macOS Payload

The macOS payload is a commercial agent for Intel x64 and Apple silicon ARM64 systems. It supports executable and debug executable output with the core cross-platform command set.

Plugin ID: shelldot.payload.mac

Template ID	Target
shelldot.payload.mac-x64	Intel x64 macOS system
shelldot.payload.mac-arm64	Apple silicon ARM64 macOS system

Supported types: EXECUTABLE, DEBUG_EXECUTABLE

Supported listeners

Both macOS architectures support these listener types:

• Reverse HTTP(S)
• Reverse DNS
• Reverse TCP
• Relay reverse TCP
• Relay bind TCP

Configuration

Attribute	Description
type	Payload type: EXECUTABLE or DEBUG_EXECUTABLE
customTemplate	Custom agent template filename to use instead of the built-in template
initialWait	Seconds to wait before starting the main payload code
pluginLoadingDirectory	Directory used when loading command plugins
mutex	Prevents multiple instances with the same value from running on one system
autoDestructDate	ISO-8601 timestamp after which the agent terminates
paddingSize	Number of null bytes appended to the payload

Example

Use this minimal configuration with either macOS template:

{
  "type": "EXECUTABLE",
  "initialWait": 0,
  "paddingSize": 0
}

Run the payload

Choose the x64 template for an Intel Mac or the ARM64 template for an Apple silicon Mac. The generated payload has no file extension.

chmod +x ./mac-agent
./mac-agent

Screen Recording permission

The screenshot command requires macOS Screen Recording permission for the application or process that runs the agent.