Persistence without sudo

[marten4n6]

Persistence without sudo

[Marten4n6]

Very weird. Never had a permission issue with that directory, persistence doesn't need root.
Are you running any anti-virus software (this might be blocking writing to the LaunchAgents directory)?

[rwbxn]

No, it's a fresh new Macbook Air, did exactly nothing with it, except for trying to run the payload. Really weird.

[Marten4n6]

https://github.com/Marten4n6/EvilOSX/blob/master/EvilOSX.py#L342 is the line which decides which directory the launch agent is written to, could you change this line to:
return os.path.expanduser("~/Library/LaunchDaemons")
Once you've changed this line you can build a new payload and it'll use this directory, hopefully this fixes the issue.

[rwbxn]

Unfortunately not working, no permission without root and Library/LaunchDaemons does not exist on my device. I tried again with root and he is creating the folder then.

Output with root:
[DEBUG] setup_persistence:277 - Creating launch agent...
[DEBUG] setup_persistence:302 - Moving EvilOSX...
[DEBUG] setup_persistence:312 - Loading launch agent...
[ERROR] setup_persistence:326 - Unexpected output: /Users/xxxxx/Library/LaunchDaemons/oiou.plist: Path had bad ownership/permissions
[INFO] main:383 - Receiving command...
[WARNING] main:446 - Failed to connect to the server.

[Marten4n6]

Library/LaunchDaemons does not exist on my device.

That doesn't matter, EvilOSX will create the directory.
I have a feeling you accidentally ran a payload as sudo before and are now trying to run another payload without sudo. This won't work since EvilOSX would of created the directories with the owner set to root so you won't have permission to write to it.

[Marten4n6]

Closing due to inactivity, feel free to reopen this issue.

[rwbxn]

Did a factory reset on the device and tried again. Now I'm getting this error:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "<string>", line 24, in <module>
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 154, in urlopen
    return opener.open(url, data, timeout)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 431, in open
    response = self._open(req, data)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 449, in _open
    '_open', req)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 409, in _call_chain
    result = func(*args)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 1240, in https_open
    context=self._context)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 1197, in do_open
    raise URLError(err)
urllib2.URLError: <urlopen error [Errno 61] Connection refused>

Do you know what's wrong? I don't want to try to open with root access, but I think that it has nothing to do with the permission. Thank you.

[Marten4n6]

urllib2.URLError: <urlopen error [Errno 61] Connection refused>

You need to start the server.