Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

username updates and cleanup #17

Merged
merged 10 commits into from
Apr 12, 2022
Merged

username updates and cleanup #17

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
d1f4212
username updates and cleanup
stuartjash Apr 1, 2022
a2c9c23
removed commented out code
stuartjash Apr 1, 2022
26787ca
added cron jobs
stuartjash Apr 6, 2022
b68a43e
added overrides and fixed crontabs
stuartjash Apr 6, 2022
7b86f47
fixed usernames and handled errors
stuartjash Apr 11, 2022
30c6947
updated basic users function
stuartjash Apr 11, 2022
ede03e2
update per comments
stuartjash Apr 11, 2022
b7a6ba5
removed unused import
stuartjash Apr 11, 2022
4aac700
update sql
stuartjash Apr 12, 2022
e4a5ed2
fixec if
stuartjash Apr 12, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions aftermath.xcodeproj/project.pbxproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,9 @@
A076742C27555FC100ED7066 /* PersistenceModule.swift in Sources */ = {isa = PBXBuildFile; fileRef = A076742B27555FC100ED7066 /* PersistenceModule.swift */; };
A076742F2755798F00ED7066 /* ArtifactsModule.swift in Sources */ = {isa = PBXBuildFile; fileRef = A076742E2755798F00ED7066 /* ArtifactsModule.swift */; };
A0879957275AD2DC00E885BC /* SystemConfig.swift in Sources */ = {isa = PBXBuildFile; fileRef = A0879956275AD2DC00E885BC /* SystemConfig.swift */; };
A0D6D54327F76C58002BB3C8 /* Cron.swift in Sources */ = {isa = PBXBuildFile; fileRef = A0D6D54227F76C58002BB3C8 /* Cron.swift */; };
A0D6D54727FE147D002BB3C8 /* Overrides.swift in Sources */ = {isa = PBXBuildFile; fileRef = A0D6D54627FE147D002BB3C8 /* Overrides.swift */; };
A0D6D54927FE52C1002BB3C8 /* SystemExtensions.swift in Sources */ = {isa = PBXBuildFile; fileRef = A0D6D54827FE52C1002BB3C8 /* SystemExtensions.swift */; };
A0E1E3E4275EC3D2008D0DC6 /* Swap.swift in Sources */ = {isa = PBXBuildFile; fileRef = A0E1E3E3275EC3D2008D0DC6 /* Swap.swift */; };
A0E1E3E6275EC433008D0DC6 /* MemoryModule.swift in Sources */ = {isa = PBXBuildFile; fileRef = A0E1E3E5275EC433008D0DC6 /* MemoryModule.swift */; };
A0E1E3E9275EC736008D0DC6 /* BrowserModule.swift in Sources */ = {isa = PBXBuildFile; fileRef = A0E1E3E8275EC736008D0DC6 /* BrowserModule.swift */; };
Expand Down Expand Up @@ -57,6 +60,9 @@
A076742B27555FC100ED7066 /* PersistenceModule.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = PersistenceModule.swift; sourceTree = "<group>"; };
A076742E2755798F00ED7066 /* ArtifactsModule.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ArtifactsModule.swift; sourceTree = "<group>"; };
A0879956275AD2DC00E885BC /* SystemConfig.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = SystemConfig.swift; sourceTree = "<group>"; };
A0D6D54227F76C58002BB3C8 /* Cron.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Cron.swift; sourceTree = "<group>"; };
A0D6D54627FE147D002BB3C8 /* Overrides.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Overrides.swift; sourceTree = "<group>"; };
A0D6D54827FE52C1002BB3C8 /* SystemExtensions.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SystemExtensions.swift; sourceTree = "<group>"; };
A0E1E3E3275EC3D2008D0DC6 /* Swap.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Swap.swift; sourceTree = "<group>"; };
A0E1E3E5275EC433008D0DC6 /* MemoryModule.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = MemoryModule.swift; sourceTree = "<group>"; };
A0E1E3E8275EC736008D0DC6 /* BrowserModule.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BrowserModule.swift; sourceTree = "<group>"; };
Expand Down Expand Up @@ -123,6 +129,9 @@
A076742B27555FC100ED7066 /* PersistenceModule.swift */,
A3745357275730870074B65C /* LaunchItems.swift */,
A3745359275735B40074B65C /* LoginHooks.swift */,
A0D6D54227F76C58002BB3C8 /* Cron.swift */,
A0D6D54627FE147D002BB3C8 /* Overrides.swift */,
A0D6D54827FE52C1002BB3C8 /* SystemExtensions.swift */,
);
path = persistence;
sourceTree = "<group>";
Expand Down Expand Up @@ -294,7 +303,10 @@
A0759135275985170006766F /* TCC.swift in Sources */,
A0E1E3F6275ED2E4008D0DC6 /* NetworkModule.swift in Sources */,
A076742C27555FC100ED7066 /* PersistenceModule.swift in Sources */,
A0D6D54727FE147D002BB3C8 /* Overrides.swift in Sources */,
A0E1E3E4275EC3D2008D0DC6 /* Swap.swift in Sources */,
A0D6D54927FE52C1002BB3C8 /* SystemExtensions.swift in Sources */,
A0D6D54327F76C58002BB3C8 /* Cron.swift in Sources */,
);
runOnlyForDeploymentPostprocessing = 0;
};
Expand Down
38 changes: 35 additions & 3 deletions aftermath/Module.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
//

