#Docker install mac command line code
#Docker install mac command line download

So the operator will need to pay attention to the IP in the connection to know which session is being interacted with. Instead the server auto switches between sessions after each command executed. NOTE: The MacC2 server currently does not have a way to conveniently switch between sessions when multiple clients connect.The operator can change that by using the sleep command. NOTE: The default sleep is 10 seconds.

enter вЂњdoneвЂќ and press enter to have the queued commands sent to the client for execution.

enter command name and press enter for each command you want to run.

The operator flow after setting everything up and getting a callback is:

A specific token (if a request failes this check it receives a 404 Not Found).

A specific user agent string check (if a request fails this check it receives a 404 Not Found).

To ensure that only MacC2 agents can access the server, the server includes the following: The MacC2 server uses aiohttp to easily allow for asynchronous web comms. The files will still be dropped and the login item will still be inserted but upon reboot the quarantine attribute prevents the persistence from executing Note: If you gain access using the MS Office macro, then the persistence method will not work due to sandboxing.

#Docker install mac command line download

Then you can provide the url to the hosted file to MacC2 using the runjxa command to have MacC2 download and execute the Mythic. js payload, download it, and host it on a remote server. The command options that are not OPSEC safe (i.e., command line executions or cause pop ups) are also flagged in red from the help menu. Python3 macro_generatory.py -s -p Д®ach command is pretty straightforward. You can copy and paste the contents of macro.text into an MS Office document: macro_generator.py also builds a macro (macro.txt) that uses hex encoding to run MacC2.

Use macro_generator.py to create the MacC2 scripts with the serverвЂ™s IP/domain and port.

#Docker install mac command line code

Note: the server script is hard-coded to use ca.pem and ca.key, so keep these names the same for now, or change the code appropriately 2: openssl x509 -trustout -signkey ca.key -days 365 -req -in ca.csr -out ca.pem.1: openssl req -new -newkey rsa:2048 -nodes -out ca.csr -keyout ca.key.If you do not have your own cert, you can use the following to generate a self signed cert: Set up ssl (note: use a key size of at least 2048).Python3 -m pip install -upgrade -force pip Pip install aiohttp (if you encounter an error ensure that pip is pointing to python3, since aiohttp is a python3 library): Since the MacC2 server uses the aiohttp library for communications, you will need to install aiohttp first: If you opt to not use docker, you can set up the server locally using the steps below: You can then either copy the MacC2_client.py file over to the client and execute for a callback or you can import the macro.txt macro into an Office document and вЂњEnable MacrosвЂќ when opening for a callback on the client. You can run the command below to delete the macc2-container after each run: Note: Since I am using a static container name (macc2-container), if you run this setup more than once on the same server, you will need to delete the macc2-container name after each use or else you will get an error вЂњThe container name вЂњ/macc2-containerвЂќ is already in use by containerвЂќ. You can run docker ps and validate that the MacC2 server is running (you will see a container named macc2-container listed there).when prompted, enter the IP/hostname of the MacC2 server.setup.sh (this will create an untrusted ssl cert and key, generate a macro file for the server and port you specify (will drop the macro in macro.txt locally), build macc2-docker, and run the MacC2 server inside of macc2-container in interactive mode) If you do not already have docker set up: You can set up the server locally or you can use the docker setup I have included in this repo. Apple plans to eventu ally remove scripting runtimes from base macOS installs, but it appears that python is still included by default on base installs of Big Sur. I wrote this tool to aid purple team exercises aimed at building detections for python-based post exploitation frameworks on macOS. It is possible down the road that Apple will remove python2 (or python altogether) from base macOS installs but as of Nov 2020 this is not the case. The client is written in python2, which though deprecated is still being shipped with base Big Sur installs. MacC2 is a macOS post exploitation tool written in python that uses Objective C calls or python libraries as opposed to command line executions.