launchd-portrep

launchd-portrep launchd-portrep is an exploit for a port replacement vulnerability in launchd, the initial userspace process and service management daemon on macOS. By sending a crafted Mach message to the bootstrap port, launchd can be coerced into deallocating its send right for any Mach port t...

darling

Darling Darling is a runtime environment for macOS applications. Please note that most GUI applications will not run at the moment. Download Packages for some distributions are available for download under releases. Build Instructions For build instructions, visit Darling Docs. Prefixes Darling h...

ssl-kill-switch2

SSL Kill Switch 2 Blackbox tool to disable SSL/TLS certificate validation - including certificate pinning - within iOS and macOS applications. Second iteration of https://github.com/iSECPartners/ios-ssl-kill-switch . Description Once loaded into an iOS or macOS application, SSL Kill Switch 2 will...

EFISwissKnife

. //| | | | | | | \ | \ | | / / / || / / . . . / / || | |/ | | |/ \ / / / |/ /// | || | /|| | / / / / / / EFI Swiss Knife An IDA plugin to improve UEFI reversing Copyright C 2016, 2017 Pedro Vilaça fG! - [email protected] - https://reverse.put.as This is an IDA plugin to assist in UEFI...

Armor

Armor Armor is a simple Bash script designed to create encrypted macOS payloads capable of evading antivirus scanners. Below is an example gif of Armor being used with a simple Netcat payload. A Netcat listener is started on port 4444. The "payload.txt" file is read and shown to contain a simple...

electroniz3r

electroniz3r Take over macOS Electron apps' TCC permissions with electroniz3r. The tool has been presented for the first time on DEFCON31 in Las Vegas during my ELECTRONizing macOS privacy - a new weapon in your red teaming armory talk. Overview $ electroniz3r OVERVIEW: macOS Red Teaming tool tha...

Blue-Team-Notes

Blue Team Notes A collection of one-liners, small scripts, and some useful tips for blue team work. I've included screenshots where possible so you know what you're getting. Contact me If you see a mistake, or have an easier way to run a command then you're welcome to hit me up on Twitter or comm...

MacDirtyCowDemo

Get root on macOS 13.0.1 with CVE-2022-46689 macOS equivalent of the Dirty Cow bug, using the testcase extracted from Apple's XNU source. https://worthdoingbadly.com/macdirtycow/ Usage On a macOS 13.0.1 / 12.6.1 or below machine, run: clang -o switcharoo vmunalignedcopyswitchrace.c sed -e...

EvilOSX

EvilOSX An evil RAT Remote Administration Tool for macOS / OS X. Marco Generator by Cedric Owens This project is no longer active Features Emulate a terminal instance Simple extendable module system No bot dependencies pure python Undetected by anti-virus OpenSSL AES-256 encrypted payloads...

CVE-2026-20660

CVE-2026-20660 PoC Bundle This folder packages a standalone proof-of-concept for: CVE-2026-20660 CFNetwork NSGZipDecoder path traversal via gzip FNAME Impact on vulnerable macOS Safari with auto-open enabled 1. Directory Layout server.py: Main PoC server with configurable traversal depth and...

CVE-2024-32002

CVE-2024-32002 RCE PoC Overview This repository contains a Proof of Concept PoC for CVE-2024-32002, a Remote Code Execution RCE vulnerability in Git submodules. The exploit demonstrates how a malicious payload can be triggered via a recursive clone of a Git repository. Repository Setup Before...

Coldroot

Coldroot Mac OS Trojan made with love 3 i make this one cuz i believe we don't give Mac it's rights in this field :P so i decided to make this Trojan to Play with Mac users 😂 Tools i'm using Free Pascal 3.0 http://www.freepascal.org/down/i386/macosx.var Intellij IDEA 15 Ultimate...

spectreScope

spectreScope The demo of the speculative execution attack Spectre CVE-2017-5753, CVE-2017-5715. Tested On macOS Intel - Apple MacBook Pro Retina, 15-inch, Late 2013 - macOS High Sierra 10.13.2 - 1 IntelR CoreTM i7-4750HQ CPU @ 2.00GHz - git 2.14.3 - cmake 3.10.1 - Xcode 9.2 Linux Intel - HP...

gsscred-move-uaf

GSSCred-move-uaf The com.apple.GSSCred XPC service, which runs as root on macOS and iOS, does not properly implement the "move" command, leading to a use-after-free condition in the doMove function. The GSSCred service can be reached from within the default application sandbox on iOS. This progra...

PoisonApple

PoisonApple This is a command-line tool to perform various persistence mechanism techniques on macOS. This tool was designed to be used by threat hunters for cyber threat emulation purposes. Install Do it up: $ pip3 install poisonapple --user Note: PoisonApple was written & tested using Python 3....

CVE-2019-8627

CVE-2019-8627 a kernel information leak on macOS= 10.14.4 =============================== How to reproudce: 1. turn on firewall 2. run the proof of concept as root 3. disconnect Belkin USB-C LAN network and then connect the Belkin USB-C LAN network. after these operations you will get the leaked...

CVE-2026-115392

Versions of Wasmtime prior to 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 are vulnerable to a filesystem sandbox escape in wasmtime-wasi . The root cause is that the cap-std dependency mishandles symlinks containing trailing slashes on macOS and Linux kernels la...

EUVD-2026-108326

Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any...

CVE-2021-30853

CVE-2021-30853 A simple POC script to test for CVE-2021-30657 affecting MacOS. This CVE allows bypass of gatekeeper, notraization and xprotect checks. Vulnerability detail This Vunlerability occurs when you don't define a interpreter or specify a interpreter that itself is a shell script in first...

c0ntextomy

c0ntextomy an informal fallacy and a type of false attribution in which a passage is removed from its surrounding matter in such a way as to distort its intended meaning Wikipedia - Contextomy A Proof of Concept demonstrating the vulnerability with a debug session hijack, remote code execution, a...