CVE-2023-32364-macos-app-sandbox-escape

CVE-2023-32364-macos-app-sandbox-escape Exploit for CVE-2023-32364...

macos_sandbox

Introduction to macOS - the App sandbox Continuing with my transition to macOS blogpost series, I'd like to discuss a bit about the macOS App sandbox. It is highly recommended to read the macOS App structure blogpost first - I will be assuming the reader knows the difference between Apps, process...

osx-password-dumper

🍎 🔓 OSX Password Dumper Script Overview A bash script to retrieve user's .plist files on a macOS system and to convert the data inside it to a crackable hash format. to use with John The Ripper or Hashcat Useful for CTFs/Pentesting/Red Teaming on macOS systems. Prerequisites The script must be ru...

procinfo

procinfo A portable process inspector for Linux and macOS. Get details about any running process instantly! Also see procinfominimal.sh - pure sh implementation of procinfo. Installation curl -fsSL https://raw.githubusercontent.com/wenekar/procinfo/main/procinfo.sh -o procinfo chmod +x procinfo...

CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV

Executive summary macOS Music and TV do an insecure rename resulting in FDA by gaining full control over the user's TCC.db I reported this bug in separate tickets for each app, feel free to merge if applicable. The underlying problem is that these apps have FDA but fail to sanitize their file...

CVE-2021-40531

CVE-2021-40531 This proof-of-concept in action. Sketch is a popular UI/UX design app for macOS. This post covers a vulnerability in Sketch that I discovered back in July, CVE-2021-40531. In its simplest form, it is a macOS quarantine bypass, but in context it can be used for remote code execution...

EvilOSX

EvilOSX A pure python, post-exploitation, remote administration tool RAT for macOS / OS X. Features Emulate a simple terminal instance. Sockets are encrypted with CSR via OpenSSL. No dependencies pure python. Persistence. Auto installer, simply run EvilOSX on the target and the rest is handled...

CVE-2017-2370

0x00. Introduction This privilege escalation exploits a vulnerability in machvoucherextractattrrecipetrap, and the core of the exploitation method is through MACHMSGOOLPORTSDESCRIPTOR messages. Regarding machmsg ool, simply put, when sending an msg containing an ool descriptor, the kernel copies...

CVE-2022-22639

Details See Blog: https://www.trendmicro.com/enus/research/22/d/macos-suhelper-root-privilege-escalation-vulnerability-a-deep-di.html Exploitation of CVE-2022-22639 1. Compile with command: clang exploit.m -o /tmp/exploit -framework Foundation -fobjc-arc -fobjc-link-runtime...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

xpc-string-leak

xpc-string-leak xpc-string-leak is a proof-of-concept exploit for an out-of-bounds memory read in libxpc. This exploit uses the vulnerability to read out-of-bounds heap memory from diagnosticd, an unsandboxed root process with the taskforpid-allow entitlement. The vulnerability: CVE-2018-4248 On...

ma2tl

ma2tl macapt to timeline This is a DFIR tool for generating a macOS forensic timeline from the analysis result DBs of macapt. Requirements Python 3.7.0 or later pytz tzlocal xlsxwriter Installation % git clone https://github.com/mnrkbys/ma2tl.git Usage % python ./ma2tl.py -h usage: ma2tl.py -h -i...

MacOSThreatTrack

MacOS ThreatTrack v2.0 Enhanced security information gathering tool for macOS systems with advanced threat detection capabilities. Description MacOSThreatTrack is a comprehensive bash-based security reconnaissance tool designed for proactive detection of malicious activity on macOS systems. This...

machscope

MachScope A native macOS binary analysis tool providing Mach-O parsing, ARM64 disassembly, and process debugging. Built entirely in Swift with zero external dependencies. Features Feature| Description ---|--- Mach-O Parsing| Headers, segments, sections, symbols, dylibs, strings Code Signatures|...

FinalShellDecodePass

FinalShellDecodePass Encryption/Decryption /Applications/FinalShell.app/Contents/Java/finalshell.jar!/myssh/O0O0OO0OOOO0OO0000O0O0O0000O00OOO0OOOOO00000OO0O0O0OOO00OOO0O00O000OOOO0OO00000O0OO0OOO00O0000OOOOOO.class The password field is in /Library/FinalShell/conn/xxxxxx/xxxxxxconnectconfig.json...

CVE-2023-26818

Disclaimer This exploit has been created solely for the purposes of research and for the development of effective defensive techniques. It is not intended to be used for any malicious or unauthorized activities. The author and the owner of the script disclaim any responsibility or liability for a...

CVE-2026-64747

CVE-2026-64747 — AppleAVE2 kernel driver: wire format + reachability PoC Root-cause analysis and macOS reachability proof-of-concept for CVE-2026-64747, a buffer overflow in the AppleAVE2 video encoder kernel extension com.apple.driver.AppleAVE2 fixed in macOS 26.6 kext 905.40.1. AppleAVE2 —...

Mythic-Macro-Generator

Mythic-Macro-Generator Python3 script to generate MS Office macros for launching Mythic JXA payloads. This script generates an Office macro which uses osascript to download and execute the Mythic JXA .js payload. Steps: 1. Set up Mythic C2 server and generate an "apfell" jxa payload note: this...

Forblaze

Forblaze - A Python Mac Steganography Payload Generator/In-Memory Dylib/MachO Execution Author: AsaurusRex Disclaimer DO NOT use this project for purposes other than legitimate red teaming/pentesting jobs, or research. DO NOT use this for illegal activity of any kind, and know that this project i...

CVE-2011-3368

CVE-2011-3368 PoC Exploit. cve-2011-3368 Install: git clone https://github.com/colorblindpentester/CVE-2011-3368 cd CVE-2011-3368 python2 CVE-2011-3368.py Tested on: OS X macos Parrot OS Kali linux...