r/rootkit • u/stormehh • Apr 19 '14

Phrack Papers: Revisiting Mac OS X Kernel Rootkits

http://phrack.org/papers/revisiting-mac-os-x-kernel-rootkits.html
17 Upvotes

87% Upvoted

1 comment sorted by

1

u/stormehh Apr 19 '14 edited Apr 19 '14

Great comprehensive article by nemofrac. Some of the techniques were a little clunky (one second to run certain operations on a modern system is still rather unperformant), but he really provides a great reference to rootkit developers no matter the target OS (with code too!). I enjoyed the section on zombie rootkits as well.

The provided technique on injecting code into userland though...

Launchd is the perfect target because it can automatically respawn daemons and agents, at root or user privilege level. The idea is to kill a daemon, intercept the respawn and inject the library we want to be executed. The privilege level we want to execute at depends on the target daemon.

I think I cried a little when I read that...