macOS Offensive Tools

Example XCode project for Audio Unit Plugins

Migration tool plugin

Installer plugin

Authentication Plugin

Source code for dylib injection. Based off of code from Jonathan Levin http://newosxbook.com/src.jl?tree=listings&file=inject.c

IOHIDManager keylogger

Rust library for in-memory JXA execution

Prerequisites

1. Rust

2. Mythic JXA Payload. Saved to disk

Build Steps

1. Use the PAYLOAD and KEY environment variables with cargo build to generate the lib. KEY will be used as a static XOR key.
2. PAYLOAD=apfell.js KEY=SOMEKEY cargo build --release
3. Release build is in target/release/libjxa_runner.dylib
4. For debug versions, a log file is created in /private/tmp/jxa_runner.log
5. To test, PAYLOAD=apfell.js KEY=SOMEKEY cargo test

Rust library for in-memory Python execution

Prerequisites

1. Rust

2. Python Payload. Saved to disk

Build Steps

1. Use the PAYLOAD and KEY environment variables with cargo build to generate the lib. KEY will be used as a static XOR key.
2. PAYLOAD=medusa.py KEY=SOMEKEY cargo build --release
3. Release build is in target/release/libpython_runner.dylib
4. For debug versions, a log file is created in /private/tmp/python_runner.log
5. To test, PAYLOAD=script.py KEY=SOMEKEY cargo test