macOS Post-Exploitation Methodology

46 programs across 8 categories for comprehensive macOS post-exploitation. Uses native tools (security, dtrace, xattr, log, launchctl, dscl, defaults, osascript), Python, and direct SQLite access.

Prerequisites

Before deploying machook tools, verify:

1. Root access — most operations require root (recon programs work without root)
2. SIP status — DTrace tools require SIP disabled (csrutil disable from Recovery Mode)
3. Native tools only — all tools use macOS CLI, no third-party dependencies

csrutil status                           # SIP status (DTrace needs disabled)
sw_vers                                  # macOS version
id                                       # current user/groups
security list-keychains                  # available keychains

Kill Chain Phases

Phase 1 — Reconnaissance (First 60 seconds)

Understand the target before deploying offensive tools.

Action	Command	Purpose
System info	machook system_info	Kernel, distro, CPU, memory, disk, hardware model
Processes	machook process_enum	Running processes, root services, listening ports
Network	machook network_enum	Interfaces, routing, ARP, DNS, Wi-Fi, firewall
Users	machook user_enum	Local users, admin group, sudo access, last logins
Applications	machook installed_apps	Installed apps, Homebrew, pip, npm — check versions via cve-mcp
Security posture	machook security_framework	SIP, Gatekeeper, FileVault, Firewall, XProtect, EDR, MDM
LaunchDaemons	machook launchd_enum	LaunchAgents/Daemons, third-party plist detection

CVE Integration: After running installed_apps or security_framework, check software versions against CVE database via cve-mcp (cve search_by_product --product <name> --version <ver>). If cve-mcp is not enabled: bountyreper mcp enable cve.

Phase 2 — Credential Harvesting

Extract credentials from macOS-specific stores.

Action	Command	Purpose
Keychain dump	machook keychain_dump	Extract passwords from login/system Keychain
Chrome creds	machook chrome_creds	Chrome/Safari passwords, cookies, autofill
SSH keys	machook ssh_keys	Private keys, known_hosts, authorized_keys, SSH config
Safari data	machook safari_creds	History, bookmarks, downloads, extensions, LocalStorage
Cloud creds	machook cloud_creds	AWS, GCP, Azure, Docker, Kubernetes credentials
GPG keys	machook gpg_keys	GPG private keys, keyrings, agent status
iCloud tokens	machook icloud_tokens	iCloud account tokens, Accounts.sqlite, Keychain DB
Mail creds	machook mail_creds	Mail.app account credentials and tokens

Phase 3 — Privilege Escalation

Escalate from user to root.

Action	Command	Purpose
TCC bypass	machook tcc_bypass	Access camera, microphone, files without consent
Dylib hijack	machook dylib_hijack	SUID/SGID binaries with weak dylib paths, DYLD_INSERT
LaunchDaemon abuse	machook launchd_plist_abuse	Writable plists/binaries in LaunchDaemons
Sudo misconfig	machook sudo_misconfig	NOPASSWD, env_keep DYLD, sudo version CVEs
Auth DB	machook authorization_db	Authorization Database rights for privesc vectors
Installer abuse	machook pkg_abuse	Trojaned .pkg files, writable installer scripts

Phase 4 — Persistence

Maintain access across reboots.

Action	Command	Purpose
LaunchAgent	machook launchagent_persist --label NAME --command CMD	User-level persistence (survives reboot)
LaunchDaemon	machook launchdaemon_persist --label NAME --command CMD	Root-level persistence (requires root)
Login items	machook login_items --path /path/to/app	Run on user login via System Events
Cron	machook cron_persist --command CMD	Scheduled crontab persistence
Shell RC	machook bashrc_persist --command CMD	Inject into .zshrc/.bashrc (runs on shell open)
Periodic	machook periodic_scripts --command CMD --frequency daily	/etc/periodic/ scripts (root, daily/weekly/monthly)

Phase 5 — Monitoring

Observe target activity for intelligence gathering.

Action	Command	Purpose
Keylogging	machook keylog_mac --duration 120	Capture keystrokes via osascript with app context
Process trace	machook dtrace_exec --duration 60	Monitor all process executions (SIP disabled)
Network trace	machook dtrace_net --duration 60	Monitor network connections (SIP disabled)
File trace	machook dtrace_file --duration 60	Monitor file access (SIP disabled)
Clipboard	machook clipboard_monitor --duration 60	Capture clipboard changes (passwords, tokens)
Screenshot	machook screen_capture	Silent screenshot via screencapture

Phase 6 — Lateral Movement

Pivot to other systems on the network.

Action	Command	Purpose
SSH pivot	machook ssh_pivot --target HOST --command CMD	SSH lateral movement, tunnels, agent forwarding
AirDrop recon	machook airdrop_abuse	AirDrop discoverability and nearby device scan
Bonjour/mDNS	machook bonjour_enum	Discover SSH, HTTP, SMB, AFP, VNC services
Apple Remote Desktop	machook apple_remote_desktop	ARD/Screen Sharing status and access audit

Phase 7 — Evasion & Anti-Forensics

Reduce forensic footprint and bypass defenses.

