Mac OS X Persistent Payload Installer
PoC files
1 fileFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
A Metasploit module that installs a persistent backdoor on macOS by creating a LaunchAgent or LaunchDaemon plist and dropping a payload executable.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit persistence exploit for macOS. It installs a user-supplied payload as a LaunchAgent or LaunchDaemon. All behavior is consistent with documented persistence functionality: it writes a payload executable, creates a plist to launch it, and optionally starts it. No concealed, deceptive, or unrelated harmful actions were found.
Classification basis and observed behavior
Classification basis
The module is a Metasploit exploit that installs a persistent payload on a compromised macOS system. It generates and drops a backdoor executable, then creates a launchd plist to execute it at login, which constitutes exploitation for persistence.
modules/exploits/osx/persistence/launch_plist.rb:8modules/exploits/osx/persistence/launch_plist.rb:23-29modules/exploits/osx/persistence/launch_plist.rb:83-101Requirements
- Requires an existing Metasploit session on the target macOS system.
modules/exploits/osx/persistence/launch_plist.rb:43 - The target directory for the backdoor must exist and be writable.
modules/exploits/osx/persistence/launch_plist.rb:77-78
Observed behavior
- Generates a payload executable (native, Python, or command) based on the selected target architecture.
modules/exploits/osx/persistence/launch_plist.rb:86-92 - Writes the payload executable to a configurable path on the target system and makes it executable.
modules/exploits/osx/persistence/launch_plist.rb:187-197 - Creates a LaunchAgent or LaunchDaemon plist file that references the dropped payload, configured to run at load and optionally keep alive.
modules/exploits/osx/persistence/launch_plist.rb:106-138 - Optionally loads the launch item immediately using launchctl, or prints the manual command.
modules/exploits/osx/persistence/launch_plist.rb:140-144
Behaviors behind the backdoor verdict
Observables
- Persistence Mechanism
- Creates a LaunchAgent or LaunchDaemon plist to execute a payload at login or boot.This is the advertised purpose of the module. The plist specifies the payload path and optional KeepAlive.
modules/exploits/osx/persistence/launch_plist.rb:110-131 - Payload Deployment
- Writes a payload executable to a configurable path and makes it executable.The module generates or uses a provided payload and drops it on the target system.
modules/exploits/osx/persistence/launch_plist.rb:86-95modules/exploits/osx/persistence/launch_plist.rb:187-197 - Cleanup Registration
- Registers cleanup commands to remove the plist and stop/remove the launchd job.Standard Metasploit resource script cleanup; no hidden persistence beyond the module's scope.
modules/exploits/osx/persistence/launch_plist.rb:98-100
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The evidence does not include any runtime behavior or verification that the module functions as described.
- Review is limited to the module source file; framework mixins (e.g., Msf::Post::File, Msf::Exploit::EXE) and the actual payload content are not expanded or inspected.
- Binary files are flagged as metadata-only and were not analyzed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Linked vulnerabilities
0This PoC is retained in the catalog but is not currently linked to a vulnerability.