EXP-312: macOS Control Bypasses

EXP-312 (macOS Control Bypasses) is designed for security professionals looking to extend their knowledge of the macOS security ecosystem, focused on local privilege escalation and bypassing the operating system’s defenses. The course will dive into macOS system internals to gain a better understanding of how the operating system works, providing insights that will help us bypass or exploit it. We'll also exploit real-world vulnerabilities, both in macOS and third-party applications, and discuss the root cause of these issues, providing the skills needed to discover previously unknown vulnerabilities.

EXP-312 covers a broad range of security techniques related to macOS, including:

• Introduction to and use of a wide array of tools, including MachOView, lipo, otool, codesign, jtool2, and dtrace
• Intercepting and modifying function calls within macOS applications, enabling you to manipulate their behavior for offensive purposes
• Exploring dylib hijacking techniques to achieve process injection
• Using hook functions on macOS to subvert a function call, to inspect application behavior, help with reverse engineering, and enable easy access to data that is only present in-memory
• Bypassing Transparency, Consent, and Control (TCC), a macOS security feature that protects user privacy by requiring explicit consent for certain actions
• Completing a full penetration test of macOS using the command line and standard reverse shells

EXP-312 is organized into 15 modules, each building upon the previous to deepen your understanding of macOS exploitation. This program requires that learners have their own macOS ARM system with at least a 1TB SSD to run local virtual machines.

Students should understand the basics of macOS and be capable of carrying out fundamental administrative tasks. MacOS source code will also be reviewed, so learners must have a foundational knowledge of the C programming language, and a working knowledge of x64 assembly is essential for debugging and reverse engineering applications. No exploit development experience is required as we do not focus on memory corruption vulnerabilities.