macOS Commands

Default macOS commands the operator runs on the target or their own Apple workstation. The full A-Z table runs across pages 155-162 of the source handbook; the highlights below cover daily tradecraft.

File and system

$ ls / ll                          # list / long format
$ cd / pwd / mkdir / rmdir
$ cp / mv / rm
$ ln                               # hard / symbolic links
$ cat / head / tail / less / more
$ open <file|folder|URL|app>       # open via Finder / LaunchServices
$ touch / file / stat
$ chmod / chown / chgrp / chflags
$ chroot / chsh
$ diskutil                         # format, verify, repair
$ defaults                         # preferences, hidden files
$ csrutil                          # System Integrity Protection
$ sw_vers                          # macOS version
$ sysctl                           # kernel state
$ system_profiler                  # system configuration
$ systemsetup                      # display system settings

Processes

$ ps / top                         # process status
$ kill / killall / pkill           # signal processes
$ pgrep                            # find by name
$ launchctl                        # load / unload daemons or agents
$ kextfind / kextstat / kextunload # kernel extensions
$ nice / nohup
$ trap                             # signal handler

Networking

$ ifconfig / ipconfig              # interface configuration
$ netstat                          # network status
$ networksetup                     # Network preferences from CLI
$ ping / traceroute
$ dig                              # DNS lookup
$ nc / netcat                      # network read / write
$ ssh / scp / rsync / sftp
$ curl / ftp
$ tcpdump                          # capture traffic

Apple specific

$ afconvert / afinfo / afplay      # audio file convert / info / play
$ airport                          # Apple AirPort
$ asr                              # Apple Software Restore
$ bless                            # bootability and startup disk
$ dscacheutil                      # Directory Service / DNS cache
$ dseditgroup / dsenableroot / dsmemberutil / dscl   # Directory Service utilities
$ dtruss                           # process system call time details
$ fdesetup                         # FileVault configuration
$ GetFileInfo                      # HFS+ attributes
$ hdiutil                          # ISO disk images
$ kickstart                        # Apple Remote Desktop
$ lipo                             # convert universal binaries
$ mdfind / mdutil                  # Spotlight search and metadata
$ ntfs.util / nvram
$ osacompile / osascript           # AppleScript
$ pbcopy / pbpaste                 # clipboard
$ pkgbuild / pkgutil               # installer packages
$ plutil                           # property list
$ pmset                            # power management
$ ReportCrash / say
$ screencapture                    # screen image to file or disk
$ scselect                         # network locations
$ scutil                           # system configuration parameters
$ security                         # Keychains, certs, Security framework
$ sharing                          # afp / ftp / smb share points
$ shasum                           # SHA checksums
$ sips                             # scriptable image processing
$ softwareupdate                   # OS update
$ spctl                            # Gatekeeper
$ sqlite3                          # SQLite (download history, etc.)
$ srm                              # secure remove
$ tccutil                          # privacy database
$ textutil                         # text format conversion
$ tmutil                           # Time Machine
$ trimforce                        # TRIM for third-party drives
$ ufs.util                         # UFS mount
$ xattr                            # extended attributes
$ xcode-select --install           # install command-line developer tools

Domain enumeration

Domain: TEST.local.

User enumeration.

$ dscl . ls /Users
$ dscl . read /Users/[username]
$ dscl "/Active Directory/TEST/All Domains" ls /Users
$ dscl "/Active Directory/TEST/All Domains" read /Users/[username]
$ dscacheutil -q user

# LDAP
$ ldapsearch -H ldap://test.local -b DC=test,DC=local "(objectclass=user)"
$ ldapsearch -H ldap://test.local -b DC=test,DC=local "(&(objectclass=user)(name=[username]))"

Computer enumeration.

$ dscl "/Active Directory/TEST/All Domains" ls /Computers
$ dscl "/Active Directory/TEST/All Domains" read "/Computers/[compname]$"

# LDAP
$ ldapsearch -H ldap://test.local -b DC=test,DC=local "(objectclass=computer)"
$ ldapsearch -H ldap://test.local -b DC=test,DC=local "(&(objectclass=computer)(name=[computername]))"

Group enumeration.

$ dscl . ls /Groups
$ dscl . read "/Groups/[groupname]"
$ dscl "/Active Directory/TEST/All Domains" ls /Groups
$ dscl "/Active Directory/TEST/All Domains" read "/Groups/[groupname]"

# LDAP
$ ldapsearch -H ldap://test.local -b DC=test,DC=local "(objectclass=group)"
$ ldapsearch -H ldap://test.local -b DC=test,DC=local "(&(objectclass=group)(name=[groupname]))"
$ ldapsearch -H ldap://test.local -b DC=test,DC=local "(&(objectclass=group)(name=*admin*))"

Domain information.

$ dsconfigad -show

# LDAP
$ ldapsearch -H ldap://test.local -b DC=test,DC=local "(objectclass=trusteddomain)"

References

• man 1 dscl, man 8 dseditgroup, man 1 dscacheutil.