mac-monitor

🎉 欢迎来到 Mac Monitor 的官方新家！ Mac Monitor 是一款先进、独立的系统监控工具，专为 macOS 安全研究、恶意软件分类和系统故障排除而设计 。利用 Apple 的 Endpoint Security ES 和 System Extension API，它收集并丰富系统事件，以图形方式显示，具有广泛的功能集，旨在仅显示与您相关的事件。收集的遥测数据包括进程、进程间、内存、XPC、文件事件等，以及丰富的元数据，使用户能够轻松地将事件置于上下文中并讲述一个故事。凭借直观的界面和丰富的分析功能，Mac Monitor...

CVE-2023-42931

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ macOS Privilege...

CVE-2024-55504

CVE-2024-55504 An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote control and unauthorized access to sensitive user data via the exploitcombined.dylib component on MacOS Reproduce From Terminal root@kitploit:...

awesome-security-hardening

awesome-security-hardening Una colección de excelentes guías de hardening de seguridad, buenas prácticas, listas de verificación, benchmarks, herramientas y otros recursos. Esto es un trabajo en curso: por favor contribuye enviando tus sugerencias. Puedes hacerlo creando tickets de incidencia o...

santa

Santa Santa is a binary and file access authorization system for macOS. It consists of a system extension that monitors for executions & file access, and makes decisions based on the contents of a local database, a GUI agent that notifies the user in case of a block decision, a background service...

santa

Santa Santa 是 macOS 的二进制及文件访问授权系统。它由一个系统扩展组成，负责监视执行和文件访问，并根据本地数据库的内容做出决策；另有一个 GUI 代理，在做出阻止决策时通知用户；一个用于与远程服务器同步配置的后台服务；以及一个用于管理系统的命令行工具。 它之所以叫 Santa（圣诞老人），是因为它负责记录哪些二进制是“顽皮的”还是“乖巧的”。 文档 Santa 文档存储在 Docs 目录中，并发布在 https://northpole.dev。 文档中包括部署选项、Santa 各部分的工作原理详情，以及开发 Santa 本身的说明。 获取帮助...

CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV

Executive summary macOS Music and TV do an insecure rename resulting in FDA by gaining full control over the user's TCC.db I reported this bug in separate tickets for each app, feel free to merge if applicable. The underlying problem is that these apps have FDA but fail to sanitize their file...

MacDirtyCowDemo

Get root on macOS 13.0.1 with CVE-2022-46689 macOS equivalent of the Dirty Cow bug, using the testcase extracted from Apple's XNU source. https://worthdoingbadly.com/macdirtycow/ Usage On a macOS 13.0.1 / 12.6.1 or below machine, run: root@kitploit: clang -o switcharoo vmunalignedcopyswitchrace.c...

DigiTrack

DigiTrack In 30 seconds, this attack can learn which networks a MacOS computer has connected to before, and plant a script that tracks the current IP address and Wi-Fi network every 60 seconds. Now includes: Hardtracker - Digispark VPN buster to send the IP address and BSSID/SSID of nearby Wi-Fi...

POC

POC ¡Solo para fines de investigación! Una colección pública de POCs y Exploits para las vulnerabilidades que descubrí. CVE-2022-22583 PackageKit : Una aplicación podría acceder a archivos restringidos SIP Bypass CVE-2022-26690 PackageKit : Una aplicación maliciosa podría modificar partes...

GenEtherExploit

EN GenEtherExploit is a Proof-of-Concept PoC exploit for the macOS vulnerability CVE-2023-40404. This PoC leverages IOKit APIs to interact with the IOUserEthernetResource network service, manipulating the system's network interfaces. The purpose of this exploit is to demonstrate a potential kerne...

macOS-Kernel-Exploit

macOS-Kernel-Exploit DISCLAIMER You need to know the KASLR slide to use the exploit. Also SMAP needs to be disabled which means that it's not exploitable on Macs after 2015. These limitations make the exploit pretty much unusable for in-the-wild exploitation but still helpful for security...

plaso

Plaso Plaso Langar Að Safna Öllu - super timeline all the things Plaso Plaso Langar Að Safna Öllu, or super timeline all the things , is a Python-based engine used by several tools for automatic creation of timelines. Plaso default behavior is to create super timelines but it also supports creati...

Apple-Remote-Crash-Tool-CVE-2018-4407

Apple-Remote-Crash-Tool-CVE-2018-4407 Crashes any macOS High Sierra or iOS 11 device that is on the same WiFi network Just a small Tool that uses a public 'heap buffer overflow vulnerability' CVE-2018-4407 and makes it easier to exploit whole networks. Requirements MacOS Python installed Scapy...

EvilOSX

EvilOSX An evil RAT Remote Administration Tool for macOS / OS X. Marco Generator by Cedric Owens This project is no longer active Features Emulate a terminal instance Simple extendable module system No bot dependencies pure python Undetected by anti-virus OpenSSL AES-256 encrypted payloads...

CVE-2023-32407-a-macOS-TCC-bypass-in-Metal

CVE-2023-32407-a-macOS-TCC-bypass-in-Metal...

POC-for-CVE-2023-41993

CVE-2023-41993 PoC exploit for CVE-2023-41993. It's written only up to addrof/fakeobj. Reliability is not great. If you want to make it better, try to spray structure IDs. POC link https://po6ix.github.io/POC-for-CVE-2023-41993/pwn.html I have decided to host with github pages from multiple...

exr-imageio-poc

exr-imageio-poc PoC for an integer overflow vulnerability in ImageIO patched in iOS/macOS 26.5 CVE-2026-28990 Bug discovered by Jiri Ha & Arni Hardarson The vulnerability There was an integer overflow in function EXRReadPlugin::decodeBlockAppleEXR prior to iOS/macOS 26.5 when calculating the size...

machscope

MachScope ネイティブなmacOSバイナリ解析ツール。Mach-Oパース、ARM64逆アセンブル、プロセスデバッグを提供します。完全にSwiftで構築され、外部依存関係はありません。 機能...

macos_sandbox

macOS 入门 - 应用沙盒 继续我的 macOS 迁移系列博文，我想稍微讨论一下 macOS 应用沙盒。 强烈建议先阅读 macOS 应用结构 这篇博文——我会假定读者了解应用（App）与进程（任务）之间的区别，对 launchd 及其与应用启动的关系有一定了解。 沙盒示例 我第一次了解 macOS 沙盒时，天真地尝试创建一个恶意的 Word 宏。 这在 Windows 生态系统中（至今）仍然是一个非常常见的攻击向量，所以我想看看我是否能够直接启动进程并肆意破坏。 好吧，在 macOS 上事情并没有那么简单——例如，我确实能够运行进程，但似乎它们做不了太多事情。...