How to Hack a MacOS Application

๐Ÿ” Introduction

โ€œHow to Hack a MacOS Applicationโ€์€ Apple์˜ MacOS์—์„œ ๋™์ž‘ํ•˜๋Š” ์–ดํ”Œ๋ฆฌ์ผ€์ด์…˜์„ ํ…Œ์ŠคํŒ…ํ•˜๋Š” ๋ฐฉ๋ฒ•์ž…๋‹ˆ๋‹ค. ์ „๋ฐ˜์ ์ธ ํ…Œ์ŠคํŒ… ๋ฉ”์ปค๋‹ˆ์ฆ˜๊ณผ ํ™˜๊ฒฝ ๊ตฌ์„ฑ์— ๋Œ€ํ•œ ๋‚ด์šฉ์„ ์ฃผ๋กœ ๋‹ค๋ฃน๋‹ˆ๋‹ค.

Directory Structure

Application

Application ๋””๋ ‰ํ† ๋ฆฌ๋Š” ์‹ค์ œ ์•ฑ ํŒŒ์ผ๊ณผ ๋ฉ”๋‹ˆํŽ˜์ŠคํŠธ ์ •๋ณด๊ฐ€ ์œ„์น˜ํ•ฉ๋‹ˆ๋‹ค. MacOS ์•ฑ ๋ถ„์„ ์‹œ CLI ๋„๊ตฌ๋ฅผ ํ†ตํ•ด์„œ ์ฒดํฌํ•˜๋Š” ๋ถ€๋ถ„๋„ ๋งŽ์€๋ฐ, ์ด ๋•Œ ํ•ด๋‹น ๋””๋ ‰ํ† ๋ฆฌ์˜ ๋ฐ”์ด๋„ˆ๋ฆฌ๋ฅผ ํ™œ์šฉํ•ฉ๋‹ˆ๋‹ค.

/Applications/<APP NAME>/Contents
  • Info.plist: ํŒจํ‚ค์ง€์— ๋Œ€ํ•œ ์ž์„ธํ•œ ์ •๋ณด
  • MacOS: ์‹ค์ œ ์•ฑ ์‹คํ–‰์— ์‚ฌ์šฉ๋˜๋Š” ๋ฐ”์ด๋„ˆ๋ฆฌ๊ฐ€ ์œ„์น˜ํ•œ ๋””๋ ‰ํ† ๋ฆฌ
  • PkgInfo: ํŒจํ‚ค์ง€ ์ •๋ณด
  • _CodeSignature: ์„œ๋ช…
  • Frameworks: ์•ฑ์— ์‚ฌ์šฉ๋œ ํ”„๋ ˆ์ž„์›Œํฌ๋“ค
  • Resources: ๋ฆฌ์†Œ์Šค ๋””๋ ‰ํ† ๋ฆฌ
  • CodeResources: ์ฝ”๋“œ ๋ฆฌ์†Œ์Šค

Data

Data ๋””๋ ‰ํ† ๋ฆฌ๋Š” ์•ฑ์ด ์‚ฌ์šฉํ•˜๋Š” ๋ฐ์ดํ„ฐ๋“ค์ด ๋ชจ์ธ ๋””๋ ‰ํ† ๋ฆฌ์ž…๋‹ˆ๋‹ค. ๋Œ€ํ‘œ์ ์œผ๋กœ Cache, Local DB ๋“ฑ์ด ์žˆ๊ณ  ํ•ด๋‹น ๋””๋ ‰ํ† ๋ฆฌ๋„ ์ž์„ธํ•˜๊ฒŒ ์ฒดํฌํ•ด์•ผํ•  ๋””๋ ‰ํ† ๋ฆฌ์ž…๋‹ˆ๋‹ค.

/Users/<USER NAME>/Library/Application Support/<APP NAME>

๐Ÿ—ก Hack Mechanism

File system

์œ„ Directory Structure์—์„œ ์ด์•ผ๊ธฐํ•œ 2๊ฐœ์˜ ๋””๋ ‰ํ† ๋ฆฌ๋Š” ์ •๋ง ์ค‘์š”ํ•ฉ๋‹ˆ๋‹ค. ํ•ด๋‹น ๋””๋ ‰ํ† ๋ฆฌ์—์„œ ๋ถ„์„์— ํ•„์š”ํ•œ ์ „๋ฐ˜์ ์ธ ์ •๋ณด๋ฅผ ์–ป์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

