This document summarizes Spencer McIntyre's presentation on using Python and Meterpreter's Railgun functionality to integrate with and execute code on Apple devices. It discusses how Railgun allows calling native library functions in memory on Windows targets. The presentation demonstrates extending this capability to macOS by using Python ctypes to interface with Objective-C and macOS APIs like Foundation and libobjc, enabling tasks like running AppleScript code directly from memory without writing to disk. Example code is provided and potential issues around memory operations and segmentation faults are addressed.

1. The Python in the Apple
BSides Cleveland 2017
Spencer McIntyre

2. Agenda
• About Me
• Python ctypes Review
• Integration with Meterpreter (Railgun)
• Objective-C from Railgun
• Demonstration Time

3. About Me
• Spencer McIntyre
• Work at SecureState
• Research, Development, “Special” Projects
• BSOD-inducer
• Avid open source contributor
• Metasploit among others
• Python enthusiast

4. Railgun
Pew Pew Pew

5. Why do we care?
• One word: Stealth
• Everything here could be accomplished an “easier” way
• Writing files (often scripts) to disk
• Starting new processes

6. Meterpreter’s Railgun
• Standard API Extension of Metepreter
• Remote FFI (Foreign Function Interface)
• Only available for Windows (prior to
March 2017)
• Facilitates in-memory loading and calling
of native library code from the target
• Used by many Windows post and a few
local exploit modules
• You’ve probably used it without realizing it

7. Meterpreter’s Railgun
• Exposed through four basic Meterpreter API functions
• railgun_api
• Core functionality to load an arbitrary function, call it with defined parameters
and return results
• railgun_api_multi
• Execute multiple calls in a single transaction, offers better speed when used
• railgun_memread
• Read data out of the Meterpreter process, useful when pointers are returned
• railgun_memwrite
• Write data to in the Meterpreter process

8. Python Meterpreter
• First non-Windows implementation of Railgun
• Heavily utilizes ctypes to make all of the native API calls
• memread / memwrite were deceptively difficult
• Linux version backed with process_vm_(read|write)
• ctypes already supported function calls so wrapping that was relatively cross-
platform
• Error code retrieval is the primary difference
• Memory operations on the other hand…

9. OSX Memory Primitives
• Invalid access (read or write) results in
segmentation fault when not done safely
• Segmentation fault = session closed
• Enter the libc’s mach_vm_*
• Accessible via standard ctypes methods
• Graceful failure will help you have a good
time
• Error codes are returned for invalid
addresses and invalid permissions

10. OSX APIs From Railgun
Less Pew Pew more Segmentation fault

11. OSX APIs
• APIs are provided by frameworks
• /System/Library/Frameworks
• Mach-O universal binaries
• Major ones
• Foundation
• Accounts
• Social
• Security
• Loadable by Python’s ctypes
• Not particularly useful, the interfaces exposed are insufficient by themselves

12. libobjc
• Provides the runtime for Objective-C code
• This is accessible via C, ctypes will work as expected
• Allows initialization and usage of Objective-C classes
• Severe lack of documentation
• Apple doesn’t advertise this method
• Internet is full of reasons why it’s a Bad Idea™
• Repetitive API to use Objective-C objects this way
• objc_getClass objc_msgSend sel_registerName

13. Bad Idea™

14. Objective-C Object
• Basically chaining calls to objc_msgSend
• id objc_msgSend(id self, SEL op, …);
• Uses the standard CDECL calling convention
• Accepts a variable number of arguments (this is key)
• First parameter is the class instance, (or the class itself when you’re first
creating an instance)
• Second parameter is the “method selector”
• This is a string passed to sel_registerName
• Contains the method name and parameters by name

15. Objective-C Object
dlopen(‘Foundation.framework/Foundation’, RTLD_LAZY)
nsstring = objc_msgSend(
objc_msgSend(
objc_getClass(‘NSString’),
sel_registerName(‘alloc’)
),
sel_registerName(‘initWithCString:encoding:’),
‘Hello World’,
NSUTF8StringEncoding
)

16. Demonstration Time!
• Tying it all together to run an Apple Script in memory
• Uses NSAppleScript

17. Beware Faults

18. Code is Public
• https://github.com/zeroSteiner/metasploit-framework
• https://github.com/zeroSteiner/metasploit-payloads
• Both branches are pymet-rg-osx

19. Further Reading & Resources
• How Meterpreter’s Railgun works
• https://community.rapid7.com/community/metasploit/blog/2017/05/18/recen
t-python-meterpreter-improvements
• https://warroom.securestate.com/inner-workings-railgun/

20. • Spencer McIntyre
• Twitter: @zeroSteiner
Thank You For Your Time!