MacPEAS

curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh -s -- -o M

The macOS variant of LinPEAS: enumerates the host for privilege escalation vectors and macOS-specific sensitive data — TCC database, keychains, LaunchAgents/LaunchDaemons, SUID binaries, credentials in plists, disk image permissions, and more.

When you have a shell on macOS (non-admin user) and want the full inventory of vectors: sudo rules, SUID, writable LaunchAgents, plists with credentials, accessible TCC.db, weakly protected keychains. The -o M flag enables macOS-specific checks that are not executed on Linux.

On macOS with SIP enabled and EDR (Jamf/Kandji), a full scan generates significant telemetry and some checks require Full Disk Access: if the session lacks approved TCC, parts of the output will be empty. Avoid it if stealth is the goal and use selective manual enumeration instead.