launchd-portrep

launchd-portrep launchd-portrep is an exploit for a port replacement vulnerability in launchd, the initial userspace process and service management daemon on macOS. By sending a crafted Mach message to the bootstrap port, launchd can be coerced into deallocating its send right for any Mach port t...

Triple_Fetch-Kernel-Creds

Triple-Fetch-Kernel-Creds Attempt to steal kernelcredentials from launchd + taskt pointer Based on: CVE-2017-7047 About Triple Fetch by Ian Beer from Google Project Zero Triple Fetch is an exploit for iOS devices prior to iOS 10.3.3 It exploits a logic error in libxpc that allows attackers to sen...

CVE-2026-112445

CVE-2026-112445: The Simplest macOS Local Privilege Escalation to Date In 2020, someone raised a question on GitHub: What is uscwoap? macOS had already switched to zsh, so why did com.apple.xpc.uscwoap still invoke Bash? A reply showed the job's configuration. It had the BootShell flag set and...

xspawn

xspawn xspawn starts a program on macOS through launchd and never execs that program itself. The aim is that an EDR records launchd as the parent, not this tool or the calling shell. by cenobyte [email protected] 2026 https://github.com/cenobyte-vincit/xspawn Summary xspawn opens...

machscope

machscope machscope is a terminal-native macOS explorer that turns processes, launchd jobs, Mach services, bundles, signatures, entitlements, and Mach-O linkage into one interrogable graph. It exists to answer a simple question brutally well: What is this process, service, binary, or bundle reall...

Exploit for CVE-2026-112445

CVE-2026-112445: The Simplest macOS Local Privilege Escalation...

blanket

blanket Blanket es una evasión de sandbox dirigida a iOS 11.2.6, aunque la vulnerabilidad principal solo se parcheó en iOS 11.4.1. Explota una vulnerabilidad de reemplazo de puertos Mach en launchd CVE-2018-4280, así como varias vulnerabilidades menores en otros servicios, para ejecutar código...

haxx

haxx Ejecución de código haxx sin ataduras ni sandbox como root en iOS 14 - iOS 14.8.1. Basado en CoreTrustDemo. Tenga en cuenta que los certificados no están sujetos a derechos de autor. Uso Nota: requiere macOS + jailbreak existente Puesta en marcha Este método funciona en 14.0-14.6. 14.7...

xspawn macOS launchd Parent Spoofing Client

xspawn is a macOS process execution utility that submits programs directly to launchd through its private XPC bootstrap interface. Rather than executing the requested program itself, xspawn causes launchd to spawn the process through xpcproxy, resulting in Endpoint Security and EDR telemetry...

Malicious code in cami-design (npm)

Source: amazon-inspector 57ccc787b2437085a18ed05c52fc473d8c28162cbe3cbbaa04adaefa73389da1 On install, scripts/install.js invokes autoUpdate.install, which writes a launchd agent to /Library/LaunchAgents/co.themobilefirst.cami-design.update.plist scripts/auto-update.js that runs npm install -g...

Malicious code in cami-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57ccc787b2437085a18ed05c52fc473d8c28162cbe3cbbaa04adaefa73389da1 On install, scripts/install.js invokes autoUpdate.install, which writes a launchd agent to...

MAL-2026-4504 Malicious code in cami-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57ccc787b2437085a18ed05c52fc473d8c28162cbe3cbbaa04adaefa73389da1 On install, scripts/install.js invokes autoUpdate.install, which writes a launchd agent to...

EUVD-2007-4686

Malware in sbrugna...

EUVD-2014-1436

Malware in sbrugna...

EUVD-2014-1434

Malware in sbrugna...

EUVD-2014-1437

Malware in sbrugna...

SUSE CVE-2005-1725

launchd 106 in Apple Mac OS X 10.4.x up to 10.4.1 allows local users to overwrite arbitrary files via a symlink attack on the socket file in an insecure temporary directory...

Google uncovers new iOS security feature Apple quietly added after zero-day attacks

Google Project Zero on Thursday disclosed details of a new security mechanism that Apple quietly added to iOS 14 as a countermeasure to prevent attacks that were recently found to leverage zero-days in its messaging app. Dubbed "BlastDoor," the improved sandbox system for iMessage data was...

CVE-2019-5013

An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service in the start/stopLaunchDProcess command. The command takes a user-supplied string argument and executes launchctl under root context. A user with local access can use this...

CVE-2019-5013

An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service in the start/stopLaunchDProcess command. The command takes a user-supplied string argument and executes launchctl under root context. A user with local access can use this...