I owned myself... 08-23-2014, 01:53 AM
#1
So, my MacBook recently started getting really, REALLY slow. I started tracing what might be causing this, I checked my hardware, no errors returned. This made me think, so I opened the Console (it displays all OS error messages), and guess what I saw?
To explain this error message to you, I guess I need to tell you a bit about a project I'm doing.
I'm currently writing a persistent reverse shell for OS X. It's especially the persistence part that's interesting here. To make OS X open an application on launch (every single time the system is booted), you have to make something called a .plist. A file, containing instructions for the OS about, how it should launch the tool and where to find it.
Being the idiot I am, I was smart enough to remove the reverse shell/malware from the location specified in the .plist file. My OS, was now trying to open a file that wasn't existing in the location it thought it would be, AND IT DID IT EVERY 10 SECONDS!
This eventually slowed down my system to a point, where I was ready to go kill myself. Luckily this can be used an example of why you ALWAYS write/test your malware in VM's.
Peace.
Code:
23/08/14 2:07:58,451 am com.apple.launchd.peruser.501[170]: (com.helper.osx.test[1041]) Exited with code: 2
23/08/14 2:07:58,451 am com.apple.launchd.peruser.501[170]: (com.helper.osx.test) Throttling respawn: Will start in 10 secondsTo explain this error message to you, I guess I need to tell you a bit about a project I'm doing.
I'm currently writing a persistent reverse shell for OS X. It's especially the persistence part that's interesting here. To make OS X open an application on launch (every single time the system is booted), you have to make something called a .plist. A file, containing instructions for the OS about, how it should launch the tool and where to find it.
Being the idiot I am, I was smart enough to remove the reverse shell/malware from the location specified in the .plist file. My OS, was now trying to open a file that wasn't existing in the location it thought it would be, AND IT DID IT EVERY 10 SECONDS!
This eventually slowed down my system to a point, where I was ready to go kill myself. Luckily this can be used an example of why you ALWAYS write/test your malware in VM's.
Peace.

![[+]](https://sinister.li/images/modern/collapse_collapsed.png)

