Ivo Damjanović idnovic

macOS Internals

Understand your Mac and iPhone more deeply by tracing the evolution of Mac OS X from prelease to Swift. John Siracusa delivers the details.

Starting Points

How to use this gist

You've got two main options:

This set of "low-hanging fruit" security headers can be set for most websites to cover a range or potential problems and get a better ranking on https://securityheaders.com/. You should not that this does not cover CORS/CSP headers, because they are not "one size fits all" and require trial and error to set. Among these standard headers, the "Permissions-Policy" (previously "Feature-Policy") header requires a bit of thought, and trial and error, so be sure to review and edit as appropriate.

Generally speaking, although you can set some of these directly in HTML, you usually set security headers on the server side, for example in a .htaccess file on Apache, in a file like vercel.json in the root of your site if you're hosting on Vercel (similar for Netlify and can be done in their config file, see below), or under "web rules, header rules" UI if you're hosting on WP Engine (see screenshot).

It's also super simple to implement a static HTML site deployed on Deno Deploy, and served via Deno Oak. See th

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
Relaying that machine authentication to LDAPS for configuring RBCD
RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

Download the full installer:

softwareupdate --list-full-installers
Finding available software
Software Update found the following full installers:
* Title: macOS Ventura, Version: 13.1, Size: 11931164KiB, Build: 22C65
* Title: macOS Ventura, Version: 13.0.1, Size: 11866460KiB, Build: 22A400
* Title: macOS Ventura, Version: 13.0, Size: 11866804KiB, Build: 22A380
* Title: macOS Monterey, Version: 12.6.2, Size: 12104568KiB, Build: 21G320
* Title: macOS Monterey, Version: 12.6.1, Size: 12108491KiB, Build: 21G217

Apple persitence mecanisms

Type	Location	Documentation
Kernel/Sytem Extensions	/System/Library/Extensions/ /Library/Extensions/ /Extra/Extensions/	https://developer.apple.com/fr/support/kernel-extensions/ /Extra/Extensions/ is deprecated
Launch Daemons	/System/Library/LaunchDaemons/ /Library/LaunchDaemons/ /Users/*/Library/LaunchDaemons/	https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/Introduction.html
Launch Agents	/System/Library/LaunchAgents/ /Library/LaunchAgents/ /Users/*/Library/LaunchAgents/	https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/Introduction.html
Startup Items	/System/Library/StartupItems//Library/

Base64 Patterns - Learning Aid

Base64 Code	Mnemonic Aid	Decoded*	Description
`JAB`	🗣 Jabber	`$.`	Variable declaration (UTF-16), e.g. `JABlAG4AdgA` for `$env:`
`TVq`	📺 Television	`MZ`	MZ header
`SUVY`	🚙 SUV	`IEX`	PowerShell Invoke Expression
`SQBFAF`	🐣 Squab favorite	`I.E.`	PowerShell Invoke Expression (UTF-16)
`SQBuAH`	🐣 Squab uahhh	`I.n.`	PowerShell Invoke string (UTF-16) e.g. `Invoke-Mimikatz`
`PAA`	💪 "Pah!"	`<.`	Often used by Emotet (UTF-16)

	#!/bin/bash
	echo "================="
	echo "Noto Font Cleaner"
	echo "================="
	echo "Hides all Noto fonts except the white listed ones. Edit script to customize."
	echo

	# --- CONFIGURATION: Add fonts you want to KEEP here ---
	# Use the exact family name as seen in fc-list : family \| grep -i "Noto"
	# The link comment is just for reference.

	#!/usr/bin/env python3
	"""Flatpak CLI Shortcut Generator

	A simple no-argument tool that generates launchers with traditional non-flatpak
	command names for your installed Flatpak applications in ~/.local/bin/flatpak.

	Does full collision detection and warns you if you forgot to add its output
	directory to your PATH. Also overrules the command-line specified in the
	``.desktop`` file if the Flatpak maintainer didn't include support for
	command-line arguments.

	############ If you are using DOCKER all-in-one image, create Dockerfile like: ################
	############ FROM openproject/openproject:16 ################
	############ COPY ./enterprise_token.rb app/models/enterprise_token.rb ################

	############ If you are runing a manual installation: ################
	############ REPLACE app/models/enterprise_token.rb in the source code with this file! ################
	############ also be sure to RESTART OpenProject after replacing the file. ################

	############ If using some other set up (eg docker-compose), read the comments on ################
	############ https://gist.github.com/markasoftware/f5b2e55a2c2e3abb1f9eefcdf0bfff45 ################

	import time
	import psutil
	import multiprocessing as mp
	from multiprocessing import Process

	def f(thread, duty, freq, q):
	p = psutil.Process()
	p.cpu_affinity([thread])

	while True: