Defiling Mac OS X - Ruxcon - Reverse Engineering Mac OS X - PUT ...

More documents

Recommendations

Info

TECHNIQUES NETWORKING HOOKS Some neat places to hook provided by Apple ‣ Network Kernel Extensions (NKEs) can provide filters ‣ Socket filters ‣ Can filter calls to stuff like setsockopt(), getsockopt(), ioctl(), connect(), listen(), bind() ‣ Mostly useful for local stuff I guess ‣ IP filters Good times ‣ ‣ Inject packets ‣ Interface filters ‣ ‣ Filter arbitrary IP packets, get actual mbufs Kinda needlessly low level for this exercise Filter packets after they’re demuxed - maybe some fun Defiling Mac OS X - Ruxcon November, 2011
TECHNIQUES NETWORKING HOOKS Registering & deregistering IP filters static struct ipf_filter ipf_filter = { .cookie = NULL, .name = "derpkit", .ipf_input = ipf_input_hook, .ipf_output = ipf_output_hook, .ipf_detach = ipf_detach_hook }; static ipfilter_t installed_ipf; Defiling Mac OS X - Ruxcon Packet coming in Packet going out kern_return_t derpkit_start (kmod_info_t * ki, void * d) { ipf_addv4(&ipf_filter, &installed_ipf); return KERN_SUCCESS; } kern_return_t derpkit_stop (kmod_info_t * ki, void * d) { ipf_remove(installed_ipf); return KERN_SUCCESS; } November, 2011
Page 1 and 2: DEFILING MAC OS X: KERNEL ROOTKITS
Page 3 and 4: STUFF Things I will talk about ‣
Page 5 and 6: Defiling Mac OS X - Ruxcon November
Page 7 and 8: GETTING CODE INTO THE KERNEL Defili
Page 9 and 10: TECHNIQUES GETTING CODE INTO THE KE
Page 11 and 12: TECHNIQUES GETTING CODE INTO THE KE
Page 13 and 14: TECHNIQUES DODGY KERNEL SYMBOL RESO
Page 15 and 16: TECHNIQUES DODGY KERNEL SYMBOL RESO
Page 17 and 18: TECHNIQUES SYSCALL HOOKS Old faithf
Page 19 and 20: TECHNIQUES SYSCALL HOOKS static str
Page 21 and 22: TECHNIQUES TRUSTEDBSD HOOKS Trusted
Page 23: TECHNIQUES TRUSTEDBSD HOOKS kern_re
Page 27 and 28: ROOTKITTERY Defiling Mac OS X - Rux
Page 29 and 30: TECHNIQUES PROCESS PRIVESC void pro
Page 31 and 32: TECHNIQUES HIDING PROCESSES Might l
Page 33 and 34: TECHNIQUES HIDING FILES Hiding file
Page 35 and 36: ONE MORE THING... *cue turtleneck*
Page 37 and 38: EFI THE EXPLOSIVE FARMVILLE INVARIA
Page 39 and 40: EFI THE EXPANSIVE FURNITURE INTERFE
Page 41 and 42: REFERENCES Mac OS X Kernel Programm

Defiling Mac OS X - Ruxcon - Reverse Engineering Mac OS X - PUT ...

Create successful ePaper yourself

Delete template?

Save as template?