jxa 入门_持久JXA

最新推荐文章于 2021-02-11 09:23:40 发布

weixin_26722031

最新推荐文章于 2021-02-11 09:23:40 发布

阅读量790

点赞数

原文链接：https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5

版权

jxa 入门

A poor man’s Powershell for macOS

适用于macOS的穷人的Powershell

介绍 (Introduction)

Over the last year or so, I have been diving into macOS tradecraft. Through my research, an area of particular interest is the use of JavaScript for Automation (JXA) on macOS. My goal was to fulfill an operational need to decrease dependency on Python and further my understanding of macOS tradecraft that I can hopefully build on. This post serves as an overview of the benefits of JXA for macOS tradecraft development, highlights a well-known persistence method, and a few lesser-known JXA execution methods.

在过去的大约一年中，我一直在研究macOS tradecraft。通过我的研究，特别感兴趣的领域是在macOS上使用JavaScript for Automation(JXA)。我的目标是满足操作需求，以减少对Python的依赖，并进一步理解我希望可以建立的macOS tradecraft。这篇文章概述了JXA对macOS Tradecraft开发的好处，重点介绍了一种众所周知的持久性方法和一些鲜为人知的JXA执行方法。

JXA的简史 (A Brief History of JXA)

MacOS Yosemite (10.10) introduced JXA. Its implementation allows users to control applications and the operating system using the JavaScript language. It can be invoked via osascript, a compiled script (.scpt), or a compiled Application (.app). Additionally, it can be leveraged in OSAKit from within other macho binaries without spawning the osascript binary.

MacOS Yosemite(10.10)引入了JXA。它的实现允许用户使用JavaScript语言控制应用程序和操作系统。可以通过osascript ，已编译脚本( .scpt )或已编译应用程序( .app )调用它。另外，可以在OSAKit中从其他猛男二进制文件中利用它，而不会产生osascript二进制文件。

为什么选择JXA？ (Why JXA?)

The preferred method for post-exploitation macOS tradecraft is scripting languages over binaries. They allow attackers to avoid leveraging unsigned code and avoid going through the code signing cert process with Apple. Compiled binaries are subject to more scrutiny due to the built-in protections on macOS (Gatekeeper, Notarization, and XProtect).

漏洞利用后的macOS Tradecraft的首选方法是在二进制文件上编写脚本语言。它们使攻击者可以避免利用未签名的代码，并避免与Apple一起进行代码签名证书过程。由于macOS上的内置保护(Gatekeeper，Notarization和XProtect)，编译后的二进制文件将受到更多审查。

As mentioned previously, Python was the favorite for macOS post-exploitation tradecraft. Python was great for macOS tradecraft as it was easy to develop with and installed by default of macOS. However, the following note from the macOS Catalina (10.15) release indicates Apple is slowly migrating away from having Python and other scripting languages included by default.

如前所述，Python是macOS开发后交易工具的最爱。 Python非常适合macOS tradecraft，因为它很容易使用macOS开发并默认安装。但是，以下来自macOS Catalina(10.15)发行版的注释表明Apple逐渐从默认包含Python和其他脚本语言迁移。

Upon looking for future areas of tradecraft development, another option that arose was AppleScript. AppleScript has the same benefits of JXA but is quirky and, in my opinion, harder to develop with than JXA. It’s quirky because it attempts to use “natural language.” The best description I heard was it is trying to script through a series of conversations with Siri.

在寻找未来的Craft.io品开发领域时，出现了另一个选择是AppleScript 。 AppleScript具有与JXA相同的优点，但是它很古怪，而且在我看来，与JXA一起开发更难。这很奇怪，因为它尝试使用“自然语言”。我听到的最好的描述是它试图通过与Siri的一系列对话来编写脚本。

Based on those considerations, I turned towards JXA. JXA has similarities with early Powershell versions. It is not as robust as Powershell but allows for a convenient method to interact with macOS. JXA has a built-in Objective-C bridge that enables you to access the file system and Cocoa frameworks, such as Foundation and AppKit, which allows us to call Apple APIs without building binaries. Similar to Powershell commands, you can even obfuscate your commands using a simple JavaScript obfuscator to slow down defenders.

基于这些考虑，我转向了JXA。 JXA与早期Powershell版本具有相似之处。它不如Powershell强大，但允许使用便捷的方法与macOS进行交互。 JXA具有内置的Objective-C桥，使您能够访问文件系统和Cocoa框架，例如Foundation和AppKit，这使我们能够在不构建二进制文件的情况下调用Apple API。与Powershell命令类似，您甚至可以使用简单JavaScript 模糊处理程序来模糊化命令，从而降低防御程序的速度。

There are a few projects that leverage JXA for macOS tradecraft. HealthInspector and Orchard from its-a-feature leverage JXA for host situational awareness and Active Directory enumeration, respectively. Additionally, the Apfell JXA agent which facilitates Command and Control (C2).

