MacLOLBins: macOS LOLBins with Entitlements, XPC and an MCP Server

Disclaimer. This post is for educational purposes and authorized security testing only. The scans shown here ran against a macOS VM I own. Only run the tooling on systems you own or have explicit permission to assess.

Table of Contents

1. What Are LOLBins?
2. Why Should You Care?
3. Prior Art
4. What MacLOLBins Adds
5. Handing It to an Agent
6. Closing Notes
7. References

What Are LOLBins?

TL;DR Living-off-the-land binaries are tools the operating system already ships that an attacker can use for their own ends. The idea is old and well catalogued for Unix-like systems, Windows and macOS. MacLOLBins scans a real Mac or macOS VM, lists every Apple binary on its PATH, and ranks them by evidence taken from the binaries themselves. That evidence is the capabilities shown by API symbols in each binary, plus what matters on Apple platforms, such as entitlements, TCC access, SIP, code signing and the launchd services that run the binary. It also ships an MCP server and a Claude Code skill so an agent can run the scan and answer questions from it.

A LOLBin (living-off-the-land binary) is a program that comes with the operating system, is signed by the vendor, and has a legitimate job, but can also be used to run code, download files, capture credentials, persist, or hide activity. On macOS that means tools such as osascript, curl, sqlite3, launchctl or screencapture. Abusing them does not need a vulnerability, because the abuse uses features the binaries were built with. That does not make them bug-free. A setuid or entitled binary with a real bug is a separate research topic, and a good one.

Using what is already on the box has three advantages for an attacker. There is nothing to drop, so there is no new file for an antivirus scan to catch. The binary is signed by Apple, so allowlists and reputation checks trust it. And its activity looks like an administrator or a developer doing their job.

Why Should You Care?

The same list of binaries is useful to four different groups.

Red teamers want to operate with as little custom tooling as possible. Knowing which built-in binaries exist on a target, what they can do, and what privilege they need decides whether you have to bring anything at all.

Malware authors already rely on them. Patrick Wardle’s The Mac Malware of 2025 describes the Paradox stealer using osascript to show a fake “System Preferences” dialog that captures the user’s password, which it needs to unlock the keychain.

That makes the list useful to defenders too. If you know which binaries attackers reach for and what normal use looks like, you know which process launches and arguments to alert on. In the Paradox case, that is osascript running display dialog ... with hidden answer.

Security researchers hunting for bugs want the list for a different reason. A setuid binary, a binary with private or TCC entitlements, and a daemon that registers Mach services often hold privileges their callers lack, so a bug in one of them can give the caller those privileges. Knowing which binaries on a Mac hold them tells you where to look first.

Prior Art

None of this is new, and MacLOLBins builds on projects that did the cataloguing first:

• GTFOBins collects Unix-like executables that can be used to bypass local security restrictions in misconfigured systems.
• LOLBAS does the same for Windows binaries, scripts and libraries, mapped to MITRE ATT&CK.
• LOOBins (Living Off the Orchard) covers macOS built-in binaries, maps them to ATT&CK, and includes detection guidance.

What MacLOLBins Adds

The projects above document what a binary can do. MacLOLBins lists every Apple binary on a specific Mac and works out from each binary what it can do there. It pipes a read-only probe script into bash on the target and writes a single-page HTML report.

The scope is the target’s default PATH, read from /etc/paths and /etc/paths.d. A LOLBin is something you run by name, so app bundles, frameworks and helpers in /usr/libexec are out.

For each executable on that PATH, the probe looks for the symbol names and library paths that 27 capability rules ask about. Finding _curl_easy_perform or a libcurl path is evidence that the binary can make HTTP requests, and finding _CGDisplayCreateImage is evidence that it can capture the screen. Most matches are imports and linked libraries.

The same pass collects privilege signals: setuid and setgid bits, private and TCC entitlements, TCC grants recorded on the Mac, entitlements that weaken the hardened runtime, and launchd Mach services. Each capability scores one point and each signal two, and the report ranks binaries by the total.

For each binary, the report shows:

• its capabilities, with the symbols or library paths that show each one, and the ATT&CK techniques they map to
• abuse notes and worked commands from the catalog, for the binaries that have them
• file permissions, setuid/setgid and SIP protection
• the code signature and hardened runtime state
• every entitlement, linked to Apple’s documentation when Apple documents the key
• TCC access, both by entitlement and by grants recorded in the TCC databases
• the launchd services that run it, with the Mach services they register

The entitlements and XPC parts are the macOS-specific additions. An entitlement can let a binary reach data that TCC would otherwise prompt for. A binary that launchd runs as a daemon with registered Mach services is also an IPC endpoint that other processes can try to connect to. I covered both in more depth in the XPC post.

