johnkhbaek

/*
================================================================================
modified from this: https://github.com/its-a-feature/macos_execute_from_memory (supports only bundle)
code injection : https://github.com/CylanceVulnResearch/osx_runbin by Stephanie Archibald (does not support m1 x64 emulation and FAT header)

added FAT header (universal Macho) parsing

script-kiddied, debugged, etc. by @exploitpreacher
================================================================================
*/

johnkhbaek

<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <!-- This inline task executes c# code. -->
  <!-- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe SimpleTasks.csproj -->
  <!-- Save This File And Execute The Above Command -->
  <!-- Original Author: Casey Smith, Twitter: @subTee -->
  <!-- Modified by John Baek, @exploitpreacher to use ntqueueapcthread (https://github.com/FuzzySecurity/Sharp-Suite/tree/master/UrbanBishop) -->
  <!-- License: BSD 3-Clause -->
  <Target Name="Hello">
   <ClassExample />
  </Target>

johnkhbaek

/*
================================================================================
modified from this: https://github.com/its-a-feature/macos_execute_from_memory (supports only bundle)
code injection : https://github.com/CylanceVulnResearch/osx_runbin by Stephanie Archibald (does not support m1 x64 emulation and FAT header)

added FAT header (universal Macho) parsing

script-kiddied, debugged, etc. by @exploitpreacher
================================================================================
*/

johnkhbaek

// gcc keys.c
// ./a.out
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <sys/ioctl.h>

int main() {
    int fd = open("/dev/tty", O_RDWR);
    if (fd < 0) {

johnkhbaek

// Learning the magic
// matched to work with M1 Rosetta which seems to have multiple macho (not just binary and dyld)

/*************************************************************************************
*  Author: Stephanie Archibald <sarchibald@cylance.com>                              *
*  Copyright (c) 2017 Cylance Inc. All rights reserved.                              *
*                                                                                    *
*  Redistribution and use in source and binary forms, with or without modification,  *
*  are permitted provided that the following conditions are met:                     *
*                                                                                    *