What about MacOS?

[antonbek89]

Hi
Wonder how to do the process over MacOS
I need only to know the Mac computerSID ?

[antonbek89]

Hi Wonder how to do the process over MacOS I need only to know the Mac computerSID ?

Update
I have the ComputerSID and Derived AES key
How to continue from this point?

[rotarydrone]

I don't currently have a MacOS device with GlobalProtect to verify, but Crowdstrike has blogged about the KDF used by the MacOS agent: https://www.crowdstrike.com/en-us/blog/exploiting-globalprotect-for-privilege-escalation-part-two-linux-and-macos/

If you have the service binary, you can decompile it and confirm it yourself and implement the same decryption routine. Feel free to open a PR if you implement a MacOS version 😃

[antonbek89]

Super interesting
@rotarydrone Another question/scenario

Let's assume I success to decrypt the GP files
I got cookie value
The PC which GP installed has solution by GP certificate (only PC with certificate can connect to GP)

So what happens If I take only the cookie value and try to connect from a new PC (without a certificate) via open connect will I succeed or be blocked by GP?

Common sense said if a user already made authentication and is already successful in connecting the cookie includes everything we need to connect via GP