Execute Thin Mach-O Binaries in Memory
./macos_shell_memory [bin] [args]
[bin] is in
[bin] is loaded into memory and executed with
[args] (if provided). Stdout and Stderr will be redirected during binary execution. Normally, when a Mach-O binary finishes execution, the program exits and returns back to the caller (like your terminal); however, this exit call, when called from your current process, will exit your loading process.
To disable this functionality, a new
atexit routine is registered to rewind stack-state back to before the in-memory Mach-O
main() function ever executed. Doing so causes instability, and as such, we call
C._Exit over letting the Go program exit normally.
This weaponization could be modified to point to any thin Mach-O binary, and enforcing the
[bin] to be in
$PATH is an arbitrary constraint I've added.
This works only for thin Mach-O binaries. This can be seen by issuing the following command:
codesign -vvvv -d /path/to/bin
codesign -vvvv -d /bin/ps returns:
Executable=/bin/ps Identifier=com.apple.ps Format=Mach-O thin (x86_64) ... snip ...
There are certain nuances that I haven't worked out for fat and ARM binaries. Doing so will cause the program to irrecoverably segfault.
╭─[email protected] ~/go/src/github.com/djhohnstein/macos_shell_memory ‹main*› ╰─$ ./macos_shell_memory ps [21/05/20 |12:18PM] [Go Code] Redirecting STDOUT... [Go Code] Successfully recovered from bin exit(), captured the following output: PID TTY TIME CMD 72116 ttys000 0:00.00 zsh 47918 ttys003 0:00.00 zsh 78749 ttys003 0:00.01 ./macos_shell_memory ps 612 ttys004 0:00.00 zsh ╭─[email protected] ~/go/src/github.com/djhohnstein/macos_shell_memory ‹main*› ╰─$ ./macos_shell_memory ls -alht [21/05/20 |12:18PM] [Go Code] Redirecting STDOUT... [Go Code] Successfully recovered from bin exit(), captured the following output: total 4752 drwxr-xr-x 13 djh staff 416B May 20 12:18 .git -rwxr-xr-x 1 djh staff 2.3M May 20 12:16 macos_shell_memory drwxr-xr-x 11 djh staff 352B May 20 11:50 . -rw-r--r-- 1 djh staff 0B May 20 11:50 README.md -rw-r--r-- 1 djh staff 3.1K May 20 11:30 main.go -rw-r--r-- 1 djh staff 3.9K May 20 11:23 shell_memory.c drwxr-xr-x 5 djh staff 160B May 18 16:04 .. -rw-r--r-- 1 djh staff 883B May 17 16:43 go.sum -rw-r--r-- 1 djh staff 253B May 17 16:43 go.mod -rw-r--r-- 1 djh staff 19B May 16 17:15 .gitignore -rw-r--r-- 1 djh staff 143B May 16 17:09 shell_memory.h