SNet - Make My Implant Call Again

Of the same essence as PyleLess SNet is experimenting with unconventional payload staging and execution for macOS.

The modules rame and wassup demonstrate downloading a staged file onto an ephemeral RAM volume and executing a Mach-O bundle directly from memory through the legacy dyld APIs.

These proofs of concept help study implant reactivation, file masquerading, memory execution, and the detection opportunities these techniques expose.

flowchart TD
    subgraph generation["wassup: generate the staged files"]
        generate_sh["generate.sh"] -->|"python3 -B generate.py"| generate_py["generate.py"]
        c_source["Embedded C source<br/>exports run()"] --> generate_py
        generate_py -->|"clang -bundle"| macho["64-bit Mach-O bundle<br/>MH_BUNDLE, exported _run"]
        macho -->|"Base64 encode"| system_plist["SystemVersion.plist<br/>Base64 Mach-O payload"]
        wassup_py["wassup.py<br/>Python loader"] -->|"copy byte-for-byte"| info_plist["Info.plist<br/>masquerading Python script"]
        generate_py --> info_plist
    end

    subgraph server["C2 server"]
        http["python3 -m http.server"]
        info_plist --> http
        system_plist --> http
    end

    subgraph rame["rame: stage the loader on an ephemeral volume"]
        rame_sh["rame.sh"] -->|"python3 -B rame.py"| rame_py["rame.py"]
        rame_py -->|"hdiutil attach ram://..."| ram_device["RAM-backed disk device"]
        ram_device -->|"diskutil eraseVolume HFS+ Recovery"| recovery["/Volumes/Recovery"]
        rame_py -->|"GET /Info.plist"| http
        http -->|"Info.plist"| staged_loader["/Volumes/Recovery/Info.plist"]
        recovery --> staged_loader
        rame_py -->|"python3 -B"| staged_loader
    end

    subgraph execution["wassup: load and execute from memory"]
        staged_loader -->|"GET /SystemVersion.plist"| http
        http -->|"Base64 payload"| loader_memory["Decode and validate in memory<br/>64-bit MH_BUNDLE"]
        loader_memory -->|"NSCreateObjectFileImageFromMemory"| object_image["dyld object-file image"]
        object_image -->|"NSLinkModule"| linked_module["Private in-memory module"]
        linked_module -->|"lookup _run and call it"| run_symbol["run()"]
        run_symbol -->|"fopen / fputs / fclose"| proof["/private/tmp/LOL<br/>Coiffeur is saying 'Wassup!'..."]
        run_symbol --> forced_exit["wassup.py exits with status 69<br/>intentionally, after run() returns"]
    end

    forced_exit -->|"subprocess.CalledProcessError"| error["rame.py prints the command error"]
    error -->|"exception cleanup"| detach["hdiutil detach RAM device"]

Loading

Information

This tool is for educational purposes and allows you to experiment with the macOS environment.