macOS-Kernel-Exploit

macOS-Kernel-Exploit DISCLAIMER You need to know the KASLR slide to use the exploit. Also SMAP needs to be disabled which means that it's not exploitable on Macs after 2015. These limitations make the exploit pretty much unusable for in-the-wild exploitation but still helpful for security...

decrypted

decrypted FairPlay decryptor dump iPA for iOS Application that running on macOS with SIP-enabled, using CVE-2025-24204. Support macOS 15.0-15.2 STILL UNDER DEVELOPMENT Credits CVE-2025-24204 Decryptor...

FinalShellDecodePass

FinalShellDecodePass Encryption/Decryption /Applications/FinalShell.app/Contents/Java/finalshell.jar!/myssh/O0O0OO0OOOO0OO0000O0O0O0000O00OOO0OOOOO00000OO0O0O0OOO00OOO0O00O000OOOO0OO00000O0OO0OOO00O0000OOOOOO.class The password field is in /Library/FinalShell/conn/xxxxxx/xxxxxxconnectconfig.json...

physmem

physmem physmem is a physical memory inspection tool and local privilege escalation targeting macOS up through 10.12.1. It exploits either CVE-2016-1825 or CVE-2016-7617 depending on the deployment target. These two vulnerabilities are nearly identical, and exploitation can be done exactly the...

boko

boko Application Hijack Scanner for macOS boko.py is an application scanner for macOS that searches for and identifies potential dylib hijacking and weak dylib vulnerabilities for application executables, as well as scripts an application may use that have the potential to be backdoored. The tool...

rootOS

rootOS Tries to use various CVEs to gain sudo or root access. All exploits have an end goal of adding ALL ALL=ALL NOPASSWD: ALL to /etc/sudoers allowing any user to run sudo commands. Run python root.py Exploits Name| CVE| Date| Links ---|---|---|--- ARDAgent| CVE-2008-2830| 06/23/2008|...

cypheroth

Cypheroth Automated, extensible toolset that runs cypher queries against Bloodhound's Neo4j backend and saves output to spreadsheets. Description This is a bash script that automates running cypher queries against Bloodhound data stored in a Neo4j database. I found myself re-running the same...

iOS-Kernel-Crash

CVE-2018-4407 Memory Corruption The vulnerability is a heap buffer overflow in the networking code in the XNU operating system kernel. XNU is used by both iOS and macOS, which is why iPhones, iPads, and Macbooks are all affected. My exploit PoC just overwrites the heap with garbage, which causes ...

CVE-2025-45528

An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF...

CVE-2025-45528

An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to achieve arbitrary code execution by processing a crafted PDF file. No specific root cause, remediation details, or exploit links are provided in the documents beyond the sighting of a proof-of-concept. Explo...

EUVD-2025-211197

An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF...

CVE-2026-64747

CVE-2026-64747 — AppleAVE2 kernel driver: wire format + reachability PoC Root-cause analysis and macOS reachability proof-of-concept for CVE-2026-64747, a buffer overflow in the AppleAVE2 video encoder kernel extension com.apple.driver.AppleAVE2 fixed in macOS 26.6 kext 905.40.1. AppleAVE2 —...

SwiftBelt

SwiftBelt About SwiftBelt is a macOS enumerator inspired by @harmjoy's Windows-based Seatbelt enumeration tool. SwiftBelt does not utilize any command line utilities and instead uses Swift code leveraging the Cocoa Framework, Foundation libraries, OSAKit libraries, etc. to perform system...

CVE-2025-24204

CVE-2025-24204 About CVE-2025-24204 is a vulnerability that allows reading any process memory on SIP-enabled macOS systems. The root cause of this vulnerability stems from adding an excessively powerful entitlement com.apple.system-task-ports.read to the gcore binary. Exploiting this vulnerabilit...

CVE-2026-64705

CVE-2026-64705 — HFS xattr kernel heap overflow macOS Root-cause analysis and proof-of-concept for CVE-2026-64705, a buffer overflow in the HFS kernel extension fixed in macOS Sonoma 14.8.7 HT127117: HFS — Impact: An app may be able to cause unexpected system termination or write kernel memory. A...

CVE-2026-9999-exploit

CVE-2026-9999 — Chrome ANGLE/Metal WebGL PoC Hunting Harness macOS 1. Vulnerability summary Field| Value ---|--- CVE| CVE-2026-9999 Vendor / product| Google Chrome Affected| Chrome 148.0.7778.216, macOS only 1 Fixed in| 148.0.7778.216 1 Impact| Arbitrary code execution inside a sandbox via a...

yarasafe

YARASAFE - Automatic Binary Function Similarity Checks with Yara SAFE is a tool developed to create Binary Functions Embedding developed by Massarelli L., Di Luna G.A., Petroni F., Querzoni L. and Baldoni R. You can use SAFE to create your function embedding to use inside yara rules. If you are...

vpwn

vpwn by qwertyoruiop generic xnu heap overflow exploitation. demo output: $ ./pwn i Preparing payload... i broke out of kaslr, kaslrslide = 0000000001a00000 + Payload successfully crafted. i Manipulating the heap... i Exploit loaded. + got r00t sh-3.2 uname -a Darwin qwertyoruiops-iMac.local 14.3...

sharesniffer

sharesniffer sharesniffer is a network analysis tool for finding open and closed file shares on your local network. It includes auto-network discovery and auto-mounting of any open cifs and nfs shares. How to use Example to find all hosts on any local network with open/closed nfs/smb shares: pyth...

norimaci

Norimaci "Norimaci" is a simple and lightweight malware analysis sandbox for macOS. This tool was inspired by "Noriben". Norimaci uses the features of OpenBSM or Monitor.app to monitor macOS system activity instead of Sysinternals Process Monitor procmon. Norimaci consists of 3 Python scripts...