import Foundation
import CoreData
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can be removed?


struct User {
let username: String
Expand Down Expand Up @@ -45,13 +46,39 @@ class AftermathModule {
if !filename.hasPrefix("_") {
let username = file.deletingPathExtension().lastPathComponent
if let homedir = NSHomeDirectoryForUser(username) {
let user = User(username:username, homedir: homedir)
users.append(user)
let user = User(username:username, homedir: homedir)
users.append(user)
}
}
}
}
}
return users
}

func getBasicUsersOnSystem() -> [User] {
jbradley89 marked this conversation as resolved.
Show resolved Hide resolved
var users = [User]()

// Check Permissions
if (activeUser != "root") {
self.log("Aftermath being run in non-root mode...")
if let homedir = NSHomeDirectoryForUser(activeUser) {
let user = User(username:activeUser, homedir: homedir)
users.append(user)
}
} else {
let userPlists = filemanager.filesInDir(path: "/var/db/dslocal/nodes/Default/users/")
for file in userPlists {
let filename = file.lastPathComponent
if !filename.hasPrefix("_") {
let username = file.deletingPathExtension().lastPathComponent
if let homedir = NSHomeDirectoryForUser(username) {
let user = User(username:username, homedir: homedir)
if SystemUsers.allCases.contains(where: {$0.rawValue == user.username}) { continue }
users.append(user)
}
}
}
}
return users
}

Expand Down Expand Up @@ -153,4 +180,9 @@ class AftermathModule {
addTextToFile(atUrl: CaseFiles.logFile, text: entry)
}
}

enum SystemUsers: String, CaseIterable {
case nobody = "nobody"
case daemon = "daemon"
}
}
21 changes: 13 additions & 8 deletions artifacts/ShellHistoryAndProfiles.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,24 +26,29 @@ class BashProfiles: ArtifactsModule {
let globalFiles = ["/etc/profile", "/etc/zshenv", "/etc/zprofile", "/etc/zshrc", "/etc/zlogin", "/etc/zlogout"]

// for each user, copy the shell historys and profiles
if let users = self.users {
for user in users {
for filename in userFiles {
let path = URL(fileURLWithPath: "\(user.homedir)/\(filename)")
for user in getUsersOnSystem() {
for filename in userFiles {
let path = URL(fileURLWithPath: "\(user.homedir)/\(filename)")
if (filemanager.fileExists(atPath: path.path)) {
let newFileName = "\(user.username)_\(filename)"
self.copyFileToCase(fileToCopy: path, toLocation: self.profilesDir, newFileName: newFileName)
}
} else { continue }
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are these continue's performing any additional function that I don't know about?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

they break that current iteration of the for loop


}
}


// Copy all the global files
for file in globalFiles {
let fileUrl = URL(fileURLWithPath: file)
let filename = fileUrl.lastPathComponent
let newFileName = "etc_\(filename)"
self.copyFileToCase(fileToCopy: fileUrl, toLocation: self.profilesDir, newFileName: newFileName)
if (filemanager.fileExists(atPath: fileUrl.path)) {
let filename = fileUrl.lastPathComponent
let newFileName = "etc_\(filename)"
self.copyFileToCase(fileToCopy: fileUrl, toLocation: self.profilesDir, newFileName: newFileName)
} else { continue }
}


self.log("Finished collecting shell history and profile information...")
}
}
99 changes: 56 additions & 43 deletions artifacts/TCC.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,65 +16,78 @@ class TCC: ArtifactsModule {
}

func getTCC() {
let fileURL = try! filemanager.url(for: .applicationSupportDirectory, in: .userDomainMask, appropriateFor: nil, create: false).appendingPathComponent("com.apple.TCC/TCC.db")
self.copyFileToCase(fileToCopy: fileURL, toLocation: tccDir)

let capturedTCC = self.createNewCaseFile(dirUrl: self.moduleDirRoot, filename: "tccItems.txt")
var db : OpaquePointer?