Action	Command	Purpose
XProtect check	machook xprotect_check	Enumerate detection signatures for evasion planning
Gatekeeper bypass	machook gatekeeper_bypass --path /path	Remove quarantine xattr for unsigned execution
Clear logs	machook log_clear	Clear unified logging, audit, crash reports
Clear history	machook history_clear	Shell, app history, recent items, Spotlight
Timestomp	machook timestomp --path /path --reference /ref	Modify file timestamps to blend in
EDR bypass	machook endpoint_security_bypass	Enumerate EDR extensions, check SIP/MDM bypass vectors

Phase 8 — Exfiltration & Cleanup (MANDATORY)

Stage data and remove all traces.

Action	Command	Purpose
Stage data	machook data_stage --type keys --output /tmp/out.tar.gz	Find and archive sensitive files
Audit artifacts	machook artifact_enum	Pre-cleanup audit of all BountyReper traces
Cleanup	machook cleanup_mac	ALWAYS run before exiting

Detection Considerations

macOS post-exploitation tools are detectable by:

• Endpoint Security Framework (ESF) — EDR agents using es_new_client() for process/file/auth events
• Unified Logging — log show --predicate 'process == "security"' for Keychain access
• TCC audit — TCC access logged in Console.app, tccutil events visible
• SIP — When enabled, blocks DTrace system-wide tracing and TCC.db modification
• XProtect — Scans downloaded executables against YARA rules
• Gatekeeper — Checks code signing and quarantine attributes
• MDM/Jamf Protect — Managed Macs report configuration changes, new LaunchAgents
• CrowdStrike Falcon / SentinelOne — macOS EDR detects suspicious security command usage, CGEventTap, dylib injection
• LaunchDaemon monitoring — New plists in /Library/LaunchDaemons/ trigger alerts
• Authorization DB changes — Modifications to system.privilege.* rights are logged
• SSH audit — New authorized_keys entries, SSH tunnels visible in lsof

Program Reference

Program	Technique	MITRE ATT&CK
system_info	System information enumeration	T1082
process_enum	Process and service discovery	T1057
network_enum	Network configuration discovery	T1016
user_enum	Local account and group discovery	T1087.001
installed_apps	Software discovery with cve-mcp CTA	T1518
security_framework	Security software discovery	T1518.001
launchd_enum	Service enumeration	T1007
keychain_dump	macOS Keychain extraction	T1555.001
chrome_creds	Browser credential decryption	T1555.003
ssh_keys	SSH private key discovery	T1552.004
safari_creds	Safari browser data extraction	T1555.003
cloud_creds	Cloud credential harvesting	T1552.001
gpg_keys	GPG private key extraction	T1552.004
icloud_tokens	iCloud token harvesting	T1528
mail_creds	Mail credential extraction	T1114.001
tcc_bypass	TCC database manipulation	T1548
dylib_hijack	Dylib search order hijacking	T1574.004
launchd_plist_abuse	Writable plist/binary abuse	T1574.006
sudo_misconfig	Sudo misconfiguration abuse	T1548.003
authorization_db	Authorization DB rights abuse	T1548
pkg_abuse	Installer package abuse	T1546.016
launchagent_persist	LaunchAgent persistence	T1543.001
launchdaemon_persist	LaunchDaemon persistence	T1543.004
login_items	Login item persistence	T1547.015
cron_persist	Cron job persistence	T1053.003
bashrc_persist	Shell RC file persistence	T1546.004
periodic_scripts	Periodic script persistence	T1053.003
xprotect_check	XProtect/MRT signature enumeration	T1518.001
gatekeeper_bypass	Quarantine xattr removal	T1553.001
log_clear	System log clearing	T1070.002
history_clear	Shell/app history clearing	T1070.003
timestomp	File timestamp modification	T1070.006
endpoint_security_bypass	EDR enumeration and bypass	T1562.001
keylog_mac	Keystroke capture	T1056.001
dtrace_exec	Process execution tracing	T1057
dtrace_net	Network connection tracing	T1049
dtrace_file	File access tracing	T1083
clipboard_monitor	Clipboard data capture	T1115
screen_capture	Screen capture	T1113
ssh_pivot	SSH lateral movement	T1021.004
airdrop_abuse	AirDrop reconnaissance	T1021
bonjour_enum	mDNS service discovery	T1046
apple_remote_desktop	ARD/Screen Sharing abuse	T1021.003
data_stage	Sensitive data staging	T1074.001
artifact_enum	Pre-cleanup artifact audit	T1070
cleanup_mac	Artifact removal and cleanup	T1070