← All Binaries

hdiutil

hdiutil manipulates disk images such as DMG and ISO files. You can mount, unmount, create, resize and verify disk images. Including encrypted images.

Path
/usr/bin/hdiutil
Author
Mark Morowczynsk (@markmorow)
Created
2023-05-21

Example Use Cases 6

Mount a malicious dmg file #

Uses hdiutil to mount a malicious dmg file to the system.

hdiutil mount malicious.dmg

Mount a malicious dmg file #

Uses hdiutil to mount a malicious dmg file to the system.

hdiutil attach malicious.dmg

Mount a malicious iso file #

Uses hdiutil to mount a malicious iso file to the system.

hdiutil mount malicious.iso

Mount a malicious iso file #

Uses hdiutil to mount a malicious iso file to the system.

hdiutil attach malicious.iso

Exfiltrate data in dmg file #

Uses hdiutil to create a dmg file to store exfiltrate data

hdiutil create -volname "Volume Name" -srcfolder /path/to/folder -ov diskimage.dmg

Exfiltrate data in encrypted dmg file #

Uses hdiutil to create a dmg file to store exfiltrate data

hdiutil create -encryption -stdinpass -volname "Volume Name" -srcfolder /path/to/folder -ov encrypteddiskimage.dmg

Detections

Resources