To get started, install php with the following apt-get command, which will work in Debian and Kali Linux. A Debian virtual private server is used in my example. Setting up this attack involves a PHP server controlled by the attacker used to intercept exfiltrated data. Instead, they have found a way to remotely execute code on the target macOS device. In this scenario, the attacker only cares about exfiltrating the clipboard and hasn't backdoored the MacBook. The payload is instead designed to exfiltrate the clipboard to the attacker's server at intervals.

Scenario: The attacker doesn't care to remotely access the MacBook. Option 2: Exfiltrate Passwords to a Remote Server

You can spend a little time devising a robust, proper solution with this as the basic foundation. But it serves its purpose for this article and most scenarios. The if statement only compares the last line of the clipboard.txt file, so if there are multiple lines in the clipboard it'll fail to recognize it as a duplicate entry. However, this solution is somewhat flawed. Only if the current clipboard content is not equal ( !=) to the last entry ( tail -n1) in clipboard.txt will pbpaste update the file. ~$ while true do if ] then echo -e ' $(pbpaste)' >/tmp/clipboard.txt fi & sleep 5 done Prevent the clipboard.txt file from flooding with duplicate lines by evaluating the clipboard contents and comparing it to the last entry in the file. Tail will follow ( -f) changes appended to the file and immediately print new content discovered in the clipboard. Don't Miss: Dump Passwords Stored in Firefox Browsersįrom an additional Netcat shell, use cat or tail to view the clipboard.txt file contents.An echo has been introduced to create a newline ( ) with every entry to prevent data from concatenating on the same line. The command within the loop will repeat over and over again, repeatedly dumping anything found in the clipboard. The while loop will execute pbpaste and pause (sleep) for five seconds. ~$ while true do echo -e ' $(pbpaste)' >/tmp/clipboard.txt & sleep 5 done

An infinite while loop with a five second delay should do the trick. The attacker can dump the clipboard into a local file and occasionally check it for new passwords. MacOS has become better about protecting against keyloggers, and anyone livestreaming the desktop couldn't unhide or reveal credentials stored in the password managers. Scenario: The attacker has established a persistent backdoor and wants to gather passwords stored in KeePassX, 1Password, or LastPass over a prolonged period.

Keepass mac os x