This document summarizes techniques for exploiting kernel vulnerabilities on OS X systems. It outlines 10 steps to achieve direct kernel object manipulation (DKOM) by leveraging features like TrustedBSD and abusing interfaces like AppleHWAccess. Key steps involve bypassing kernel memory protections, installing a malicious MAC policy, and modifying unused system calls to achieve code execution. The document concludes that OS X security relies heavily on unwritten assumptions and is quite vulnerable due to a lack of mandatory access controls and read-write kernel memory.

1. fG! @ CodeBlue 2014
BadXNU

2. Who am I?
! (© Dr.
Quynh)

4. Rootkits?
!
! :
! .
! .

5. Backdoors?
! .
! .
! OS X .

8. Got root?
! OS X
!

12. https://vimeo.com/

13. Got root?
! ....
! !
! iWorm

14. Got root?
! HTTP
! ...
! ☺☺.

16. Problem?

17. Apple new kext policy

18. Mavericks

19. Yosemite

20. Consequences
! Kexts :
! .
! Invalid.
!
.

21. Solutions
!
! kext-dev-mode=1 (boot parameter)
!
!
!
! EFI

24. Attack userland daemons
! Kextd daemon.
! 3 .
! !

26. Attack userland daemons
!
*Output from Yosemite GM3 kextd

27. Attack userland daemons
! 2
! 2013 .
! http://reverse.put.as/2013/11/23/
breaking-os-x-signed-kernel-
extensions-with-a-nop/

28. Apple Security...

30. Kernel vulnerabilities
! :
! .
! .
! .

31. Kernel vulnerabilities
!
! .
! PID .

32. Kernel vulnerabilities
! Snow Leopard
.
! task_for_pid(0) .
! http://phrack.org/issues/66/16.html

33. Kernel vulnerabilities

34. Kernel vulnerabilities
! processor_set_tasks() .
! Ming-chieh Pan & Sung-ting Tsai
BlackHat Asia 2014 .
! Jonathan Levin Mac OS X iOS

35. Kernel vulnerabilities
! .
! task_for_pid(0) .

40. !

41. Kernel vulnerabilities
! Apple
.
! iOS !
! SECURE_KERNEL .
! !

42. ?

43. We can
! .
! .
! .

44. We can’t
! :
! .
! read-only .
! .

46. Kernel obstacles
! read-only.

47. Kernel obstacles
! read-only.
! syscall mach
! Mountain Lion

48. Kernel obstacles

49. Kernel obstacles
! Kernel ASLR.
! .
! kas_info syscall .
! .

51. Memory protection problem
! read-only
.
! CR0
!

52. Code execution problem
!
! sysycall mach
.

53. Code execution problem
! .
! kernelchache .
! .

55. DKOM!

56. Goals
! Direct Kernel Object Manipulation
(DKOM).
! .
! .
! CR0 .
! .

57. TrustedBSD

58. TrustedBSD MACF
! MAC .
! .
! FreeBSD .
! OS X/iOS .
! Userland Gatekeeper.

59. TrustedBSD MACF
! .
! .

60. TrustedBSD MACF
! .
! .
! .
= WIN!

61. HOW?

62. How to Leverage TrustedBSD
! .
! .
! .
! .

64. 10 steps to victory
1. .
2. ASL .
3. .
4.
.
5. .

65. 10 steps to victory
6. .
7.
8. TrustedBSD .
9. TrustedBSD .
10. .

66. 1. Get kernel task port

67. 2. Find KASLR slide

68. 3. Compute rootkit size
!

69. 4. Allocate kernel memory
! mach_vm_allocate().
! .

70. 5. Copy rootkit
! mach_vm_write().
! .
!

71. 6. Change memory protections
! mach_vm_protect().
! .
! .

73. Problems
! .
!
.

75. Problems
! .
! mach_vm_wire().
!
.

76. !
"

77. 7. Fix external symbols
! PIE.
! .
! ?
! .
!
.

78. 7. Fix external symbols
! .
! Mach-O :
! LC_DYSYMTAB.
! LC_SYMTAB.

79. 7. Fix external symbols
! 10 .
! Kexts :
! X86_64_RELOC_UNSIGNED.
! RIP .
! X86_64_RELOC_BRANCH.
! .

