macOS process injection playbook. Use when you need to inject code into running or launching macOS processes via dylib hijacking, DYLD environment variables, XPC exploitation, Mach port manipulation, or Electron/Chromium abuse.

SKILL: macOS Process Injection — Expert Attack Playbook AI LOAD INSTRUCTION : Expert macOS process injection techniques. Covers DYLD INSERT LIBRARIES, dylib hijacking (weak/rpath/proxy), XPC PID reuse attacks, Mach port manipulation, MIG abuse, and Electron injection. Base models miss entitlement prerequisites and SIP constraints on injection vectors. 0. RELATED ROUTING Before going deep, consider loading: [macos security bypass](../macos security bypass/SKILL.md) when you need to bypass TCC, Gatekeeper, or SIP protections blocking your injection [linux privilege escalation](../linux privilege escalation/SKILL.md) for Unix layer escalation (shared object hijacking concepts apply) Advanced Reference Also load [DYLIB XPC TECHNIQUES.md](./DYLIB XPC TECHNIQUES.md) when you need: Step by step dylib hijacking methodology with tooling commands XPC exploitation walkthrough with code examples Mach port technique details and task for pid patterns 1. DYLD INSERT LIBRARIES INJECTION The most straightforward injection: set an environment variable that forces the dynamic linker to preload your dylib. 1.1 Requirements and Restrictions Condition Can Inject? Reason Normal (non hardened) binary Yes No restrictions Hardened Runtime enabled No DYLD strips env vars Hardened Runtime + com.apple.security.cs.allow dyld environment variables Yes Entitlement explicitly allows it Apple system binary (SIP protected) No DYLD env vars stripped by SIP SUID/SGID binary No DYLD env vars stripped for privilege safety App Sandbox enabled No Sandbox blocks env var injection 1.2 Basic Injection 1.3 Finding Injectable Targets 2. DYLIB HIJACKING Exploit the dynamic linker's library search order to load attacker controlled dylibs instead of (or in addition to) legitimate ones. 2.1 Weak Dylib Hijacking (LC LOAD WEAK DYLIB) Weak dylibs are optional — if missing, the binary still runs. If you can place a dylib at the expected path, it loads. 2.2 @rpath Hijacking @rpath is resolved from LC RPATH entries in the binary. If an earlier rpath directory is writable, you can place your dylib there. 2.3 Dylib Proxying Replace a legitimate dylib with a malicious one that forwards all exports to the original. 2.4 Dependency Enumeration 3. XPC EXPLOITATION XPC (Cross Process Communication) is macOS's primary IPC mechanism for privilege separation. Privileged XPC services are high value targets. 3.1 XPC Service Discovery 3.2 PID Reuse Attack XPC connections validated by PID are vulnerable to race conditions: attacker spawns process, PID is checked and passes, attacker's process exits, OS reuses PID for malicious process. Validation Method Vulnerable? Notes PID based check Yes PID recycled after process exit Audit token No Unique per process lifecycle, not recycled Code signature check No Validates signing identity Entitlement check No Checks process entitlements 3.3 XPC Client Validation Weaknesses Weakness Description Exploitation No client validation Service accepts any connection Connect directly, send commands PID only validation Race condition exploitable PID reuse attack (§3.2) Bundle ID check only Bundle IDs can be spoofed Create app with matching bundle ID Partial code requirement Missing anchor checks Sign with any cert matching partial requirement Entitlement check on wrong process Checks parent instead of client Spawn from entitled parent 4. MACH PORT MANIPULATION Mach ports are the kernel level IPC primitive underlying XPC. Direct Mach port access enables powerful injection. 4.1 Task Port (task for pid) Access Method Requirement Post Exploit Capability task for pid() Root + not SIP protected target Full memory R/W, thread injection processor set tasks() Root + com.apple.system task ports Enumerate all task ports Exception ports Set via task set exception ports Catch target crashes, redirect execution Thread injection Task port obtained Create new thread in target address space 4.2 Port Namespace Manipulation Technique Description Port name guessing Mach port names are sequential integers — brute forceable in some contexts mach port insert right Insert send right into target's namespace (requires task port) Bootstrap server abuse Register service name before legitimate service → intercept connections 5. MIG (MACH INTERFACE GENERATOR) ABUSE MIG generates C stubs for Mach IPC. MIG servers may have vulnerabilities in their dispatch routines. 5.1 Analysis Approach 5.2 Common MIG Vulnerabilities Vulnerability Description Missing audit token validation MIG handler doesn't verify sender identity Type confusion MIG deserialization trusts client provided type descriptors Port lifecycle issues Use after deallocate on Mach ports between MIG calls OOL (out of line) memory abuse Oversized OOL descriptors → kernel memory issues 6. ELECTRON / CHROMIUM INJECTION Many macOS apps use Electron (Slack, Discord, VS Code, Teams, etc.). Electron apps expose multiple injection surfaces. 6.1 ELECTRON RUN AS NODE 6.2 Debugging Flags 6.3 NODE OPTIONS Injection 6.4 Electron Fuses Modern Electron apps use "fuses" to disable dangerous features. Check fuse state: Fuse When Enabled (secure) When Disabled (exploitable) RunAsNode ELECTRON RUN AS NODE stripped Can use app as Node.js EnableNodeCliInspectArguments inspect flags stripped Can attach debugger EnableNodeOptionsEnvironmentVariable NODE OPTIONS stripped Can inject preload OnlyLoadAppFromAsar Only loads from .asar Can replace JS files 7. APPLICATION SCRIPTING (APPLE EVENTS) 8. PROCESS INJECTION DECISION TREE 9. DETECTION & FORENSICS Artifact Where to Look DYLD INSERT LIBRARIES use Process environment ( /proc/PID/environ , ps eww ) Unexpected dylibs loaded vmmap PID or DYLD PRINT LIBRARIES=1 output XPC connection anomalies Endpoint Security es event type t XPC events Electron debug port open lsof i :9229 osascript execution Unified log: log show predicate 'process=="osascript"' Unsigned code execution codesign verify failures, Gatekeeper logs

macos-process-injection