We find the following files in this location: ~ % ls -l Library/Shortcuts This location is protected by the Sandbox (SIP), as we can’t access it unless we have Full Disk Access permissions granted or the entitlement .shortcuts. Shortcuts Database & ConfigurationĪll of the Shortcuts files are stored under the user’s HOME folder at ~/Library/Shortcuts. As we can see, the application is very rich in entitlements, most notably it’s sandboxed ( -sandbox), has quite a few TCC exceptions ( kTCCServiceAddressBook,….) and also one that suggest it has access to a SIP protected location .shortcuts. The above XML has been beautified, as the embedded one, has no new line characters or spaces, and it’s unreadable. Ĭom.-container-identifiersĬom.-container-identifiersĬom.request.client-identifiersĬom.Ĭom.-preference.read-writeĬom.home-relative-path.read-writeĬom.home-relative-path.read-onlyĬom.Ĭom.INec.INeiĬom.aevt.quitĬom.-lookup.global-nameĬom.Ĭom.-launching

Sealed Resources version=2 rules=2 files=0Ĭom.Ĭom.-delegateĬom.-eventsĬom.-modeĬom.-applicationĬom.-accessĬom.-set-output-deviceĬom.Ĭom.-system-wide-contextĬom.Ĭom.-selected.read-writeĬom.Ĭom.-access-to-device-listĬom._knowledge_storeĬom.Ĭom.event-dispatch.internalĬom.-libraryĬom.-container-environmentĬom.-identifying-output-device-detailsĬom.identities ~ % codesign -dv -entitlements :- /System/Applications/Shortcuts.appĮxecutable=/System/Applications/Shortcuts.app/Contents/MacOS/Shortcutsįormat=app bundle with Mach-O universal (x86_64 arm64e)ĬodeDirectory v=20400 size=6636 flags=0x0(none) hashes=197+7 location=embedded I will use this example along the way, when I explore the internals of Shortcuts.īefore moving on, here are the code signing properties of the application. I created a new shortcut, named it “testcut” and added a shell script as an action, which will create the file /tmp/testcut. Shortcuts can be created by the Shortcuts.app. All of the below information is based on macOS Monterey Developer Beta 1. My security focused brain immediately thought about how cool this feature could be for red teamers or pentesters to persist on macOS :) So I decided to take a quick look on the new functionality, focusing on how it works. It’s already available on iOS, but it made its way to macOS.

Apple announced macOS Monterey (macOS 12) this week at WWDC, and one of its new features that caught my eye is Shortcuts.

Macos key shortcuts