80. 7. Fix external symbols
RReellooccaattiioonn TTyyppee LLooccaall EExxtteerrnnaall
X86_64_RELOC_UNSIGNED 166078 335464
X86_64_RELOC_SIGNED 0 0
X86_64_RELOC_BRANCH 0 158219
X86_64_RELOC_GOT_LOAD 0 0
X86_64_RELOC_GOT 0 0
X86_64_RELOC_SUBTRACTOR 0 0
X86_64_RELOC_SIGNED_1 0 0
X86_64_RELOC_SIGNED_2 0 0
X86_64_RELOC_SIGNED_4 0 0
X86_64_RELOC_TLV 0 0

81. 7. Fix external symbols
! :
! KPI .
! :
! kext .

86. 8. Install a TrustedBSD policy
! :
! mac_policy_list.
! mac_policy_conf.
! mac_policy_ops.

88. 8. Install a TrustedBSD policy
! .
! mac_policy_list.

90. 8. Install a TrustedBSD policy
! mac_policy_conf
.

91. 8. Install a TrustedBSD policy
! mac_policy_ops
.
!
.

92. 8. Install a TrustedBSD policy
a) mac_policy_ops .
b) mac_policy_conf .
c) mac_policy_con .
d) mac_policy_list .

93. a) mac_policy_ops
! task_for_pid() .
! .
! mac_policy.h

95. Rootkit entrypoint
! .
! kmod_info symbol .
! start_addr .

98. b) mac_policy_conf
! mac_policy_ops
.
! NULL .

99. c) Add mac_policy_conf
! .
!

100. c) Add mac_policy_conf
!

101. d) Add new policy
!
:
! numloaded
! .
! maxindex
! .

102. 9. Start rootkit
! task_for_pid(1) .
! PID 1 launchd .
! ”fuse”
.

104. 10. Cleanup
! :
! maxindex numloaded .
! :
! .
! .

107. Abusing OS X features
! /dev/kmem .
! “kmem=1” .
! /Library/Preferences/
SystemConfiguration/
com.apple.Boot.plist .

108. Abusing OS X features
! AppleHWAccess .
! Mavericks .
!
.
! 64 bits read/write.

111. Abusing OS X features
! SJ_UnderWater .
! http://www.tonymacx86.com/apple-
news-rumors/112304-applehwaccess-
random-memory-read-write.html

112. We can
!
.
! read-only .

113. We can’t
! .
! .
! .

118. AppleHWAccess
! :
! .
! .
! .

120. Problems?
! :
! .
!
! .
! .
! shellcode .

121. Problems?
! :
! syscall mach .
! TrustedBSD .
! kext .
! ...

123. 10 steps to victory
1. ASLR .
2. .
3. .
4. .
5. .

124. 10 steps to victory
6. .
7. .
8. .
9. syscall .
10. syscall .

125. 1. Find KASLR slide

126. 2. Find available memory

127. 3. Find kernel
! .
! (VM !).
! :
! .
! .

128. 3. Find kernel
! .
!
.
! KASLR .
! 32 .

129. 3. Find kernel
! .
! 0 .
! .

130. 3. Find kernel
! VM .
! .
! ""

131. 3. Find kernel
! ?
! Mach-O .
! .
! .

132. 3. Find kernel
! KASLR
.
! .

133. 3. Find kernel
! .
! vmaddrs KASLR
.

134. 4. Compute rootkit size
! .
!
.

135. 5. Find free space
! __TEXT __DATA
.
! .
! 10.10.0 .
! 10.9.5 .

136. 5. Find free space
! !
! .
! .

137. 5. Find free space
!
.
!
.

138. 6. Write rootkit to memory
! .
! .

139. 6. Write rootkit to memory

140. 7. Fix rootkit symbols
! .
! .

141. 8. Find rootkit entrypoint
! .

142. 9. Modify unused syscall entry
! sysent .
! .
! syscall .
! sysent ( ).

143. 9. Modify unused syscall entry
!
”enosys” ”nosys” .
! Mavericks nosys .
! Yosemite enosys .
!
.

144. 10. Start rootkit

146. Problems
! non-writeable(
.
! .
!
.

147. Problems
! CR0 .
!
!
.

148. Problems
! CR0 CPU .
! ?

154. OS X
security
is...

156. CRAP!(

157. TOTAL
CRAP!

159. Conclusions
! Kext .
! .
! Apple
.

160. Conclusions
! (EOL)
.
! .
!

161. Conclusions
! Apple
.
! ...

163. Greetings
!
.

164. http://reverse.put.as
http://github.com/gdbinit
reverser@put.as
@osxreverser
#osxre @ irc.freenode.net
PGP key:
http://reverse.put.as/wp-content/uploads/2008/06/
publickey.txt
PGP Fingerprint:
7B05 44D1 A1D5 3078 7F4C E745 9BB7 2A44 ED41 BF05

166. References
! Images from images.google.com. Credit due to all their
authors.