macOS Payload

The macOS payload is a commercial agent for Intel x64 and Apple silicon ARM64 systems. It supports executable and debug executable output with the core cross-platform command set.

Plugin ID: shelldot.payload.mac

Template ID	Target
shelldot.payload.mac-x64	Intel x64 macOS system
shelldot.payload.mac-arm64	Apple silicon ARM64 macOS system

Supported types: EXECUTABLE, DEBUG_EXECUTABLE

Supported listeners

Both macOS architectures support these listener types:

• Reverse HTTP(S)
• Reverse DNS
• Reverse TCP
• Relay reverse TCP
• Relay bind TCP

Configuration

Attribute	Required	Default	Description
type	Yes	None	Payload type: EXECUTABLE or DEBUG_EXECUTABLE.
customTemplate	No	Built-in template	A filename or relative path beneath this plugin's configured template directory, or a direct http: or https: URL.
initialWait	No	0	Seconds to wait before starting the main payload code.
pluginLoadingDirectory	No	Not set	Directory used when loading command plugins. The value must be at most 266 bytes after UTF-8 encoding.
mutex	No	Not set	Prevents multiple instances with the same value from running on one system.
autoDestructDate	No	Not set	ISO-8601 timestamp after which the agent terminates.
paddingSize	No	0	Number of null bytes appended to the payload. Positive values normally add padding; zero, negative, or omitted values add none. Padding is not applied when listener data is appended rather than embedded in the template.

Example

Use this minimal configuration with either macOS template:

{
  "type": "EXECUTABLE",
  "initialWait": 0,
  "paddingSize": 0
}

Run the payload

Choose the x64 template for an Intel Mac or the ARM64 template for an Apple silicon Mac. The generated payload has no file extension.

chmod +x ./mac-agent
./mac-agent

Screen Recording permission

The screenshot command requires macOS Screen Recording permission for the application or process that runs the agent.