🐙EXP-312

The certification associated with this course is the OffSec macOS Researcher (OSMR).

ack Responsibly.

Always ensure you have explicit permission to access any computer system before using any of the techniques contained in these documents. You accept full responsibility for your actions by applying any knowledge gained here.

These will be the notes I felt were worth writing down as things I was not completely familiar with and/or were new to me at the time of working through this course.

Some sections may be empty due to nothing being worth noting IMO.

Table of Contents

EXP-312 - Modules
Module 1: macOS Control Bypasses: General Course Information
Module 2: Virtual Machine Setup Guide
Module 3: Introduction to macOS
Module 4: macOS Binary Analysis Tools
Module 5: The Art of Crafting Shellcodes
Module 6: The Art of Crafting Shellcodes (Apple Silicon Edition)
Module 7: Dylib Injection
Module 8: The Mach Microkernel
Module 9: XPC Attacks
Module 10: Function Hooking on macOS
Module 11: The macOS Sandbox
Module 12: Bypassing Transparency, Consent, and Control (Privacy)
Module 13: GateKeeper Internals
Module 14: Bypassing GateKeeper
Module 15: Symlink and Hardlink Attacks
Module 16: Injecting Code into Electron Applications
Module 17: Getting Kernel Code Execution
Module 18: Mach IPC Exploitation
Module 19: macOS Penetration Testing
Module 20: Chaining Exploits on macOS Ventura
Module 21: Mount(ain) of Bugs (archived)

Documentation Templates

Templates provided via the OSMR Exam Guide

Submission Checklist:

• Your exam report is in PDF format

• You have used the following format for the PDF file name "OSMR-OS-XXXXX-Exam-Report.pdf", providing your OSID in place of "OS-XXXXX"

• You have provided any necessary code for assignments in separate files which must be in the following extensions:

  • .c

  • .asm

  • .m

  • .sh

  • .py

  • .h

  • .cpp

• You have used the following format for the file names for each assignment with the appropriate file extension:

  • "assignment1"

  • "assignment2"

  • "assignment3"

  • "assignment4"

• Your PDF and code files have been archived in a .7z file (Please do NOT archive it with a password)

• You have used the following format for the .7z file name "OSMR-OS-XXXXX-Exam-Report.7z", in which "OS-XXXXX" is your OSID

• You have made sure that your archive is not more than 200MB

• You have uploaded your .7z file to https://upload.offsec.com

21KB

OSMR-Exam-Report.docx

Open

Microsoft Word format

36KB

OSMR-Exam-Report.odt

Open

OpenOffice/LibreOffice format