if sqlite3_open(fileURL.path, &db) == SQLITE_OK {
var queryStatement: OpaquePointer? = nil
let queryString = "select client, auth_value, auth_reason, service from access"
for user in getBasicUsersOnSystem() {

var fileURL: URL
if filemanager.fileExists(atPath: "\(user.homedir)/Library/Application Support/com.apple.TCC/TCC.db") {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To keep this cleaner

let tcc_path = "\(user.homedir)/Library/Application Support/com.apple.TCC/TCC.db"
if filemanager.fileExists(atPath: tcc_path) {...

fileURL = URL(fileURLWithPath: "\(user.homedir)/Library/Application Support/com.apple.TCC/TCC.db")
} else { continue }


self.copyFileToCase(fileToCopy: fileURL, toLocation: tccDir, newFileName: "tcc_\(user.username)")

if sqlite3_prepare_v2(db, queryString, -1, &queryStatement, nil) == SQLITE_OK {
var client: String = ""
var authValue: String = ""
var authReason: String = ""
var service: String = ""

var db : OpaquePointer?

if sqlite3_open(fileURL.path, &db) == SQLITE_OK {
var queryStatement: OpaquePointer? = nil
let queryString = "select client, auth_value, auth_reason, service from access"

while sqlite3_step(queryStatement) == SQLITE_ROW {
let col1 = sqlite3_column_text(queryStatement, 0)
if col1 != nil{
client = String(cString: col1!)
}
if sqlite3_prepare_v2(db, queryString, -1, &queryStatement, nil) == SQLITE_OK {
var client: String = ""
var authValue: String = ""
var authReason: String = ""
var service: String = ""

let col2 = sqlite3_column_text(queryStatement, 1)
if col2 != nil {
authValue = String(cString: col2!)
for item in TCCAuthValue.allCases {
if authValue == String(item.rawValue) {
authValue = String(describing: item)
while sqlite3_step(queryStatement) == SQLITE_ROW {
let col1 = sqlite3_column_text(queryStatement, 0)
if col1 != nil{
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you can clean all of these up by using

                    if let col1 = col1 {
                        client = String(cString: col1)
                    }

This is the more standard way to do it in swift that way you're not force unwrapping with client = String(cString: col1!)

If you would prefer to do all of this in a separate PR that's fine. I know you have a lot of sql statements

client = String(cString: col1!)
}

let col2 = sqlite3_column_text(queryStatement, 1)
if col2 != nil {
authValue = String(cString: col2!)
for item in TCCAuthValue.allCases {
if authValue == String(item.rawValue) {
authValue = String(describing: item)
}
}
}
}

let col3 = sqlite3_column_text(queryStatement, 2)
if col3 != nil {
authReason = String(cString: col3!)
for item in TCCAuthReason.allCases {
if authReason == String(item.rawValue) {
authReason = String(describing: item)
let col3 = sqlite3_column_text(queryStatement, 2)
if col3 != nil {
authReason = String(cString: col3!)
for item in TCCAuthReason.allCases {
if authReason == String(item.rawValue) {
authReason = String(describing: item)
}
}
}
}

let col4 = sqlite3_column_text(queryStatement, 3)
if col4 != nil {
service = String(cString: col4!)
for item in TCCService.allCases {
if service == String(item.rawValue) {
service = String(describing: item)
let col4 = sqlite3_column_text(queryStatement, 3)
if col4 != nil {
service = String(cString: col4!)
for item in TCCService.allCases {
if service == String(item.rawValue) {
service = String(describing: item)
}
}
}

self.addTextToFile(atUrl: capturedTCC, text: "TCC Data for \(user.username)")
self.addTextToFile(atUrl: capturedTCC, text: "Name: \(client)\nRequested Service: \(service)\nAuth Value: \(authValue)\nAuth Reason: \(authReason)\n")
}

self.addTextToFile(atUrl: capturedTCC, text: "Name: \(client)\nRequested Service: \(service)\nAuth Value: \(authValue)\nAuth Reason: \(authReason)\n")
}
self.log("Finished capturing TCC data for \(user.username)")
} else {
self.log("An error occurred when attempting to query the TCC database for user \(user.username)...")
}
self.log("Finished capturing TCC data")
} else {
self.log("An error occurred when attempting to query the TCC database...")
}
self.log("Finished querying TCC")
}

override func run() {
Expand Down
Loading