Apple Mac OS X Shellcode

This section contains Mac OS X payloads.

Payloads

Bind Shell
Bind Stager
Reverse Shell
Reverse Stager
Find Recv Stager

osx_ppc_bind

Mac OS X (PPC)

This payload listens on a TCP port and waits for a connection. Once the connection has been established it executes /bin/sh with standard I/O redirected to the client TCP connection.

osx_ppc_bind_stg

Mac OS X (PPC)

This payload listens on a TCP port and waits for a connection. Once the connection has been established it reads in a second stage payload and executes it. This is useful for scenarios where you have limited room for your payload.

osx_ppc_reverse

Mac OS X (PPC)

This payload establishes a TCP connection to a given host on a given port and redirects standard I/O from /bin/sh to the established connection.

osx_ppc_reverse_stg

Mac OS X (PPC)

This payload establishes a TCP connection to a given host on a given port. Once the connection is established a second stage payload is read in and executed. This is useful for scenarios where you have limited room for your initial payload.

osx_ppc_reverse_nf_stg

Mac OS X (PPC)

This payload establishes a TCP connection to a given host on a given port. Once the connection is established a second stage payload is read in and executed. This is useful for scenarios where you have limited room for your initial payload. This payload is null-free.

osx_ppc_findrecv_stg

Mac OS X (PPC)

This payload searches all open file descriptors for a four byte tag that is sent by the attacker over the established exploit connection. Once the connection is located the payload executes /bin/sh and redirects standard I/O to the established exploit connection. This is useful for bypassing firewall and NAT restrictions by repurposing the already established exploit connection. This payload is null-free.

osx_ppc_findrecv_peek_stg

Mac OS X (PPC)

This payload searches all open file descriptors for a four byte tag that is sent by the attacker over the established exploit connection. Once the connection is located the payload executes /bin/sh and redirects standard I/O to the established exploit connection. This is useful for bypassing firewall and NAT restrictions by repurposing the already established exploit connection. This payload is null-free and used the MSG_PEEK flag for the recv system calls.