Virtualise MacOS

GitHub - sickcodes/Docker-OSX: Run Mac in a Docker! Run near native OSX-KVM in Docker! X11 Forwarding! CI/CD for OS X!

Tools

https://github.com/xorrior/macOSTools

https://github.com/cedowens

Payloads

https://posts.specterops.io/introducing-mystikal-4fbd2f7ae520

• Infrastructure
  • C2
  • Signing executables
• Exploitation
• Once we gained access
  • Check TCC Access Permissions
  • Mounting the TimeMachine
  • Persistence
  • Credential Recovery
  • Active Directory
• Detection
• Payloads
  • Package payloads

Most enterprises have MacOS endpoints in some form, need to be prepared to exploit them.

Infrastructure

C2

Cobalt Strike is not supported on Linux or MacOS, alternate C2 includes:

• Mythic (https://github.com/its-a-feature/Mythic) A cross-platform, post-exploit, red teaming framework built with python3, docker, docker-compose, and a web browser UI.
  • Apfell (https://github.com/its-a-feature/Apfell): python server with JXA, python and golang agents (Linux & MacOS)
  • Merlin (https://github.com/Ne0nd0g/merlin): cross platform golang implant with HTTP/2 support (Windows, Linux MacOS)
• Pupy (https://github.com/n1nj4sec/pupy): python based implant with cross platform support (Windows, Linux, MacOS)