490398290

How to Defang macOS System Protections

If you want to change things on the root drive of a Mac you will need to take some steps to disable the built in security of the system. Most of these steps are the same regardless if you are on Intel or Apple Silicon. If there is a difference it is noted.

Note that all of these things put a Mac into an unsupported and less secure state.

Make sure you either perform these steps in a VM or that you reset the protections after you are done poking around

Protections and Terms

(This list is not exahustive on the details of each. Check the links at the end for more info.)

AI Tool Master List

Audio Editing

News

EOL (2024-07-21)

I'm not going to be maintaining this document anymore. I'm leaving it as-is since much of the FAQ section is still accurate and has yet to be incorporated into other resources.

Use CanI.RootMy.TV to find an exploit for your TV.

New exploit for webOS 3.5+: DejaVuln (2024-04-21)

Boot

Boot in recovery

sudo nvram "recovery-boot-mode=unused" && sudo reboot recovery

Boot in Internet Recovery

Shift +Option + Cmd + R equivalent:

sudo nvram internet-recovery-mode=RecoveryModeNetwork

Update WSL (to use "store version" features) without the Microsoft Store:

Download the latest WSL app package release: https://github.com/microsoft/WSL/releases
wsl --shutdown
Add-AppxPackage Microsoft.WSL_1.2.5.0_x64_ARM64.msixbundle

Optionally, reboot before and/or after installing the package if features aren't working properly (not required for --mount, maybe required for WSLg)

Attach bare vhdx disk (useful for formatting to ext4)

	#!/bin/sh
	set -eu
	GOPATH=${GOPATH:-~/go}
	export PATH="${PATH}:${GOPATH}/bin"

	go install tailscale.com/cmd/tailscale{,d}@main
	sudo tailscaled install-system-daemon
	sudo tailscale up

	#!/bin/zsh
	# Credit: Original idea and script disable.sh by pwnsdx https://gist.github.com/pwnsdx/d87b034c4c0210b988040ad2f85a68d3

	# Disabling unwanted services on macOS Big Sur (11), macOS Monterey (12) and macOS Ventura (13)
	# Disabling SIP is required ("csrutil disable" from Terminal in Recovery)
	# Modifications are written in /private/var/db/com.apple.xpc.launchd/ disabled.plist, disabled.501.plist
	# To revert, delete /private/var/db/com.apple.xpc.launchd/ disabled.plist and disabled.501.plist and reboot; sudo rm -r /private/var/db/com.apple.xpc.launchd/*


	# user

	#!/usr/bin/env python
	# -- coding: utf-8 --
	#
	# System: macOS 12+
	# Version: TeamViewer v15.x.x
	# Python: 3.x.x
	# Command: sudo python TeamViewer-15-id-changer.py
	#

	import os

	#!/usr/bin/env python
	# -- coding: utf-8 --
	#
	# System: macOS 12+
	# Version: TeamViewer v15.x.x
	# Python: 3.x.x
	# Command: sudo python3 TeamViewer-15-id-changer.py
	#

	import os

	#!/usr/bin/env bb
	; =========================================================================== ;
	; FILE: hack-captive-portal.bb ;
	; USAGE: sudo bb hack-captive-portal.bb ;
	; ;
	; DESCRIPTION: This script helps to pass through the captive portals in ;
	; public Wi-Fi networks. It hijacks IP and MAC from somebody ;
	; who is already connected and authorized on captive portal. ;
	; Tested in Ubuntu 16.04 with different captive portals in ;
	; airports and hotels all over the world. ;