← All Binaries

sysadminctl

sysadminctl can administer system user accounts. sysadminctl can be used to change user passwords, create new users (including automatically provisioning the user home folder) or to check the status of a user's SecureToken.

Author: Hare Sudhan (@cyb3rbuff) Created: 2024-11-19
Initial AccessPersistenceImpactExfiltration userspassword

Paths

/usr/sbin/sysadminctl

Example Use Cases

Enable Guest Account

sysadminctl can be used to enable the guest account

sudo sysadminctl -guestAccount on
Initial Access

Create Local User Account

sysadminctl can be used to create a local user account

sudo sysadminctl -addUser randomUser -password "randomPassword"
Persistence users

Create a Local Admin Account

sysadminctl can be used to create a local admin account

sudo sysadminctl -addUser randomUser -password "randomPassword" -admin
Persistence users

Reset user password

sysadminctl can be used to reset password for a particular user account

sudo sysadminctl -resetPasswordFor randomUser -newPassword "randomPassword"
Persistence passwordusers

Delete a local account

sysadminctl can delete the specified user account

sudo sysadminctl -deleteUser randomUser
Impact users

Enable SMB Guest Access

sysadminctl can enable SMB Guest Access

sudo sysadminctl -smbGuestAccess on
Exfiltration

Enable AFP Guest Access

sysadminctl can enable AFP Guest Access

sudo sysadminctl -afpGuestAccess on
Exfiltration

Detections

Resources