/explore
|
You are here 
|
balintmagyar.com | ||
| | | | |
bradleyjkemp.dev
LaunchDaemon (or LaunchAgent) Hijacking is a MacOS privilege escalation and persistence technique. It involves abusing insecure file/folder permissions to replace legitimately installed, misconfigured LaunchDaemons with malicious code. I first spotted this issue affecting the OSQuery installer but went looking and found multiple other products with the same problem. This isn't a novel technique (it's briefly mentioned in T1543.004) but I was surprised to find it so rarely talked about. Example - Hijacking the OSQuery LaunchDaemon I've already disclosed this issue to the OSQuery team and they kindly let me use it as an example in this post. |
|
| | | | | ||
| | | | |
objective-see.com
[AI summary] A technical deep-dive analysis of OSX.DazzleSpy, a macOS cyber-espionage implant targeting pro-democracy activists in Hong Kong, which persists via LaunchAgents and offers capabilities like remote desktop and keychain dumping. |
|
| | | | | ||
| | | | |
blog.quarkslab.com
The following article explains how during a Purple Team engagement we were able to identify a vulnerability in Microsoft Teams on macOS allowing us to access a user's camera and microphone. |
|
| | | | | ||
| | | | |
www.barryodonovan.com
Turned out to be very useful during a recent RMA maintenance window: sudo launchctl load -F /System/Library/LaunchDaemons/tftp.plist sudo launchctl start com.apple.tftpd The default tftp file path ... |
|
| | | |||
