Mac Hunt THM | Writeup

INTRO

Jake had gained some good knowledge and skills in the game development field. So, he decided to enter the industry through a decent job and upgrade his finances. Little did he know that there were many fake recruiters in search of people looking for jobs. These fake recruiters lure the victim through attractive jobs to achieve their objectives, often to compromise the victim’s machines and use them for malicious purposes. Having conventionally overlooked cyber security, Jake fell prey to such an attack. A well-crafted phishing attack with a promising job offer compromised his Mac machine.

After a series of MacOS forensic analysis rooms, a challenge requiring the analysis of an acquired Mac disk image was released. Try out the room here:

TryHackMe | Mac Hunt

1. What is the name of the most recently accessed folder by the user?

MacOS, like Windows, stores information about the most recently accessed files and folders. Unlike Windows, which stores this in a hierarchical database known as the Windows Registry, MacOS stores all properties in plist files. plist files can be in XML or in BLOB (Binary Large Object) format. The latter requires the plistutil tool to decode and read.

On Windows, you have File Explorer, which shows u the most recently accessed folders on the sidebar. On MacOS, you have the Finder app, which lets you navigate, organise and create new files and folders. The first artefact we need to find is the plist regarding the Finder app, as it includes the FXRecentFolders keys among others.

Location: Users/jake/Library/Preferences/com.apple.finder.plist

This file is in BLOB format. Thus, to read it, we need plistutil. To make it more readable, we can pass in the -p argument to plistutil, which will turn the output into a JSON-like format with indents included.

CMD: plistutil -p com.apple.finder.plist | less

Looking for the key specified above:

ANS: Downloads

2. Which social platform did the attacker use to deliver the document?

Assuming that Jake uses Safari as his default web browser, we can check his browser history, which is stored in a database.

Location: /Users/jake/Library/Safari/History.db

Using SQLitebrowser to view the database:

CMD: sqlitebrowser History.db

We can either run a SQL query using an APOLLO module’s query or view the history_visits table.

APOLLO/modules at master · mac4n6/APOLLO · GitHub

SELECT
  DATETIME(HISTORY_VISITS.VISIT_TIME+978307200,'UNIXEPOCH') AS "VISIT TIME",
  HISTORY_ITEMS.URL AS "URL",
  HISTORY_ITEMS.VISIT_COUNT AS "VISIT COUNT",
  HISTORY_VISITS.TITLE AS "TITLE",
  CASE HISTORY_VISITS.ORIGIN
   WHEN 1 THEN "ICLOUD SYNCED DEVICE"
   WHEN 0 THEN "VISITED FROM THIS DEVICE"
   ELSE HISTORY_VISITS.ORIGIN
  END "ICLOUD SYNC",
  HISTORY_VISITS.LOAD_SUCCESSFUL AS "LOAD SUCCESSFUL",
  HISTORY_VISITS.id AS "VISIT ID",
  HISTORY_VISITS.REDIRECT_SOURCE AS "REDIRECT SOURCE",
  HISTORY_VISITS.REDIRECT_DESTINATION AS "REDIRECT DESTINATION",
  HISTORY_VISITS.ID AS "HISTORY ITEM ID"
 FROM HISTORY_ITEMS
 LEFT OUTER JOIN HISTORY_VISITS ON HISTORY_ITEMS.ID == HISTORY_VISITS.HISTORY_ITEM

From the query results, we can see that Jake searched for “jobs for game developers” and went to LinkedIn.

ANS: LinkedIn

3. What link did the attacker craft for the victim to download the MeetMeLive application?

The history of downloads on Safari is all saved in a plist file stored in the same location as the History.db and appropriately named Downloads.plist:

Location: Users/jake/Library/Safari/Downloads.plist

CMD: plistutil -p Downloads.plist | less

ANS: http://files.techthm.careers.thm:8080/MeetMeLiveInstaller.pkg

Looking further down, Jake also downloaded a PDF file containing Instructions on how to proceed further with the Job Application.

Viewing this PDF file:

CMD: mate-open TechTHM\ Interview\ Instructions\ \?\ Content\ Writer.pdf

The attacker instructs Jake to use his hotspot or other forms of connections to download the malicious application instead of using his office wifi. This should be an immediate indicator of something suspicious!

4. Which network did Jake connect to after reading the instructions in the PDF?

We are expecting Jake to connect to his hotspot. All wireless connections are saved in a plist file as well, in the location:

Location: Library/Preferences/com.apple.wifi.known-networks.plist

This can be a bit confusing, but there are 2 Library directories, one User-specific and the other System-specific. Since the plist file is in XML format we can directly read it.

CMD: less com.apple.wifi.known-networks.plist

Do take note that all keys for WIFI SSID have “wifi.network.ssid” prepended in front of the actual SSID.

Get Domon’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

ANS: Jake M. iPhone

5. What was the IP address assigned to Jake’s system?

MacOS stores all the last known DHCP leases of every interface. This includes parameters such as IP address assigned, Default Gateway address and Lease duration among others. Computers usually store this information for renewal or checking the validity of a lease after rebooting.

Location: private/var/db/dhcpclient/leases/en0.plist

CMD: less en0.plist

ANS: 192.168.64.2

6. When did the application get installed into the system? (YYYY-MM-DD HH:MM:SS)

MacOS keeps a history of all downloads as well as the source of those downloads (e.g. updater/process name).

Location: Library/Receipts/InstallHistory.plist

CMD: less InstallHistory.plist

ANS: 2025–04–30 08:54:20

7. What is the human-friendly name for the permission the user explicitly granted for the application?

Similar to how you may execute applications on Windows with Administrator rights, you can grant certain applications certain permissions on MacOS, giving you more control. All application permissions given are stored in a database at:

Location: Library/Application Support/com.apple.TCC/TCC.db

sqlitebrowser TCC.db

Browsing the data in the access table:

A quick Google search would tell you that kTCCServiceSystemPolicyAllFiles is for Full Disk Access.

ANS: Full Disk Access

8. Which feature of the OS did the attacker use to run their application at startup persistently?

Since MacOS is a Unix-based system, Cron Jobs are available, which are similar to Windows Task Scheduler. An alternative is also Application Startup, which is easier to set up and more likely to be the persistence mechanism used. To start applications on a user login, MacOS uses information stored in plist files for each application. The location is:

Location: Users/jake/Library/LaunchAgents

There is also a system-wide LaunchAgents directory, which starts applications regardless of which user is logging in.

plist file contents:

ANS: LaunchAgents

9. What was the URL to which the application was exfiltrating data?

Looking at the script ran:

ANS: http://techthm.thm/exfil

CONCLUSION

MacOS makes finding artefacts incredibly difficult as the artefacts are spread throughout the system in places you wouldn’t expect. Compared to Windows and Linux, MacOS has to be one of the more tedious operating systems to perform forensics on, having to consistently jump between different points in the system. Overall, a great room for practising MacOS forensics! Thanks to TryHackMe and Aashir.Masood! 🙌