A scan of a macOS 26.6.2 (25G83) VM inventoried 1,279 executables on its PATH and reported 1,181 Apple binaries. 442 of them show at least one capability or privilege signal, and the other 739 are listed with a score of 0. The report includes 67 of the 76 binaries LOOBins documents. The other nine are a shell built-in, an app, four helpers outside the PATH such as socketfilterfw, and three developer tools that are not installed on the VM.

The overview for the scanned VM: the PATH it read, 1,181 Apple binaries with 442 carrying evidence, a folder per capability, and the binaries with the strongest evidence.

Take screencapture as an example. It scores 8, from four capabilities and two privilege signals. It imports _CGDisplayCreateImage and ScreenCaptureKit classes for screen capture, plus pasteboard, preference-writing and Launch Services APIs. It also holds private and TCC entitlements, one of which is com.apple.private.tcc.allow for kTCCServicePostEvent, so it can post input events without a TCC prompt. Catalog notes add abuse text and worked commands for 111 of the reported binaries, screencapture included, but they never decide what is in the report or how it ranks.

The report for screencapture: each capability with the symbols that show it, its TCC entitlements, the catalog note and worked command, and an evidence score of 8.

Launchd registers Mach services for 33 of the reported binaries, which makes them XPC server candidates. The evidence comes from launchd plists and strings in the binary. The scan never looks up a Mach service or opens a connection, so it does not tell you whether a caller can reach the service at all, or which operations it can reach if it can.

Handing It to an Agent

The report is there for reading, but the point now is to have your agent do this work. MacLOLBins runs three ways:

uv run maclolbins scan --vm macOS                 # scan a Parallels VM into reports/
uv run maclolbins render reports/SCAN/scan.json   # rebuild a report from a saved scan
uv run maclolbins mcp --reports reports           # serve scans to agents over MCP

The MCP server exposes nine tools. discover_targets lists this Mac, Parallels, Tart, VMware Fusion and UTM VMs, and SSH hosts, with a suggested scan command where one exists. scan_target takes any argv that starts bash on the target, so the same probe runs locally, in a VM or over SSH. VMware Fusion and UTM guests go through get_probe_script and import_probe_output instead. list_lolbins and get_lolbin answer questions from the same data the report renders, so the answers and the report agree. list_lolbins returns binaries with the strongest evidence first and can filter by capability, and explain_entitlement explains any entitlement key without a scan.

The repo also ships a Claude Code skill that teaches the agent which tool to use when, to reuse a recent scan instead of re-running it, to quote the evidence behind each capability it mentions, and to answer with ATT&CK and Apple documentation links. A question like “which of these can reach TCC-protected data?” becomes a filtered list_lolbins call against the scan, so the model answers from data instead of memory.

Closing Notes

MacLOLBins is a starting point. The idea comes from GTFOBins, LOLBAS and LOOBins, and the parts I added are the Apple-specific context, the evidence taken from the binaries themselves, and the agent interface. Some directions worth taking it:

• add capability rules for the APIs you care about; a rule is a list of symbols or libraries. Re-rendering applies a new library rule to scans you already have, but a rule that names new symbols needs a fresh scan, because the probe only records the symbols the catalog asks for
• check each match with disarm, whose -S output marks imported symbols U and whose -L output lists the libraries a binary loads, so only real imports and load commands count as evidence
• work out which capabilities a caller can drive from the command line, which the scan does not tell you
• take the XPC candidates and test what a caller can reach, which is what the XPC post started doing for packaged .xpc services
• turn the worked commands into detections and test them against your EDR

The code is on GitHub. If you extend it, I would like to hear what you find.

The capability rules, notes and worked commands were generated with Claude Opus 5.5. I reviewed them, but I may not have caught every error. If you find one, tell me or open an issue.

References

• MacLOLBins. The scanner, report, MCP server and Claude Code skill.
• GTFOBins. Unix-like executables that bypass local security restrictions.
• LOLBAS. Living Off The Land Binaries, Scripts and Libraries for Windows.
• LOOBins. Living Off the Orchard: macOS Binaries.
• The Mac Malware of 2025. Patrick Wardle’s review of the year’s new macOS malware, including the Paradox stealer’s osascript password prompt.
• Apple entitlements documentation. The source for the report’s entitlement links.