macOSTriageCollectionScript

macOSTriageCollectionScript A triage data collection script for macOS that utilises sysdiagnose with a few additions to gather useful triage data for investigations. What does the script collect? Data collected includes: sysdiagnose , a utility on a vareity of macOS/iOS operating systems that...

aftermath

About Aftermath is a Swift-based, open-source incident response framework. Aftermath can be leveraged by defenders in order to collect and subsequently analyze the data from the compromised host. Aftermath can be deployed from an MDM ideally, but it can also run independently from the infected...

CVE-2021-30657

CVE-2021-30657 A simple POC for CVE-2021-30657 affecting MacOS Vulnerability detail A vulnerability in syspolicyd allows specially crafted application bundle downloaded from internet to bypass foundational macOS security features such as File Quarantine, Gatekeeper, and Notarization. Armed with...

inficere

inficere Public version of my Mac OS X rootkit built on top of fractalG's onyx-the-black-cat https://github.com/gdbinit/onyx-the-black-cat Tested only in Mountain Lion, 10.8.2 to 10.8.5. Not guaranteed to work on other versions. Features process hiding - hides from 'ps PID', 'ps aux', Activity...

autofs-cve-2026-84568

CVE-2026-84568 — Reverse engineering notes and reproduction Independent reverse engineering of the macOS autofs patch for CVE-2026-84568 , plus a working PoC for the trust-boundary violation. Apple published the advisory. Mr.Gedik @h4ck2s3c reported the bug. This repository documents the technica...

ESFang

ESFang This is a tool devised for modular consumption of EndpointSecurity Framework ESF events from the MacOs environment. This is my attempt to overcome a number of issues encountered with existing tools including things such as silent data dropping, strict event type consumption, lack of suppor...

CVE-2019-6203-PoC

CVE-2019-6203-PoC There is a PEAP bug in all Apple devices that would allow an attacker to force any Apple device iOS, macOS or tvOS to associate with a malicious access point. This is a PoC for CVE-2019-6203, works on iOS 12.2, macOS 10.14.4, tested on Kali Linux. You need a Wi-Fi card that...

wifi_leak

WiFi Bug - CVE-2018-4084 ZeroFest 2017 Environment tested on macOS High Sierra 10.13.1 tested on MacBook Pro Retina, 15-inch, Mid 2015 Reference https://support.apple.com/en-us/HT208465...

Mystikal

Mystikal macOS Initial Access Payload Generator Intended to be used with https://github.com/its-a-feature/Mythic Related Blog Post: https://posts.specterops.io/introducing-mystikal-4fbd2f7ae520 Usage: 1. Install Xcode on build machine Required for Installer Package w/ Installer Plugin 2. Install...

PoC

PoC A collection of proof-of-concept codes from DARKNAVY. CVE-2025-43300 Target: iOS && macOS Version: before iOS 18.6.2 && macOS 14.7.8 CVE-2025-6554 Target: Chrome Renderer Version: before 138.0.7204.96 CVE-2024-5274 Target: Chrome Renderer Version: before 125.0.6422.112 Blog Post: CVE-2024-527...

dtrace-memaccess_cve-2020-27949

Reading and writing memory of other processes using fasttrap The /dev/fasttrap device for creating trap nodes in user-space processes for the pid and objc providers has the permissions 666. In contrast to /dev/dtrace, which is also 666, fasttrap lacks a permission check. This allows any process t...

ctl_ctloutput-leak

ctlctloutput-leak The ctlctloutput function in macOS High Sierra 10.13 ignores the return value of a call to sooptcopyin, which opens up a race window to leak uninitialized kernel heap data to user space. ctlctloutput-leak is a proof-of-concept exploit that attempts to trigger this information...

CVE-2018-4121

CVE-2018-4121 - Safari Wasm Sections POC RCE Exploit by MWR Labs c 2018 Details this proof of concept exploit targets Safari 11.0.3 13604.5.6 on macOS 10.13.3 17D47 versions only. compile the payload of your choice as a dylib with a constructor run python filetojsarray.py your.dylib payload.js...

CVE-2018-4407

CVE-2018-4407 Massive IOS/MAC Attack Exploit CVE-2018-4407 is a Simple and Very Fast BOF attack Against IOS/MAC that can lead to DOS. The vulnerability is a heap buffer overflow in the networking code in the XNU operating system kernel. XNU is used by both iOS and macOS, which is why iPhones,...

CVE-2024-23741

CVE-2024-23741 An issue in Hyper through 3.4.1 on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. There is a tool designed to automate the process of searching for vulnerabilities in electron:...

Aegis-releases

Aegis Claude Code's sandbox lets an agent read your SSH keys and AWS credentials by default. Aegis doesn't. Two layers, both verified on real hardware. Kernel sandbox — the agent's own shell cannot reach a denied path: $ ! cat /.ssh/idrsa cat: /Users/you/.ssh/idrsa: Operation not permitted $ ! ca...

CVE-2018-4121

CVE-2018-4121 - Safari Wasm Sections POC RCE Exploit by MWR Labs c 2018 Details this proof of concept exploit targets Safari 11.0.3 13604.5.6 on macOS 10.13.3 17D47 versions only. compile the payload of your choice as a dylib with a constructor run python filetojsarray.py your.dylib payload.js...

Malimite

Description Malimite is an iOS and macOS decompiler designed to help researchers analyze and decode IPA files and Application Bundles. Built on top of Ghidra decompilation to offer direct support for Swift, Objective-C, and Apple resources. Features Multi-Platform Mac, Windows, Linux Direct suppo...

CVE-2022-22639

Details See Blog: https://www.trendmicro.com/enus/research/22/d/macos-suhelper-root-privilege-escalation-vulnerability-a-deep-di.html Exploitation of CVE-2022-22639 1. Compile with command: clang exploit.m -o /tmp/exploit -framework Foundation -fobjc-arc -fobjc-link-runtime...

wifi-password

wifi-password Quickly fetch your WiFi password and if needed, generate a QR code of your WiFi to allow phones to easily connect. Works on macOS and Linux , Windows Installation Install using pip $ python3 -m pip install --user wifi-password Install using git $ git clone...