bfinject

bfinject Inyección sencilla de dylibs para iOS de 64 bits con jailbreak 11.0 - 11.1.2. Compatible con los jailbreaks de Electra y LiberiOS. bfinject carga dylibs arbitrarios en apps de App Store en ejecución. Tiene soporte integrado para descifrar apps de App Store y viene incluido con iSpy y...

Swift-Attack

Swift-Attack 针对蓝队的单元测试，帮助构建针对一些常见 macOS 后渗透方法的检测规则。我提供了一些后渗透示例，既包括使用命令行历史的，也包括使用 API 调用的。这里列出的后渗透示例并非包罗万象，只是一些我觉得有助于开展单元测试的常见例子。我计划随着时间的推移，不断向该项目添加更多的单元测试。 所有这些测试均在本地运行，并将结果输出到 stdout（即 Swift-Attack 不会连接到服务器）。 步骤： 1. git clone https://github.com/cedowens/Swift-Attack && cd Swift-Attack 2. 确保已安装...

CVE-2024-55503

CVE-2024-55503 Termius 应用 MacOS dylib 命令注入 描述 Termius v.9.9.0 之前版本中存在一个问题，允许本地攻击者通过精心构造的脚本向 DYLDINSERTLIBRARIES 组件执行任意代码。使用 dylib root@kitploit: DYLDINSERTLIBRARIES=exploitcombined.dylib /Applications/Termius.app/Contents/MacOS/Termius 复现 影响 命令执行（本地） 参考资料 CVE...

macOSTools

macOSTools macOS 攻击性工具 AUnit 音频单元插件的示例 XCode 项目 MigrationToolPayload 迁移工具插件 SpecialDelivery 安装程序插件 authplugin 认证插件 dylibinjection dylib 注入的源代码。基于 Jonathan Levin 的代码 http://newosxbook.com/src.jl?tree=listings&file=inject.c HIDMan IOHIDManager 键盘记录器 脚本运行器 jxarunner 用于内存中 JXA 执行的 Rust 库 先决条件 1. Rust...

ios-malicious-bithunter

iOS恶意位猎手 摘要 iOS恶意位猎手是一个针对iOS应用的恶意插件检测引擎。它能够基于运行时分析注入的dylib动态库的macho文件头部，并通过接口输入特性进行行为分析，以判断动态库特征的行为。该程序不依赖越狱环境，可在AppStore上使用。 新特性 这是一种精确识别iOS恶意代码行为的新方法。基于对App中Mach-O格式的内存中恶意代码运行的分析方法，它可以执行灵活的行为识别以进行分析和持续跟踪。这是一种非常准确的防插件防御方法，包括行为、变量及高度混淆的代码（包括ollvm），在我们的防御过程中取得了非常好的效果。 使用方法 1...

CVE-2024-53407

CVE-2024-53407 在 Phiewer 4.1.0 中，dylib 注入会导致命令执行，攻击者可以注入 dylib 文件，从而可能导致远程控制以及对 macOS 上敏感用户数据的未授权访问。 复现 使用 .dylib 文件注入命令 root@kitploit: DYLDINSERTLIBRARIES=exploitcombined.dylib /Applications/Phiewer\ \lite.app/Contents/MacOS/Phiewer\ \lite\ 影响 命令执行（本地） 参考 https://phiewer.com/...

CVE-2023-49313

CVE-2023-49313 Una vulnerabilidad de inyección de dylib en XMachOViewer 0.04 permite a los atacantes comprometer la integridad. Al explotarla, se puede inyectar código no autorizado en los procesos del producto, lo que potencialmente conduce al control remoto y al acceso no autorizado a datos...

DylibHijackTest

DylibHijackTest Requisitos Instala los requisitos de Python3: pip3 install -r requirements.txt Compila la dylib desde el código fuente porque no confíes en cosas compiladas de GitHub: gcc -dynamiclib DylibHijackTest.c -o DylibHijackTest.dylib Cómo funciona ⚠️ Esto generará muchos procesos en tu...

bfdecrypt

bfdecrypt Utilidad para descifrar apps del App Store en iOS 11.x con jailbreak Descifrar apps del App Store en LiberiOS Este es un ejemplo que usa https://github.com/BishopFox/bfinject para descifrar la app de Reddit en un iPhone con jailbreak de Electra: root@kitploit: Cs-iPhone: root bash...

CVE-2025-65741

CVE-2025-65741 - Sublime Text 3 vulnerable a inyección de Dylib para macOS root@kitploit: Download: https://www.sublimetext.com/3 CVE: CVE-2025-65741 | https://nvd.nist.gov/vuln/detail/CVE-2025-65741 Author: Vinicius Batistella Version Affected: Sublime Text 3 Build 3208 or prior for macOS Detall...

PT-2026-47796

1 Local Privilege Escalation via DYLIB Injection CVE-2026-24064 2 Local Privilege Escalation via Insecure XPC Client Validation CVE-2026-24065 Multiple Local Privilege Escalation Vulnerabilities in Waves Audio Waves Central https://t.co/fkys4ePhWy...

PT-2026-47795

Name of the Vulnerable Software and Affected Versions Waves Central for macOS versions 13.0.9 through 16.5.5 Description A trusted XPC client component is signed with hardened runtime entitlements that allow dynamic library injection. A local attacker can use the DYLD INSERT LIBRARIES environment...

CVE-2026-24070

During the installation of the Native Access application, a privileged helper com.native-instruments.NativeAccess.Helper2, which is used by Native Access to trigger functions via XPC communication like copy-file, remove or set-permissions, is deployed as well. The communication with the XPC servi...

CVE-2026-24070

During the installation of the Native Access application, a privileged helper com.native-instruments.NativeAccess.Helper2, which is used by Native Access to trigger functions via XPC communication like copy-file, remove or set-permissions, is deployed as well. The communication with the XPC servi...

EUVD-2026-5108

During the installation of the Native Access application, a privileged helper com.native-instruments.NativeAccess.Helper2, which is used by Native Access to trigger functions via XPC communication like copy-file, remove or set-permissions, is deployed as well. The communication with the XPC servi...

CVE-2026-24070 Local Privilege Escalation via DYLIB Injection in Native Instruments Native Access

During the installation of the Native Access application, a privileged helper com.native-instruments.NativeAccess.Helper2, which is used by Native Access to trigger functions via XPC communication like copy-file, remove or set-permissions, is deployed as well. The communication with the XPC servi...

PT-2026-5657

Name of the Vulnerable Software and Affected Versions Native Instruments Native Access affected versions not specified Description The Native Access application installs a privileged helper, com.native-instruments.NativeAccess.Helper2, used for triggering functions via XPC communication, such as...

CVE-2023-49313

A dylib injection vulnerability in XMachOViewer 0.04 allows attackers to compromise integrity. By exploiting this, unauthorized code can be injected into the product's processes, potentially leading to remote control and unauthorized access to sensitive user data...

CVE-2019-20856

An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection...

CVE-2025-65741

Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection. An attacker could compile a .dylib file and force the execution of this library in the context of the Sublime Text application...