# Macos Post Exploitation

> macOS endpoint post-exploitation — launchd persistence, TCC bypass, Keychain credential access, dylib hijacking, Gatekeeper/quarantine evasion, and discovery on Apple hosts.

- Skill: `purpleailab/macos-post-exploitation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/macos-post-exploitation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/macos-post-exploitation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/macos-post-exploitation

---


# macOS post-exploitation

Post-compromise operations on Apple/macOS endpoints. Apple's controls
(TCC, Gatekeeper/quarantine, SIP, code signing, AMFI) shape every step, so the
playbook is organized around defeating or living within them. Prefer
on-host built-ins (`launchctl`, `security`, `sqlite3`, `dscl`, `system_profiler`,
`codesign`, `xattr`) over dropped tooling for OPSEC.

> Authorized engagements only. Stay within RoE scope; emulate destructive
> actions as benign proofs unless explicitly authorized.

## Discovery (T1087.001 / T1518 / T1647)
- `system_profiler SPSoftwareDataType SPHardwareDataType` — OS build, model, SIP.
- `csrutil status` — System Integrity Protection on/off.
- `dscl . -list /Users | grep -v '^_'` — local accounts; `id`, `groups`.
- `sw_vers`, `profiles status -type enrollment` — MDM/Jamf managed? (T1647 plist prefs).
- Installed security tooling: `ls /Library/Objective-See`, `pgrep -l 'CrowdStrike|SentinelOne|falcon|Jamf|santad'`.

## Privilege escalation
- **TCC bypass / abuse (T1548 family).** TCC gates access to Documents, Desktop,
  Downloads, camera/mic, Full Disk Access. Check `sqlite3
  ~/Library/Application\ Support/com.apple.TCC/TCC.db 'select * from access'`
  (user) and `/Library/Application Support/com.apple.TCC/TCC.db` (system, needs root).
  Abuse an already-FDA-granted app (e.g. a terminal/Electron app) to read
  protected data instead of triggering a prompt.
- **Sudo / admin group.** `sudo -n true` (cached creds), membership in `admin`.
- **Setuid hunting:** `find / -perm -4000 -type f 2>/dev/null`.

## Persistence
- **LaunchAgents / LaunchDaemons (T1543.001 / T1543.004).** Drop a plist in
  `~/Library/LaunchAgents` (user, no root) or `/Library/LaunchDaemons` (root,
  runs as root at boot); `launchctl bootstrap gui/$(id -u) <plist>`. The classic,
  noisy-but-reliable mechanism.
- **Login items (T1547.015)** via `osascript -e 'tell application "System Events"
  to make login item ...'` or a Service Management (`SMAppService`) helper.
- **Dylib hijacking / proxying (T1574.004).** Find apps with a writable/missing
  `@rpath` or weak-linked dylib (`otool -l <app>`); plant a malicious dylib that
  re-exports the original. Survives as the host app's identity.
- **Re-opened apps / cron / emond / at** — lower-signal fallbacks.

## Defense evasion
- **Gatekeeper / quarantine (T1553.001).** Downloaded files carry the
  `com.apple.quarantine` xattr; `xattr -d com.apple.quarantine <file>` (or
  `xattr -c`) strips it so the binary runs without the Gatekeeper prompt.
- **Code signing (T1553).** `codesign --force --deep --sign - <bundle>` ad-hoc
  signs a tampered bundle; check `codesign -dv --verbose=4` and `spctl -a -vv`.
- **File-permission/attribute manipulation (T1222.002):** `chflags`, `chmod`.
- **AppleScript / osascript execution (T1059.002)** for living-off-the-land.

## Credential access (T1555.001)
- **Keychain.** `security find-generic-password -ga <svc>` /
  `security find-internet-password`; `security dump-keychain -d
  ~/Library/Keychains/login.keychain-db` (prompts unless unlocked). Offline:
  exfil the `*.keychain-db` + the login password and crack with `chainbreaker`.
- **Browser & app secrets** under `~/Library/Application Support/...` (often
  TCC-protected — see TCC abuse above).
- **Sudo/SSH keys** in `~/.ssh`, `~/.aws`, `~/.kube`.

## Collection, C2 & exfil
- Stage under `/tmp` or `~/Library/Caches`; archive with `tar`/`ditto`.
- C2: prefer signed, allow-listed channels; see `post-exploit/c2` and
  `post-exploit/c2-sliver` (Sliver has a macOS implant). Beacon over HTTPS to
  blend with managed-device telemetry.

## Detection & defense (blue-cell notes)
- Monitor new plists in `*/LaunchAgents` and `*/LaunchDaemons` and `launchctl`
  bootstraps; alert on `xattr -d com.apple.quarantine`, ad-hoc `codesign`,
  `security dump-keychain`, and TCC.db reads by non-Apple binaries.
- Endpoint Security framework (ES) + tools like santad/Objective-See catch most
  of the above; LOTL via `osascript`/`launchctl` is the gap to watch.

## See also
`post-exploit/credential-access`, `post-exploit/lateral-movement`,
`post-exploit/privilege-escalation`, `shared/defense-evasion`, `reverser/ios-static`.