# textutil

> Manipulate text files in various formats.

The textutil binary is a command-line utility included in macOS that allows users to manipulate text files of various formats, using the mechanisms provided by the Cocoa text system. Formats include rtf, html, docx and others

- Page: https://loobins.io/binaries/textutil/
- Author: ezaspy
- Created: 2023-05-05
- Tactics: Defense Evasion, Credential Access, Collection

## Paths

- `/usr/bin/textutil`

## Example Use Cases

### Use the textutil to read several files and build a new file

A one-liner can load the content of multiple RTF files in a directory, concatenate their contents, and write the results out as a new file. This provides two sub-use-cases; one is building a malicious file from a collection of smaller files which could evade both network and host-based security controls as the traditional means of signature-based detection would be redundant; two is concatenating the content of several, potentially sensitive files before exfiltration. This command can also be looped to iterate a directory of files.

```bash
textutil -convert html Quote.doc secondQuote.doc
```

- Tactics: Defense Evasion, Collection
- Tags: bash, oneliner

### Capture clipboard content

By leveraging another command line tool, pbpaste, it is possible to write a one-liner which captures the content of the clipboard. If an attacker already has access to the system, the attacker could run this command to obtain sensitive information such as a password and then elevate their privileges or exfiltrate the information.

```bash
pbpaste | textutil -stdin -info > Clipboard.txt
```

- Tactics: Credential Access, Collection
- Tags: bash, oneliner, pbpaste, clipboard

## Detections

- Command Line Argument Detection (args contain textutil AND (-convert OR -stdin OR pbpaste))

## Resources

- [textutil](https://osxdaily.com/tag/textutil/)