有一些项目将JXA用于macOS tradecraft。 HealthInspector和Orchard利用其功能来分别利用JXA进行主机态势感知和Active Directory枚举。此外， Apfell JXA代理可简化命令和控制(C2)。

持久JXA (Persistent JXA)

To further develop my understanding of established macOS tradecraft, I developed the PersistentJXA project.

为了进一步了解已建立的macOS Tradecraft，我开发了PersistentJXA项目。

This section goes through a couple of usage examples as well as the related detections.

本节介绍了几个用法示例以及相关的检测。

持久性的Bash配置文件 (Bash Profiles for Persistence)

背景 (Background)

An older persistence method on macOS is the use of bash profiles. As a brief background, the ~/.bash_profile is a shell script that contains shell commands and is executed in the user’s context when a new shell opens. Attackers can abuse this by adding malicious commands to the profile to maintain persistence.

在macOS上，较旧的持久性方法是使用bash配置文件。作为简要背景，〜/ .bash_profile是一个包含脚本命令的shell脚本，并在打开新的shell时在用户上下文中执行。攻击者可以通过向配置文件添加恶意命令来保持持久性，从而滥用此功能。

The benefit of this persistence mechanism is that if an organization allows end-users to modify bash profiles, mitigation, and even detection becomes difficult due to the number of false positives. In my testing, I have found it easier to detect the actions the profile performs than the modification of the bash profile itself.

这种持久性机制的好处在于，如果组织允许最终用户修改bash配置文件，则由于误报的数量，缓解，甚至检测变得困难。在测试中，我发现检测配置文件执行的操作比修改bash配置文件本身更容易。

The implementation within PersistentJXA checks to determine if osascript is running; if not, it executes our persistence action (assumed osascript) upon opening a new terminal window. Since macOS Catalina, zshell is the default shell. If the script detects the host as macOS Catalina, then ~/.zshenv is used instead.

PersistentJXA中的实现检查以确定osascript是否正在运行；如果没有，它将在打开新的终端窗口时执行我们的持久性动作(假定为osascript )。从macOS Catalina开始， zshell是默认的shell。如果脚本将主机检测为macOS Catalina，则使用~/.zshenv 。

用法 (Usage)

The Apfell JXA agent can leverage all of the scripts within the PersistentJXA project. To gain access to the function, use the jsimport command.

Apfell JXA代理可以利用PersistentJXA项目中的所有脚本。要访问该功能，请使用jsimport命令。

Image for post — Importing Bash Profile Persistence Script

After importing, we can use the jsimport_call command to run the imported function.

导入后，我们可以使用jsimport_call命令运行导入的函数。

The PersistentJXA implementation of bash profile persistence creates two shell scripts in a created hidden directory. The apple.sh script provides the osascript monitoring action and the update.sh contains the user-specified persistence action.

bash概要文件持久性的PersistentJXA实现在创建的隐藏目录中创建两个Shell脚本。 apple.sh脚本提供osascript监视操作，而update.sh包含用户指定的持久性操作。

侦测 (Detection)

Again the modification of the ~/.bash_profile can be tracked but is not scalable. However, other elements of the persistence method can be detected.

同样，可以跟踪~/.bash_profile的修改，但不能扩展。但是，可以检测到持久性方法的其他元素。

osquery does not capture process events by default. For my testing, I made modifications to the Palantir osquery configuration found here and here. I then forwarded the osquery logs to Splunk.

osquery默认不捕获进程事件。为了进行测试，我对此处和此处找到的Palantir osquery配置进行了修改。然后，我将osquery日志转发到Splunk。

osquery captures the chmod actions on the apple.sh and update.sh scripts within the created hidden directory ./security.

osquery在已创建的隐藏目录./security捕获apple.sh和update.sh脚本上的chmod操作。

Additionally, osquery captures those scripts’ execution events upon opening a new terminal window in which osascript is not already running.

另外，osquery在打开尚未运行osascript的新终端窗口时捕获这些脚本的执行事件。

You may have noticed that the separate actions have the same Process Identifier (PID). Additional details on macOS process execution and why different commands can have the same PID is discussed here.

您可能已经注意到，单独的操作具有相同的进程标识符(PID)。此处讨论了有关macOS进程执行的其他详细信息以及为什么不同的命令可以具有相同的PID。

Lastly, osquery captures the launching of the persistence action (Apfell JXA payload). Flagging on the osascript invocation would be the most straightforward detection approach and would still occur if the persistence action was placed directly in the bash profile.

最后，osquery捕获持久性动作(Apfell JXA有效负载)的启动。对osascript调用进行标记将是最直接的检测方法，并且如果将持久性操作直接放置在bash概要文件中，则仍然会发生。