4 macOS payload packaging tools for red teams

Learn about four different packaging tools to convert red team payloads into macOS applications.

Imagine that you have developed a highly sophisticated payload for your next red team engagement which primarily targets macOS machines. The payload is in the form of a Shell script (or a Python script or a JavaScript script). How will you get the user to execute your payload?

Option 1

Get the user to download the script, make it executable and then finally get them to execute it via the terminal. What if its a Python script? You will have to teach the user how to execute Python script. Even though it might seem as a trivial thing to do but look at it from the end user’s perspective. They are accustomed to double-click and execute rather than going through all these steps.

Option 2

What if you can package the script as a macOS application? Then all a user will need to do would be to download the application and double-click to execute it. That’s it. Its a more convenient option and a less suspicious one at that.

Below, I have listed four tools that can help you, the red team operator, to package your malicious scripts as macOS applications:

1. Appify - Appify is a command-line utility designed to convert shell scripts into standalone macOS applications. It primarily supports shell scripts but can be adapted for other scripting languages. By wrapping a script in an application bundle, Appify allows scripts to be executed as native macOS apps, providing a convenient way to distribute and run scripts without requiring users to access the command line. It is a tad old and might need some tinkering to get it working on recent macOS versions.

2. Platypus - Platypus is a developer tool that creates native macOS applications from various scripting languages, including shell scripts, Python, Perl, PHP etc. It works by wrapping the script in an application bundle along with a slim app binary that runs the script. This makes it easy to share scripts with users who are unfamiliar with the command line.

3. PyInstaller - PyInstaller is a popular tool for converting Python scripts into standalone executables, supporting platforms like Windows, Linux, and macOS. It analyzes Python programs to discover every piece of code needed to run them and then packages the code into a single executable file. This allows Python applications to be distributed without requiring users to have Python installed.

4. Electron - Electron is a framework that enables developers to build cross-platform desktop applications using web technologies like JavaScript, HTML, and CSS. It works by combining a Chromium-based rendering engine with the Node.js runtime, allowing for the creation of rich desktop applications. Developers can package their applications using tools like Electron Forge or electron-builder, which bundle the source code and necessary resources into a distributable format.

Red Team Notes
- Red team operators can use following tools to package their payloads as macOS applications:
  - Appify - Converts shell scripts into macOS apps by wrapping them in an application bundle.
  - Platypus - Packages scripts (Python, Perl, Ruby, etc.) into macOS apps with a lightweight binary. 
  - PyInstaller - Converts Python scripts into standalone executables for macOS, Windows, and Linux.
  - Electron - Builds cross-platform desktop apps using JavaScript, HTML, and CSS. 
- Packaging payloads as applications facilitates easier distribution and raises less suspicion (only in case of macOS).  

Follow my journey of 100 Days of Red Team on WhatsApp, Telegram or Discord.