Pinned Repositories
C2-JARM
A list of JARM hashes for different ssl implementations used by some C2/red team tools.
EntitlementCheck
Scripts (python3 and Swift) for macOS to recursively check /Applications and also check /usr/local/bin, /usr/bin, and /usr/sbin for binaries with problematic/interesting entitlements. Also checks for hardened runtime enablement
Inject_Dylib
Swift code to programmatically perform dylib injection
MacShellSwift
Proof of concept MacOS post exploitation tool written in Swift. Designed as a POC for blue teams to build macOS detections. Author: Cedric Owens
Mod_Rewrite_Automation
Scripts to automate standing up apache2 with mod_rewrite in front of C2 servers.
Mythic-Macro-Generator
Python3 script to generate a macro to launch a Mythic payload. Author: Cedric Owens
Persistent-Swift
A Swift port of some of the original PersistentJXA projects by D00MFist. Original PersistentJXA repo: https://github.com/D00MFist/PersistentJXA
Swift-Attack
Unit tests for blue teams to aid with building detections for some common macOS post exploitation methods.
SwiftBelt
A macOS enumeration tool inspired by harmjoy's Windows-based Seatbelt enumeration tool. Author: Cedric Owens
SwiftBelt-JXA
JXA implementation of some SwiftBelt functions. Author: Cedric Owens
cedowens's Repositories
cedowens/SwiftBelt
A macOS enumeration tool inspired by harmjoy's Windows-based Seatbelt enumeration tool. Author: Cedric Owens
cedowens/C2-JARM
A list of JARM hashes for different ssl implementations used by some C2/red team tools.
cedowens/Swift-Attack
Unit tests for blue teams to aid with building detections for some common macOS post exploitation methods.
cedowens/EntitlementCheck
Scripts (python3 and Swift) for macOS to recursively check /Applications and also check /usr/local/bin, /usr/bin, and /usr/sbin for binaries with problematic/interesting entitlements. Also checks for hardened runtime enablement
cedowens/Inject_Dylib
Swift code to programmatically perform dylib injection
cedowens/SwiftBelt-JXA
JXA implementation of some SwiftBelt functions. Author: Cedric Owens
cedowens/Spotlight-Enum-Kit
JXA and swift code that can perform some macOS situational awareness without generating TCC prompts.
cedowens/Presentations
Collection of Slides From My Conference Talks
cedowens/docker-arsenal
Spins up a docker container with several useful tools for offensive security in macOS/cloud environments. Also installs the needed dependencies for each tool/utility during docker setup.
cedowens/Dylib_Runner
Swift code to run a dylib on disk
cedowens/Helpful_aws-scripts
python3 scripts to help with aws triage needs
cedowens/Gitlab-Searcher
python3 script that pulls gitlab data of interest using a gitlab personal access token
cedowens/HELK-automation
Scripts to automate HELK server standup in Digital Ocean and filebeat on macOS to help automation of sending endpoint security logs from macOS hosts into HELK for building detections content
cedowens/ioreg-and-sysctl-examples
Examples of programmatically interacting with ioreg and sysctl to query system info
cedowens/GoBelt
Golang programmatically invoking my SwiftBelt-JXA macOS system enumerator project (Golang running SwiftBelt-JXA via cgo)
cedowens/JXA-Firefox
JXA Scripts for extracting data from Firefox
cedowens/zshrc-persist-JXA
JXA script to add a macho binary to ~/.zshrc for persistence
cedowens/LocalAdminChecker
Threaded C# code that uses wmic to quickly check a host's /24 subnet for other hosts the current user has local admin access to. Author: Cedric Owens
cedowens/okta-sprayer
Python3 Script to perform a password spray against an okta instance
cedowens/chromedp-remotedebugger-example
An example of how to use chromedp to run Chrome headless with the remote debugger port programmatically (is still a wrapper around the Chrome binary)
cedowens/dns-TXT-exfil-test
Simple client/server in golang to help with testing data exfil detections over DNS TXT records
cedowens/dns-exfil-test
cedowens/JenkinsHunter
python3 script that searches a network range for instances of unauthenticated Jenkins hosts. Author: Cedric Owens
cedowens/LOOBins
Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in macOS binaries and how they can be used by threat actors for malicious purposes.
cedowens/modified-tcc-clickjack
modified version of Ron Masas's TCC-Clickjack Swift project
cedowens/Modlishka
Modlishka. Reverse Proxy.
cedowens/DGA-test
simple code to help with DGA nxdomain response testing
cedowens/ForgeArmory
ForgeArmory provides TTPs that can be used with the TTPForge (https://github.com/facebookincubator/ttpforge).
cedowens/http-uri-test
cedowens/objc_rust
Simple example of running JXA code from rust