Often they arrange things so the kernel is re-exploited from userland during the boot process, or shortly thereafter. Some tricks that I recall being used: addi

Often they arrange things so the kernel is re-exploited from userland during the boot process, or shortly thereafter. Some tricks that I recall being used: adding a new launch daemon; signing an app with a developer certificate; and dropping a binary that abuses quirks in the dynamic linker to evade signature checks.