  • /Applications/<APP NAME>/Contents
  • /Users/<USER NAME>/Library/Application Support/<APP NAME>

Info.plist

/Applications/<APP NAME>/Contents์— ์žˆ๋Š” Info.plist๋Š” ์•ฑ์— ๋Œ€ํ•œ ์ •๋ณด๋ฅผ ๋‹ด๊ณ ์žˆ๋Š” plist(xml) ํŒŒ์ผ์ž…๋‹ˆ๋‹ค. plist ํŒŒ์ผ์ด ๋–„๋ฌธ์— plutil ๋“ฑ์œผ๋กœ ํ™•์ธํ•ด์•ผ ์ •์ƒ์ ์ธ ๋‚ด์šฉ์„ ๋ณผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

plutil -p Info.plist

Notion ์•ฑ ์˜ˆ์‹œ

{
  "BuildMachineOSBuild" => "19F101"
  "CFBundleDisplayName" => "Notion"
  "CFBundleExecutable" => "Notion"
  "CFBundleIconFile" => "electron.icns"
  "CFBundleIdentifier" => "notion.id"
  "CFBundleInfoDictionaryVersion" => "6.0"
  "CFBundleName" => "Notion"
  "CFBundlePackageType" => "APPL"
  "CFBundleShortVersionString" => "2.0.22"
  "CFBundleURLTypes" => [
    0 => {
      "CFBundleURLName" => "notion"
      "CFBundleURLSchemes" => [
        0 => "notion"
      ]
    }
  ]
  "CFBundleVersion" => "2.0.22"
  "DTCompiler" => "com.apple.compilers.llvm.clang.1_0"
  "DTSDKBuild" => "11.0"
  "DTSDKName" => "macosx11.0"
  "DTXcode" => "1220"
  "DTXcodeBuild" => "12B45b"
  "LSApplicationCategoryType" => "public.app-category.productivity"
  "LSMinimumSystemVersion" => "10.10.0"
  "NSBluetoothAlwaysUsageDescription" => "This app needs access to Bluetooth"
  "NSBluetoothPeripheralUsageDescription" => "This app needs access to Bluetooth"
  "NSCameraUsageDescription" => "This app needs access to the camera"
  "NSHighResolutionCapable" => 1
  "NSMainNibFile" => "MainMenu"
  "NSMicrophoneUsageDescription" => "This app needs access to the microphone"
  "NSPrincipalClass" => "AtomApplication"
  "NSQuitAlwaysKeepsWindows" => 0
  "NSRequiresAquaSystemAppearance" => 0
  "NSSupportsAutomaticGraphicsSwitching" => 1
}

๋ฒ„์ „, ํŒจํ‚ค์ง€ ์ด๋ฆ„์„ ๋น„๋กฏํ•˜์—ฌ, CFBundleURLSchemes์—์„œ ์•ฑ์˜ ์Šคํ‚ด ์ด๋ฆ„, ๊ทธ๋ฆฌ๊ณ  ๊ฐœ๋ฐœ์ž๊ฐ€ ์ €์žฅํ•ด๋‘” ์ผ๋ถ€ ์ •๋ณด๋ฅผ ๋ณด์‹ค ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

Strings to Binary

strings ๋ช…๋ น์€ ๋ฐ”์ด๋„ˆ๋ฆฌ ๋‚ด ๋ฌธ์ž์—ด์„ ์ถ”์ถœํ•˜๋Š” ๋ช…๋ น์ž…๋‹ˆ๋‹ค. ์ด๋ฅผ ํ†ตํ•ด ๋ฐ”์ด๋„ˆ๋ฆฌ์— ์ €์žฅ๋œ ๋ฌธ์ž์—ด์„ ์ถ”์ถœํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

strings ./MacOS/Notion

๋•Œ๋–„๋กœ ์ค‘์š”ํ•œ API Endpoint๋‚˜ ํ‚ค ๊ฐ’์ด ๋…ธ์ถœ๋˜๊ธฐ๋„ ํ•ฉ๋‹ˆ๋‹ค.

API Testing

MacOS Application ๋˜ํ•œ Web ๊ธฐ๋ฐ˜์˜ API๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๊ณ  ์ตœ๊ทผ์—๋Š” Electron app ๋“ฑ ์›น์„ ์‚ฌ์šฉํ•˜๋Š” ์•ฑ์˜ ๋น„์ค‘์ด ๋†’๊ธฐ ๋–„๋ฌธ์— ๊ธฐ์กด Web Application ํ…Œ์ŠคํŒ…๊ณผ ๋™์ผํ•˜๊ฒŒ ๋ณด์•ˆ ํ…Œ์ŠคํŒ…์„ ์ง„ํ–‰ํ•ฉ๋‹ˆ๋‹ค.

