# pbpaste

> Paste the contents of clipboard to the terminal.

Retrieves the contents of the clipboard (a.k.a. pasteboard) and writes them to the standard output (stdout). The utility is often used for creating new files with the clipboard content or for piping clipboard contents to other commands. It can also be used in shell scripts that may require clipboard content as input.

- Page: https://loobins.io/binaries/pbpaste/
- Author: Brendan Chamberlain (@infosecB)
- Created: 2023-04-11
- Tactics: Credential Access, Collection

## Paths

- `/usr/bin/pbpaste`

## Example Use Cases

### Use pbpaste to collect sensitive clipboard data

A pbpaste bash loop can continuously collect clipboard contents every x minutes and write contents to a file (or another location). This may allow an attacker to gather user credentials or collect other sensitive information.

```bash
while true; do echo $(pbpaste) >> loot.txt; sleep 10; done
```

- Tactics: Credential Access, Collection
- Tags: bash, oneliner

## Detections

- [Sigma: Clipboard Data Collection Via Pbpaste](https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/macos/process_creation/proc_creation_macos_pbpaste_execution.yml)

## Resources

- [Hacking macOS: How to Dump 1Password, KeePassX & LastPass Passwords in Plaintext](https://medium.com/@NullByteWht/hacking-macos-how-to-dump-1password-keepassx-lastpass-passwords-in-plaintext-723c5b1c311b)
- [Living-off-the-Land: Exploring macOS LOOBins and Crafting Detection Rules - pbpaste](https://danielcortez.substack.com/p/living-off-the-land-exploring-macos-b65)