0xmachos / mOrc

mOrc is a post-exploitation framework for macOS written in Bash
MIT License
18 stars 2 forks source link

Investigate usefulness of disabling core dumps #6

Open 0xmachos opened 3 years ago

0xmachos commented 3 years ago

It appears that ulimit -c 0 does not work on macOS Big Sur (11.5.1)

$ source mo.rc                                                                                                                                                          (master)
coredumps disabled by ulimit
=========== Info ===========
...
============================
=== Welcome to mOrc Shell ===
Run gethelp to see a list of commands.
/Users/mikey should be deleted upon exit.
mikey ~/Documents/Projects/mOrc $ ulimit                                                                                                                                  (master)
unlimited
mikey ~/Documents/Projects/mOrc $  

There is also the limit command (limit core 0) which can be used to limit the size of core dumps.

$ limit
...
coredumpsize    unlimited
...
$ limit core 0
$ limit       
...
coredumpsize    0kB
...

Core dumps used to be written to /cores. However on macOS Big Sure the user doesn't have write permission for /core by default.

$ touch /cores/test                                                            
touch: /cores/test: Permission denied

It appears that the modern location for core dumps are: