macos-security-bypasslisted

# SKILL: macOS Security Bypass — Expert Attack Playbook > **Scope**: Expert macOS security bypass techniques. Covers TCC bypass, Gatekeeper evasion, SIP restrictions, sandbox escape, and entitlement abuse. Pays particular attention to version-specific bypass nuances and protection interaction effects. ## Related Skills Before going deep, see also: - `macos-process-injection` when you need dylib injection, XPC exploitation, or Electron abuse after achieving initial access - `linux-privilege-escalation` for Unix-layer privesc techniques that also apply to macOS (SUID, cron, writable paths) - `linux-security-bypass` for shared Unix security bypass concepts ### Advanced Reference Also load [TCC_BYPASS_MATRIX.md](./TCC_BYPASS_MATRIX.md) when you need: - Per-macOS-version TCC bypass mapping - Protection-type-specific techniques (Camera, Microphone, FDA, Automation) - MDM/configuration profile abuse patterns --- ## 1. TCC (TRANSPARENCY, CONSENT, CONTROL) OVERVIEW TCC is macOS's permission framework controlling access to sensitive resources (camera, microphone, contacts, full disk access, etc.). ### 1.1 TCC Database Locations | Database | Path | Controls | Protection | |---|---|---|---| | User-level | `~/Library/Application Support/com.apple.TCC/TCC.db` | Per-user consent decisions | SIP-protected since Catalina | | System-level | `/Library/Application Support/com.apple.TCC/TCC.db` | System-wide consent decisions | SIP-protected | | MDM-managed | Via configuration profiles