Introduction
While common macOS applications are protected by the hardened runtime, shellcode execution is often still possible because of various entitlements permitting unsigned executable memory. As more applications transition to using the more-restrictive “allow-jit” entitlement, previous execution techniques are rendered ineffective.
Execution
In this presentation, the speaker examines macOS JIT internals and evaluates public documentation on JIT memory through empirical testing. The research aims to discover the true restrictions on JIT memory and how shellcode can execute under these conditions. Multiple approaches to executing shellcode in applications with the “allow-jit” entitlement are demonstrated. The presentation ends with a practical demonstration of shellcode execution using a Microsoft Word macro.
