Cedric Owens

SwiftBelt. A macOS enumeration tool inspired by harmjoy's Windows-based Seatbelt enumeration tool. Author: Cedric Owens

C2-JARM. A list of JARM hashes for different ssl implementations used by some C2/red team tools.

MacShellSwift. Proof of concept MacOS post exploitation tool written in Swift. Designed as a POC for blue teams to build macOS detections. Author: Cedric Owens

Swift-Attack. Unit tests for blue teams to aid with building detections for some common macOS post exploitation methods.

EntitlementCheck. Scripts (python3 and Swift) for macOS to recursively check /Applications and also check /usr/local/bin, /usr/bin, and /usr/sbin for binaries with problematic/interesting entitlements. Also checks for hardened runtime enablement

Inject_Dylib. Swift code to programmatically perform dylib injection

Mythic-Macro-Generator. Python3 script to generate a macro to launch a Mythic payload. Author: Cedric Owens

Mod_Rewrite_Automation. Scripts to automate standing up apache2 with mod_rewrite in front of C2 servers.

SwiftBelt-JXA. JXA implementation of some SwiftBelt functions. Author: Cedric Owens

Spotlight-Enum-Kit. JXA and swift code that can perform some macOS situational awareness without generating TCC prompts.

Persistent-Swift. A Swift port of some of the original PersistentJXA projects by D00MFist. Original PersistentJXA repo: https://github.com/D00MFist/PersistentJXA

EvilOSX_MacroGenerator. Python3 script to generate Office macros for the EvilOSX framework. Author: Cedric Owens

JXA-Runner. Swift code to programmatically execute local or hosted JXA payloads from Terminal without using the on-disk osascript binary.

Presentations. Collection of Slides From My Conference Talks

C2_Cradle. Tool to download, install, and run macOS capable command & control servers (i.e., C2s with macOS payloads/clients) as docker containers from a list of options. This is helpful for automating C2 server setup.

aws-cli-notes. A combined list of helpful awscli commands from Scott Piper's flaws.cloud exercise as well as from Beau Bullock's Breaching the Cloud Training

Terraform_DigitalOcean_Scripts. Scripts to automate standing up C2 infra with firewall settings inside of DigitalOcean.

docker-arsenal. Spins up a docker container with several useful tools for offensive security in macOS/cloud environments. Also installs the needed dependencies for each tool/utility during docker setup.

JXA-RemoveQuarantine. JXA script based on research by Jeff Johnson on leveraging TextEdit to remove quarantine attributes on files. Jeff's original research is here: https://lapcatsoftware.com/articles/sandbox-escape.html

keygrabber. Automation for grabbing keys from a Linux host. Useful during red team exercises to quickly help assess what access to a Linux host can lead to.

Dylib_Runner. Swift code to run a dylib on disk

macOS-browserhist-parser. Swift code to parse the quarantine history database, Chrome history database, Safari history database, and Firefox history database on macOS.

Linode_Terraform_Scripts. Scripts to automate standing up hosts in Linode

SimpleC2_Server. POC for a basic C2 server using the python aiohttp framework

Helpful_aws-scripts. python3 scripts to help with aws triage needs

Gitlab-Searcher. python3 script that pulls gitlab data of interest using a gitlab personal access token

HELK-automation. Scripts to automate HELK server standup in Digital Ocean and filebeat on macOS to help automation of sending endpoint security logs from macOS hosts into HELK for building detections content

Add-To-TCC-DB. A JXA script that leverages sqlite3 API calls to add items to the user's TCC database at: ~/Library/Application Support/com.apple.TCC/TCC.db

ioreg-and-sysctl-examples. Examples of programmatically interacting with ioreg and sysctl to query system info

Rolling_Op_Metrics. Skeleton spreadsheet to track rolling red team operation metrics.

GoBelt. Golang programmatically invoking my SwiftBelt-JXA macOS system enumerator project (Golang running SwiftBelt-JXA via cgo)

zshrc-persist-JXA. JXA script to add a macho binary to ~/.zshrc for persistence

okta-sprayer. Python3 Script to perform a password spray against an okta instance

Jenkins_Hunter_CSharp. C# implementation of my original Jenkins Hunter script (orig in python). It uses threading to search for unauthenticated Jenkins instances on ports 8080, 80, and 443. Author: Cedric Owens

JXA-Firefox. JXA Scripts for extracting data from Firefox

PICT-Swift. A Swift (and slightly modified) version of Thomas Reed's PICT (Post Infection Collection Toolkit)

LocalAdminChecker. Threaded C# code that uses wmic to quickly check a host's /24 subnet for other hosts the current user has local admin access to. Author: Cedric Owens

SSH-Password-Sprayer. python3 script to spray a username and password against a network range. Author: Cedric Owens

gitleaks-wrapper. Simple wrapper around gitleaks to enumerate publicly facing repos belonging to an org and then run gitleaks against each in search of exposed secrets/keys.

kube-unauth-exec-hunter. Python3 script to check a subnet range for kubernetes nodes allowing system:anonymous API command access. Author: Cedric Owens

Metadata_URLs. List of some cloud metadata URLs that return interesting info

PhishDifficultyScorer. python3 script that rates the difficulty of a given phishing exercise. Author: Cedric Owens

chromedp-remotedebugger-example. An example of how to use chromedp to run Chrome headless with the remote debugger port programmatically (is still a wrapper around the Chrome binary)

dns-TXT-exfil-test. Simple client/server in golang to help with testing data exfil detections over DNS TXT records

find_chrome_tab. For those of us with too many Chrome tabs open on macOS :flushed:...this is a simple applescript to search all tab titles and urls across all Chrome browser windows for a match string and if found it sets that as the active tab. :sunglasses:

JAMF_Runner. A wrapper around the on disk jamf binary (for JAMF managed macOS hosts). Useful for unit testing detections of offensive jamf host-based commands.

JenkinsHunter. python3 script that searches a network range for instances of unauthenticated Jenkins hosts. Author: Cedric Owens

Mystikal. macOS Initial Access Payload Generator

modified-tcc-clickjack. modified version of Ron Masas's TCC-Clickjack Swift project

Page-Finder. python3 script that searches a network range for hosts hosting interesting pages that an attacker can leverage. Author: Cedric Owens

Modlishka. Modlishka. Reverse Proxy.

ForgeArmory. ForgeArmory provides TTPs that can be used with the TTPForge (https://github.com/facebookincubator/ttpforge).

gophish. Open-Source Phishing Toolkit. I made a few slight changes to help with campaigns

purple-team-exercise-framework. Purple Team Exercise Framework