"check": "sip", "status": "enabled", "risk": "normal"})
        except Exception:
            results.append({"check": "sip", "status": "unknown"})
        return results

    def scan_cron(self):
        results = []
        try:
            output = subprocess.check_output(["crontab", "-l"], text=True, stderr=subprocess.DEVNULL)
            for line in output.strip().split("\n"):
                line = line.strip()
                if line and not line.startswith("#"):
                    risk = "high" if "/tmp/" in line or "/dev/" in line else "medium"
                    results.append({"type": "user_cron", "entry": line, "risk": risk})
        except Exception:
            pass
        try:
            with open("/etc/crontab", "r") as f:
                for line in f:
                    line = line.strip()
                    if line and not line.startswith("#"):
                        results.append({"type": "system_cron", "entry": line, "risk": "high"})
        except Exception:
            pass
        return results

    def scan_kexts(self):
        results = []
        try:
            output = subprocess.check_output(
                ["kextstat"], text=True, stderr=subprocess.DEVNULL
            )
            for line in output.strip().split("\n"):
                if "com.apple" not in line and "index" not in line:
                    results.append({"type": "third_party_kext", "entry": line.strip(), "risk": "medium"})
        except Exception:
            pass
        return results

    def scan_profiles(self):
        results = []
        try:
            output = subprocess.check_output(
                ["profiles", "list", "-type", "configuration"],
                text=True,
                stderr=subprocess.DEVNULL,
            )
            for line in output.strip().split("\n"):
                if "Identifier:" in line or "Name:" in line:
                    is_apple = "com.apple" in line.lower()
                    risk = "normal" if is_apple else "medium"
                    results.append({"type": "profile", "entry": line.strip(), "risk": risk})
        except Exception:
            pass
        return results

    def run_full_scan(self):
        report = {
            "launchd": self.scan_launchd(),
            "tcc": self.scan_tcc(),
            "gatekeeper": self.scan_gatekeeper(),
            "cron": self.scan_cron(),
            "kexts": self.scan_kexts(),
            "profiles": self.scan_profiles(),
        }
        return report

    def print_report(self, report):
        risk_emoji = {"critical": "🔴", "high": "🟡", "medium": "🟡", "low": "🟢", "normal": "🟢"}
        print("=" * 60)
        print("  macOS Persistence Scan Report")
        print("=" * 60)
        for category, findings in report.items():
            print(f"\n--- {category.upper()} ---")
            if not findings:
                print("  No findings.")
                continue
            for finding in findings:
                risk = finding.get("risk", "normal")
                emoji = risk_emoji.get(risk, "⚪")
                if "error" in finding:
                    print(f"  ⚪ {finding.get('path', finding.get('db', 'unknown'))}: {finding['error']}")
                else:
                    label = finding.get("label", finding.get("client", finding.get("entry", finding.get("status", "unknown"))))
                    path_info = finding.get("path", finding.get("db", ""))
                    print(f"  {emoji} [{risk.upper()}] {label}")
                    if path_info:
                        print(f"       Path: {path_info}")
                    if "program" in finding and finding["program"]:
                        print(f"       Program: {' '.join(finding['program'])}")

if __name__ == "__main__":
    scanner = MacPersistenceScanner()
    report = scanner.run_full_scan()
    scanner.print_report(report)
    json_path = "/tmp/mac_persistence_scan.json"
    with open(json_path, "w") as f:
        json.dump(report, f, indent=2)
    print(f"\n[*] JSON report saved to: {json_path}")

sudo santactl rule list
sudo santactl rule add --path /Library/Application Support/.hidden/backdoor --decision block --reason "Detected during incident response"
sudo santactl rule add --path /Applications/Suspicious.app --decision block --reason "Ad-hoc signed, unknown origin"

defaults read com.google.santa 2>/dev/null
cat /var/db/santa/rules.db 2>/dev/null
log show --predicate 'subsystem == "com.google.santa"' --last 24h | \
    grep -i "block\|deny" | head -20

# 检查 LaunchAgent
ls -la ~/Library/LaunchAgents/
cat ~/Library/LaunchAgents/com.apple.xcs.listener.plist

# 检查 Xcode 项目文件
grep -r "Run Script" ~/Library/Developer/Xcode/DerivedData/
find ~ -name "*.xcodeproj" -exec grep -l "malicious_script" {} \;

# 检查 TCC 权限
sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db \
    "SELECT client, service FROM access WHERE auth_value=2;"

# 检查 LaunchAgent
ls -la ~/Library/LaunchAgents/
cat ~/Library/LaunchAgents/com.apple.xcs.helper.plist 2>/dev/null

# 检查 DMG 挂载历史
log show --predicate 'eventMessage contains "hdiutil"' --last 30d

# 检查浏览器数据访问
sqlite3 ~/Library/Application\ Support/Google/Chrome/Default/Cookies \
    "SELECT count(*) FROM cookies;" 2>/dev/null

# 检查 xattr 移除记录
log show --predicate 'eventMessage contains "xattr"' --last 7d

# 检查 DYLD 注入
defaults read .GlobalPreferences 2>/dev/null | grep -i dyld
launchctl print system/ 2>/dev/null | grep -i "DYLD"

# 检查 /etc/launchd.conf（已废弃但可残留）
cat /etc/launchd.conf 2>/dev/null

# 检查异常 LaunchDaemon
ls -la /Library/LaunchDaemons/
plutil -p /Library/LaunchDaemons/com.java.update.plist 2>/dev/null

# 检查系统库注入
file /usr/lib/libcurl.3.dylib 2>/dev/null
md5 /usr/lib/libcurl.3.dylib 2>/dev/null