The Python in the Apple
- 1. The Python in the Apple BSides Cleveland 2017 Spencer McIntyre
- 2. Agenda • About Me • Python ctypes Review • Integration with Meterpreter (Railgun) • Objective-C from Railgun • Demonstration Time
- 3. About Me • Spencer McIntyre • Work at SecureState • Research, Development, “Special” Projects • BSOD-inducer • Avid open source contributor • Metasploit among others • Python enthusiast
- 5. Why do we care? • One word: Stealth • Everything here could be accomplished an “easier” way • Writing files (often scripts) to disk • Starting new processes
- 6. Meterpreter’s Railgun • Standard API Extension of Metepreter • Remote FFI (Foreign Function Interface) • Only available for Windows (prior to March 2017) • Facilitates in-memory loading and calling of native library code from the target • Used by many Windows post and a few local exploit modules • You’ve probably used it without realizing it
- 7. Meterpreter’s Railgun • Exposed through four basic Meterpreter API functions • railgun_api • Core functionality to load an arbitrary function, call it with defined parameters and return results • railgun_api_multi • Execute multiple calls in a single transaction, offers better speed when used • railgun_memread • Read data out of the Meterpreter process, useful when pointers are returned • railgun_memwrite • Write data to in the Meterpreter process
- 8. Python Meterpreter • First non-Windows implementation of Railgun • Heavily utilizes ctypes to make all of the native API calls • memread / memwrite were deceptively difficult • Linux version backed with process_vm_(read|write) • ctypes already supported function calls so wrapping that was relatively cross- platform • Error code retrieval is the primary difference • Memory operations on the other hand…
- 9. OSX Memory Primitives • Invalid access (read or write) results in segmentation fault when not done safely • Segmentation fault = session closed • Enter the libc’s mach_vm_* • Accessible via standard ctypes methods • Graceful failure will help you have a good time • Error codes are returned for invalid addresses and invalid permissions
- 10. OSX APIs From Railgun Less Pew Pew more Segmentation fault
- 11. OSX APIs • APIs are provided by frameworks • /System/Library/Frameworks • Mach-O universal binaries • Major ones • Foundation • Accounts • Social • Security • Loadable by Python’s ctypes • Not particularly useful, the interfaces exposed are insufficient by themselves
- 12. libobjc • Provides the runtime for Objective-C code • This is accessible via C, ctypes will work as expected • Allows initialization and usage of Objective-C classes • Severe lack of documentation • Apple doesn’t advertise this method • Internet is full of reasons why it’s a Bad Idea™ • Repetitive API to use Objective-C objects this way • objc_getClass objc_msgSend sel_registerName
- 13. Bad Idea™
- 14. Objective-C Object • Basically chaining calls to objc_msgSend • id objc_msgSend(id self, SEL op, …); • Uses the standard CDECL calling convention • Accepts a variable number of arguments (this is key) • First parameter is the class instance, (or the class itself when you’re first creating an instance) • Second parameter is the “method selector” • This is a string passed to sel_registerName • Contains the method name and parameters by name
- 15. Objective-C Object dlopen(‘Foundation.framework/Foundation’, RTLD_LAZY) nsstring = objc_msgSend( objc_msgSend( objc_getClass(‘NSString’), sel_registerName(‘alloc’) ), sel_registerName(‘initWithCString:encoding:’), ‘Hello World’, NSUTF8StringEncoding )
- 16. Demonstration Time! • Tying it all together to run an Apple Script in memory • Uses NSAppleScript
- 17. Beware Faults
- 18. Code is Public • https://github.com/zeroSteiner/metasploit-framework • https://github.com/zeroSteiner/metasploit-payloads • Both branches are pymet-rg-osx
- 19. Further Reading & Resources • How Meterpreter’s Railgun works • https://community.rapid7.com/community/metasploit/blog/2017/05/18/recen t-python-meterpreter-improvements • https://warroom.securestate.com/inner-workings-railgun/
- 20. • Spencer McIntyre • Twitter: @zeroSteiner Thank You For Your Time!