PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Daemon Ex Plist: LPE via MacOS Daemons

swarm.ptsecurity.com | research | #macos | #local-privilege-escalation | #launchd | #plist | #daemons
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A deep dive into macOS launchd Agents and Daemons: plist loading mechanisms, directory trust levels, and a defect the author used to demonstrate a local privilege escalation (LPE) vulnerability.
Published
Collected

Related coverage

research · swarm.ptsecurity.com
The Guest Who Could: Exploiting LPE in VMWare Tools
PT SWARM details LPE flaws in VMware Tools' Windows VGAuth service (12.5.0) — a SYSTEM-level component for alias store, ticket and SAML auth on guest VMs, an overlooked guest-only attack surface.
research · blog.quarkslab.com
Exploiting Microsoft Teams on macOS during a Purple Team engagement
During a Purple Team engagement Quarkslab identified a flaw in Microsoft Teams for macOS allowing an attacker to capture the victim's camera and microphone streams; a PoC led to a fix from MSRC.
research · blog.quarkslab.com
LLDBagility: practical macOS kernel debugging
Presents LLDBagility, which attaches LLDB to a VirtualBox macOS VM via the Fast Debugging Protocol for kernel breakpoints, watchpoints and pause — no debug kernel or SIP changes needed.
research · blog.quarkslab.com
An overview of macOS kernel debugging
First of two posts on macOS kernel debugging: kernel debugger fundamentals, how debugging is implemented for XNU, and the limitations of current tooling (debug kernel builds, no watchpoints).
research · calif.io
cat readme.txt" is not safe in iTerm2
# "cat readme.txt" is not safe in iTerm2 Codex found a bug turning "cat readme.txt" into arbitrary code execution. Hung Nguyen April 17, 2026 Covered by Hacker News madbugs Contents 1. Background:...
research · hunt.io
Fake Homebrew Pages Deliver Cuckoo Stealer via ClickFix | macOS Threat Hunting Analysis
Homebrew typosquats delivered Cuckoo Stealer via ClickFix: a first stage stole credentials via dscl authonly prompts, then a macOS infostealer/RAT hitting 20+ wallets and persisting via LaunchAgent.
Back