joev <joev@metasploit.com>
Source-scoped identity with 37 associated PoCs and 32 linked vulnerabilities.
Exploit catalog results
Showing 25 PoCs on this page
MetasploitMac OS X Persistent Payload Installer
Metasploit exploitby Marcin 'Icewall' Noga <marcin@icewall.pl>Added to Metasploit 2025-09-19ExploitUnlinked1 file
Analysis
Technical assessment
A Metasploit module that installs a persistent backdoor on macOS by creating a LaunchAgent or LaunchDaemon plist and dropping a payload executable.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit persistence exploit for macOS. It installs a user-supplied payload as a LaunchAgent or LaunchDaemon. All behavior is consistent with documented persistence functionality: it writes a payload executable, creates a plist to launch it, and optionally starts it. No concealed, deceptive, or unrelated harmful actions were found.
ClassificationExploit
Model confidence95%
AuthenticationRequired
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The module is a Metasploit exploit that installs a persistent payload on a compromised macOS system. It generates and drops a backdoor executable, then creates a launchd plist to execute it at login, which constitutes exploitation for persistence.
modules/exploits/osx/persistence/launch_plist.rb:8modules/exploits/osx/persistence/launch_plist.rb:23-29modules/exploits/osx/persistence/launch_plist.rb:83-101Requirements
- Requires an existing Metasploit session on the target macOS system.
modules/exploits/osx/persistence/launch_plist.rb:43 - The target directory for the backdoor must exist and be writable.
modules/exploits/osx/persistence/launch_plist.rb:77-78
Observed behavior
- Generates a payload executable (native, Python, or command) based on the selected target architecture.
modules/exploits/osx/persistence/launch_plist.rb:86-92 - Writes the payload executable to a configurable path on the target system and makes it executable.
modules/exploits/osx/persistence/launch_plist.rb:187-197 - Creates a LaunchAgent or LaunchDaemon plist file that references the dropped payload, configured to run at load and optionally keep alive.
modules/exploits/osx/persistence/launch_plist.rb:106-138 - Optionally loads the launch item immediately using launchctl, or prints the manual command.
modules/exploits/osx/persistence/launch_plist.rb:140-144
Behaviors behind the backdoor verdict
Observables
- Persistence Mechanism
- Payload withheldThis is the advertised purpose of the module. The plist specifies the payload path and optional KeepAlive.
modules/exploits/osx/persistence/launch_plist.rb:110-131 - Payload Deployment
- Payload withheldThe module generates or uses a provided payload and drops it on the target system.
modules/exploits/osx/persistence/launch_plist.rb:86-95modules/exploits/osx/persistence/launch_plist.rb:187-197 - Cleanup Registration
- Payload withheldStandard Metasploit resource script cleanup; no hidden persistence beyond the module's scope.
modules/exploits/osx/persistence/launch_plist.rb:98-100
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The evidence does not include any runtime behavior or verification that the module functions as described.
- Review is limited to the module source file; framework mixins (e.g., Msf::Post::File, Msf::Exploit::EXE) and the actual payload content are not expanded or inspected.
- Binary files are flagged as metadata-only and were not analyzed.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.