# dscl

> Interact with Directory Services.

An extensive tool for communicating with the Directory Services, useful for Discovery.

- Page: https://loobins.io/binaries/dscl/
- Author: Jonathan Bar Or (@yo_yo_yo_jbo)
- Created: 2023-04-25
- Tactics: Persistence, Discovery

## Paths

- `/usr/bin/dscl`

## Example Use Cases

### Local user enumeration

Enumerate all local users.

```bash
dscl . -list /Users
dscl . list /Users
dscl . ls /Users
```

- Tactics: Discovery
- Tags: users

### Active Directory user enumeration

Enumerate all Active Directory users.

```bash
dscl "/Active Directory/TEST/All Domains" -list /Users
dscl "/Active Directory/TEST/All Domains" list /Users
dscl "/Active Directory/TEST/All Domains" ls /Users
```

- Tactics: Discovery
- Tags: network, users

### Local user information gathering

Gain useful local user information such as when their password was last set, their keyboard layout, their avatar, their home directory, UID and default shell.

```bash
dscl . -read /Users/$USERNAME
dscl . read /Users/$USERNAME
dscl . cat /Users/$USERNAME
```

- Tactics: Discovery
- Tags: users, configuration

### Active Directory user information gathering

Gain useful Active Directory user information such as when their password was last set, their keyboard layout, their avatar, their home directory, UID and default shell.

```bash
dscl "/Active Directory/TEST/All Domains" -read /Users/$USERNAME
dscl "/Active Directory/TEST/All Domains" read /Users/$USERNAME
dscl "/Active Directory/TEST/All Domains" cat /Users/$USERNAME
```

- Tactics: Discovery
- Tags: network, users, configuration

### Local group enumeration

Enumerate all local groups.

```bash
dscl . -list /Groups
dscl . list /Groups
dscl . ls /Groups
```

- Tactics: Discovery
- Tags: groups

### Active Directory group enumeration

Enumerate all Active Directory groups.

```bash
dscl "/Active Directory/TEST/All Domains" -list /Groups
dscl "/Active Directory/TEST/All Domains" list /Groups
dscl "/Active Directory/TEST/All Domains" ls /Groups
```

- Tactics: Discovery
- Tags: network, groups

### Local group information gathering

Gain useful local group information such as which users belong to that group, SMB SIDs and group ID. Especially useful for the "admin" group.

```bash
dscl . -read /Groups/$GROUPNAME
dscl . read /Groups/$GROUPNAME
dscl . cat /Groups/$GROUPNAME
```

- Tactics: Discovery
- Tags: groups, configuration

### Active Directory group information gathering

Gain useful Active Directory group information such as which users belong to that group, SMB SIDs and group ID. Especially useful for the "admin" group.

```bash
dscl "/Active Directory/TEST/All Domains" -read /Groups/$GROUPNAME
dscl "/Active Directory/TEST/All Domains" read /Groups/$GROUPNAME
dscl "/Active Directory/TEST/All Domains" cat /Groups/$GROUPNAME
```

- Tactics: Discovery
- Tags: network, groups, configuration

### Computer enumeration

Enumerate all computers in an Active Directory.

```bash
dscl  "/Active Directory/TEST/All Domains" -list /Computers
dscl  "/Active Directory/TEST/All Domains" list /Computers
dscl  "/Active Directory/TEST/All Domains" ls /Computers
```

- Tactics: Discovery
- Tags: network, shares

### Share enumeration

Enumerate all shares.

```bash
dscl . -list /SharePoints
dscl . list /SharePoints
dscl . ls /SharePoints
```

- Tactics: Discovery
- Tags: network, shares

### Password policy discovery

Gain password policy information

```bash
dscl . -read /Config/shadowhash
dscl . read /Config/shadowhash
dscl . cat /Config/shadowhash
```

- Tactics: Discovery
- Tags: password, policy

### Change a user password

Change an existing user's password.

```bash
dscl . passwd /Users/$USERNAME oldPassword newPassword
```

- Tactics: Persistence
- Tags: password

### Local account creation

Create a local account

```bash
dscl -create
```

- Tactics: Persistence

## Detections

- [Jamf Protect: Detect user account creation with dscl](https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl)

## Resources

- [MacOS Red Teaming - HackTricks](https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming)
- [MITRE ATT&CK T1136.001 Create Account: Local Account](https://attack.mitre.org/techniques/T1136/001/)