์ด๋ฅผ ์œ„ํ•ด์„  ์‹œ์Šคํ…œ ํ”„๋ก์‹œ ์„ค์ •์œผ๋กœ MacOS Application์—์„œ ๋ฐœ์ƒํ•˜๋Š” ํŠธ๋ž˜ํ”ฝ์ด ZAP์ด๋‚˜ Burpsuite ๋“ฑ Proxy ๋„๊ตฌ๋ฅผ ๊ฑฐ์ณ๊ฐ€๋„๋ก ๊ตฌ์„ฑํ•ด์•ผํ•ฉ๋‹ˆ๋‹ค. ๊ตฌ์„ฑ์— ๋Œ€ํ•œ ์ž์„ธํ•œ ๋‚ด์šฉ์€ ์•„๋ž˜ Environment > Set Proxy ๋ถ€๋ถ„์„ ํ™•์ธํ•ด์ฃผ์„ธ์š”.

Check Listen Port

Listen Port๋ฅผ ์ฒดํฌํ•˜๋Š” ๊ฒƒ์€ ๊ฐ„๋‹จํ•˜์ง€๋งŒ ์ค‘์š”ํ•œ ๊ณผ์ •์ž…๋‹ˆ๋‹ค. ๋ณดํ†ต listen port๋Š” netstat์„ ์ƒ๊ฐํ•˜์ง€๋งŒ lsof ๋ช…๋ น์œผ๋กœ PID์™€ Application ์ด๋ฆ„์„ ๊ฐ™์ด ํ™•์ธํ•˜๋Š” ๊ฒƒ์ด ๊ฐ€๋…์„ฑ์ด ์ข‹์Šต๋‹ˆ๋‹ค.

lsof -iTCP -sTCP:LISTEN -n -P

e.g

lsof -iTCP -sTCP:LISTEN -n -P
COMMAND     PID   USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
rapportd    500 hahwul    5u  IPv4 0xe46fe57c5b35640d      0t0  TCP *:64356 (LISTEN)
rapportd    500 hahwul    6u  IPv6 0xe46fe57c5be4c6ad      0t0  TCP *:64356 (LISTEN)
....
com.docke 33499 hahwul   11u  IPv4 0xe46fe57c5b33f6d5      0t0  TCP 127.0.0.1:62604 (LISTEN)
Notion    96251 hahwul   35u  IPv4 0xe46fe57c5b33c40d      0t0  TCP 127.0.0.1:52981 (LISTEN)

์ด๋ฅผ ํ†ตํ•ด ๊ฐ App์ด Listen ์ƒํƒœ๋กœ ์žˆ๋Š” Port๋ฅผ ํ™•์ธํ•  ์ˆ˜ ์žˆ๊ณ , ์ด๋Š” ์ถ”๊ฐ€์ ์ธ ํ…Œ์ŠคํŒ…์˜ ์ข‹์€ Endpoint๊ฐ€ ๋ฉ๋‹ˆ๋‹ค.

  • HTTP ๊ธฐ๋ฐ˜ ํฌํŠธ์˜ ๊ฒฝ์šฐ ์›น ๊ธฐ๋ฐ˜์œผ๋กœ ํ…Œ์ŠคํŒ…ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.
  • Socket ๊ธฐ๋ฐ˜ ํฌํŠธ์˜ ๊ฒฝ์šฐ Fuzzing ๋“ฑ์œผ๋กœ ์˜ค๋™์ž‘์„ ์œ ๋„ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

์ฐธ๊ณ ๋กœ ์ด๋ ‡๊ฒŒ ๋กœ์ปฌ ํฌํŠธ๋ฅผ ์—ด๊ณ  ์žˆ๋Š” ์•ฑ์€ ์ƒ๊ฐ๋ณด๋‹ค ๋งŽ์Šต๋‹ˆ๋‹ค ๐Ÿค”

Log Analysis

MacOS Application ๋˜ํ•œ iOS App๊ณผ ๋™์ผํ•˜๊ฒŒ Console ์•ฑ์œผ๋กœ ๋กœ๊ทธ๋ฅผ ๋ฐ›์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

Reverse Engineering

MacOS Application์€ ์ตœ์ข…์ ์œผ๋กœ ๋ฐ”์ด๋„ˆ๋ฆฌ๋กœ ์ปดํŒŒ์ผ๋˜์–ด ๋™์ž‘ํ•˜๊ธฐ ๋•Œ๋ฌธ์— Windows๋‚˜ Linux Application๊ณผ ๋™์ผํ•˜๊ฒŒ Reverse Engineering์ด ๊ฐ€๋Šฅํ•ฉ๋‹ˆ๋‹ค. IDA๋‚˜ Ghidra, Frida๋ฅผ ํ†ตํ•ด ์–ดํ”Œ๋ฆฌ์ผ€์ด์…˜์˜ ํ๋ฆ„์„ ๋ถ„์„ํ•˜๊ณ  ์ˆจ๊ฒจ์ง„ ๊ด€๋ฆฌ ๊ธฐ๋Šฅ์ด๋‚˜ ๋ฉ”๋ชจ๋ฆฌ ๋‹จ ์ทจ์•ฝ์ ์„ ์ฐพ์„ ์ˆ˜๋„ ์žˆ์Šต๋‹ˆ๋‹ค.

๐Ÿ›  Environment

Set Proxy

Certificate

Proxy ์„ค์ •๋ณด๋‹ค ๋จผ์ € ์ธ์ฆ์„œ ์„ค์ •(RootCA)์„ ํ•˜๋Š” ๊ฒƒ์ด ์ข‹์Šต๋‹ˆ๋‹ค. ์‚ฌ์šฉํ•˜์‹œ๋Š” ๋„๊ตฌ(ZAP or Burp ๋“ฑ) ์—์„œ ์ธ์ฆ์„œ ํŒŒ์ผ์„ ์ƒ์„ฑํ•˜์—ฌ ๋‹ค์šด๋กœ๋“œํ•œ ํ›„ ํŒŒ์ผ์„ ๋”๋ธ”ํด๋ฆญ ํ•˜๊ฑฐ๋‚˜ ํ‚ค์ฒด์ธ ์•ฑ์„ ํ†ตํ•ด ์ธ์ฆ์„œ ํŒŒ์ผ์„ ๋“ฑ๋กํ•ฉ๋‹ˆ๋‹ค. ์ดํ›„ ํ•ด๋‹น ์ธ์ฆ์„œ๋Š” ๋ชจ๋‘ ์‹ ๋ขฐ ์„ค์ • ๋˜์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.

Use System Proxy

์‹œ์Šคํ…œ ์„ค์ • > ๋„คํŠธ์›Œํฌ > ๊ณ ๊ธ‰(ํ˜„์žฌ ์—ฐ๊ฒฐ๋œ ๋„คํŠธ์›Œํฌ์˜ ์ƒ์„ธ ์„ค์ •) > ํ”„๋ก์‹œ > ์›น ํ”„๋ก์‹œ(HTTP)์™€ ๋ณด์•ˆ ์›น ํ”„๋ก์‹œ(HTTPS) ์—์„œ ์‹œ์Šคํ…œ ํ”„๋ก์‹œ๋ฅผ ์„ค์ •ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

Use Proxychains

Proxychains๋Š” ์‹œ์Šคํ…œ ํ”„๋ก์‹œ๋ฅผ ์ค‘๊ฐœํ•ด์ฃผ๋Š” ๋„๊ตฌ์ž…๋‹ˆ๋‹ค. ๊ธฐ๋ณธ๊ฐ’์€ Tor network๋ฅผ ์‚ฌ์šฉํ•˜๋„๋ก ๋˜์–ด ์žˆ์–ด์„œ IP ์šฐํšŒ ๋“ฑ์— ์‚ฌ์šฉ๋˜์ง€๋งŒ, configuation์„ ํ†ตํ•ด ์ง€์ •ํ•œ ํ”„๋ก์‹œ๋กœ ํ†ต์‹ ํ•  ์ˆ˜ ์žˆ๋„๋ก ๊ตฌ์„ฑ์ด ๊ฐ€๋Šฅํ•˜๊ธฐ ๋•Œ๋ฌธ์— ํ™˜๊ฒฝ ์„ค์ • ํ›„ ์‚ฌ์šฉ ์‹œ ๋งค์šฐ ํŽธ๋ฆฌํ•˜๊ฒŒ ์“ธ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

