# lsregister

> Interact with the macOS Launch Services database.

lsregister is used to build, dump, and check the validity of the Launch Services database. This database is often abused to create custom URL scheme handlers that point to malicious apps.

- Page: https://loobins.io/binaries/lsregister/
- Author: Brendan Chamberlain (@infosecB)
- Created: 2023-05-15
- Tactics: Discovery, Impact

## Paths

- `/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister`

## Example Use Cases

### Force an update of the Launch Services database

The -f flag can be used to force an update of the Launch Services database. This can be used to quickly register a custom URL scheme that points to a malicious app.

```bash
/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -f
```

- Tactics: Discovery

### Get a list of apps and their bindings

The -dump flag can be used to get a list of apps and their bindings

```bash
/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -dump | grep -E "path:|bindings:|name: | more"
```

- Tactics: Discovery

### Delete the Launch Services database

The -delete flag can be used to delete the Launch Services database to impact normal operation of the system.

```bash
lsregister -delete
```

- Tactics: Impact

## Detections

- No detections at time of publishing

## Resources

- [Remote Mac Exploitation Via Custom URL Schemes](https://www.jamf.com/blog/remote-mac-exploitation-via-custom-url-schemes/)
- [macOS Security & Privilege Escalation](https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation)

## Acknowledgements

- Patrick Wardle (@patrickwardle)