☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
- Discover The PEASS Family, our collection of exclusive NFTs
- Get the official PEASS & HackTricks swag
- Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.
- Share your hacking tricks by submitting PRs to the hacktricks repo and hacktricks-cloud repo.
{% hint style="warning" %}
Note that entitlements starting with com.apple are not available to third-parties, only Apple can grant them.
{% endhint %}
This entitlement allows to get the task port of the process run by the binary with this entitlement and inject code on it. Check this for more info.
This entitlement allows to get the task port for any process, except the kernel. Check this for more info.
Apps with the Debugging Tool Entitlement can call task_for_pid() to retrieve a valid task port for unsigned and third-party apps with the Get Task Allow entitlement set to true. However, even with the debugging tool entitlement, a debugger can’t get the task ports of processes that don’t have the Get Task Allow entitlement, and that are therefore protected by System Integrity Protection. Check this for more info.
This entitlement allows to load frameworks, plug-ins, or libraries without being either signed by Apple or signed with the same Team ID as the main executable, so an attacker could abuse some arbitrary library load to inject code. Check this for more info.
This entitlement allows to use DYLD environment variables that could be used to inject libraries and code. Check this for more info.
This entitlement allows to create memory that is writable and executable by passing the MAP_JIT flag to the mmap() system function. Check this for more info.
This entitlement allows to override or patch C code, use the long-deprecated NSCreateObjectFileImageFromMemory (which is fundamentally insecure), or use the DVDPlayback framework. Check this for more info.
{% hint style="danger" %} Including this entitlement exposes your app to common vulnerabilities in memory-unsafe code languages. Carefully consider whether your app needs this exception. {% endhint %}
This entitlement allows to modify sections of its own executable files on disk to forcefully exit. Check this for more info.
{% hint style="danger" %} The Disable Executable Memory Protection Entitlement is an extreme entitlement that removes a fundamental security protection from your app, making it possible for an attacker to rewrite your app’s executable code without detection. Prefer narrower entitlements if possible. {% endhint %}
TODO
☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
- Discover The PEASS Family, our collection of exclusive NFTs
- Get the official PEASS & HackTricks swag
- Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.
- Share your hacking tricks by submitting PRs to the hacktricks repo and hacktricks-cloud repo.