์„ค์น˜๋Š” homebrew ํ†ตํ•ด์„œ ์ง„ํ–‰ํ•ด์ค๋‹ˆ๋‹ค.

brew install proxychains-ng
Usage:	proxychains4 -q -f config_file program_name [arguments]
	-q makes proxychains quiet - this overrides the config setting
	-f allows one to manually specify a configfile to use
	for example : proxychains telnet somehost.com
More help in README file

Configuration ํŒŒ์ผ์€ /usr/local/etc/proxychains.conf ๊ฒฝ๋กœ์— ์žˆ์Šต๋‹ˆ๋‹ค. vim์œผ๋กœ ์—ด์–ด์„œ ์‚ฌ์šฉํ•  proxy ํฌํŠธ์™€ ์„œ๋น„์Šค๋ฅผ ์ง€์ •ํ•ฉ๋‹ˆ๋‹ค.

vim /usr/local/etc/proxychains.conf
http    127.0.0.1       8090

์ดํ›„ proxychains4 ๋ช…๋ น์„ ํ†ตํ•ด ์–ดํ”Œ๋ฆฌ์ผ€์ด์…˜ ์‹คํ–‰ ์‹œ ์•ฑ์ด ์ง€์ •ํ•œ Proxy๋กœ ํ†ต์‹ ํ•˜๊ฒŒ ๋ฉ๋‹ˆ๋‹ค.

proxychains4 /Applications/Notion.app/Contents/MacOS/Notion

If use Pulse VPN

ํšŒ์‚ฌ ๋“ฑ์—์„œ VPN์„ ์œ„ํ•ด Pulse๋ฅผ ์‚ฌ์šฉํ•˜๋Š ๊ฒฝ์šฐ ์ผ๋ฐ˜์ ์ธ ์‹œ์Šคํ…œ ์„ค์ •์œผ๋กœ Proxy๊ฐ€ ์ •์ƒ์ ์œผ๋กœ ์žกํžˆ์ง€ ์•Š์Šต๋‹ˆ๋‹ค. ์ด๋Š” Pulse ์ž์ฒด์—์„œ๋„ ํŠธ๋ž˜ํ”ฝ์„ ์ฒ˜๋ฆฌํ•˜๊ธฐ ์œ„ํ•จ์ด๊ธฐ ๋•Œ๋ฌธ์ž…๋‹ˆ๋‹ค. ์ด๋Ÿฌํ•œ ๋ฌธ์ œ๋Š” Pulse ์ชฝ Configuration์„ ์กฐ์ •ํ•˜์—ฌ ํ•ด๊ฒฐํ•  ์ˆ˜ ์žˆ๊ณ , ์ด๋ฅผ ์‰ฝ๊ฒŒํ•  ์ˆ˜ ์žˆ๋Š” psproxy๋ž€ ๋„๊ตฌ๊ฐ€ ์žˆ์Šต๋‹ˆ๋‹ค.

๋จผ์ € npm์„ ํ†ตํ•ด ๋„๊ตฌ๋ฅผ ์„ค์น˜ํ•ฉ๋‹ˆ๋‹ค.

npm i -g psproxy

์ดํ›„ ์•„๋ž˜ ๋ช…๋ น์œผ๋กœ psproxy๋ฅผ ํ™œ์„ฑํ™”ํ•˜์—ฌ Pulse ์‚ฌ์šฉ์ค‘์—๋„ ํŠธ๋ž˜ํ”ฝ์ด ์šฐ๋ฆฌ๊ฐ€ ์˜๋„ํ•œ ๋„๊ตฌ๋กœ ํ˜๋Ÿฌ๊ฐˆ ์ˆ˜ ์žˆ๋„๋ก ๋ณ€๊ฒฝํ•ฉ๋‹ˆ๋‹ค.

sudo psproxy on

์›๋ณธ ์ƒํƒœ๋กœ ๋˜๋Œ๋ฆฌ๊ธฐ ์œ„ํ•ด์„  ์•„๋ž˜ ๋ช…๋ น์œผ๋กœ ๋ณ€๊ฒฝํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

sudo psproxy off

๐Ÿ“š Articles

  • https://www.hahwul.com/2020/09/18/use-proxy-in-macos-and-pulse-with-psproxy-for-zapburp/
  • https://www.hahwul.com/2021/08/28/mac-listen-port/

๐Ÿ“Œ References

  • none