actae0n xpcmdshell

## writeup.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                xpcmdshell
                / writeup.md
            
            
              Last active
              March 25, 2021 23:17
            
              
                Lulu Bypass [dead]
              
          
    LuLu bypasses

LuLu Helper (/Applications/LuLu.app/Contents/Library/LoginItems/LuLu Helper.app/Contents/MacOS/LuLu Helper) is the user mode GUI app that communicates with the kernel extension, and provides a nice interface for the user to define and view socket filtering rulesets (block/allow). The kernel extension is responsible for  performing socket creation filtering based on these user defined rulesets.
The user mode helper sends ruleset and preferences creation, deletion, and modification requests by calling methods in an exported interface (XPCDaemonProtocol) on an exported XPC object. The XPC service it connects to is com.objective-see.lulu.
The LuLu Helper ships with the get-task-allow entitlement, so any program can get its task port using task_for_pid().
[ λ ~ ] jtool --ent "/Applications/LuLu.app/Contents/Library/LoginItems/LuLu Helper.app/Contents/MacOS/LuLu Helper"


## Hooky.cpp
#include "stdafx.h"
#define WIN32_LEAN_AND_MEAN
#include <Windows.h>
#include "prio.h"

//Convenient define for the fdwReason
#define VERIFIER_LOAD 4

/*
	Prototypes for additional event callbacks (dll load, unload, and heap free). If you wanted to, you could respond to these events. We will
	#include "stdafx.h"
	#define WIN32_LEAN_AND_MEAN
	#include <Windows.h>
	#include "prio.h"

	//Convenient define for the fdwReason
	#define VERIFIER_LOAD 4

	/*
	Prototypes for additional event callbacks (dll load, unload, and heap free). If you wanted to, you could respond to these events. We will