jipegit / osxauditor Goto Github PK

View Code? Open in Web Editor NEW

3.1K 3.1K 282.0 1.01 MB

OS X Auditor is a free Mac OS X computer forensics tool

License: Other

JavaScript 91.14% Python 8.74% Makefile 0.12%

osxauditor's Introduction

OS X Auditor

OS X Auditor is a free Mac OS X computer forensics tool.

OS X Auditor parses and hashes the following artifacts on the running system or a copy of a system you want to analyze:

the kernel extensions
the system agents and daemons
the third party's agents and daemons
the old and deprecated system and third party's startup items
the users' agents
the users' downloaded files
the installed applications

It extracts:

the users' quarantined files
the users' Safari history, downloads, topsites, LastSession, HTML5 databases and localstore
the users' Firefox cookies, downloads, formhistory, permissions, places and signons
the users' Chrome history and archives history, cookies, login data, top sites, web data, HTML5 databases and local storage
the users' social and email accounts
the WiFi access points the audited system has been connected to (and tries to geolocate them)

It also looks for suspicious keywords in the .plist themselves.

It can verify the reputation of each file on:

Team Cymru's MHR
VirusTotal
your own local database

It can aggregate all logs from the following directories into a zipball:

/var/log (-> /private/var/log)
/Library/logs
the user's ~/Library/logs

Finally, the results can be:

rendered as a simple txt log file (so you can cat-pipe-grep in them… or just grep)
rendered as a HTML log file
sent to a Syslog server

Author

Jean-Philippe Teissier - @Jipe_ & al.

Development status

OS X Auditor IS NO LONGER MAINTAINED - YOU SHOULD NOT USE IT

Support

OS X Auditor started as a week-end project and is no longer maintained. It has been forked by the great guys @ Yelp who created osxcollector.

I do recommend you to use to osxcollector (https://github.com/Yelp/osxcollector)

How to install

Just copy all files from GitHub.

Dependencies

If you plan to run OS X Auditor on a Mac, you will get a full plist parsing support with the OS X Foundation through pyobjc:

pip install pyobjc

If you can't install pyobjc or if you plan to run OS X Auditor on another OS than Mac OS X, you may experience some troubles with the plist parsing:

pip install biplist
pip install plist

These dependencies will be removed when a working native plist module will be available in python

How to run

OS X Auditor runs well with python >= 2.7.2 (2.7.9 is OK). It does not run with a different version of python yet (due to the plist nightmare)
OS X Auditor is maintained to work on the lastest OS X version. It will do its best on older OS X versions.
You must run it as root (or via sudo) if you want to use is on a running system, otherwise it won't be able to access some system and other users' files
If you're using API keys from environment variables (see below), you need to use the sudo -E to use the users environment variables

Type osxauditor.py -h to get all the available options, then run it with the selected options

eg. [sudo -E] python osxauditor.py -a -m -l localhashes.db -H log.html

Setting Environment Variables

VirusTotal API:

export VT_API_KEY=aaaabbbbccccddddeeee

Changelog

0.4.3

FIX: (lots of) Bug fixes - See https://github.com/jipegit/OSXAuditor/issues
CHANGE: Malware.lu hash check removed - service not available anymore

0.4.2

CHANGE: Moved API keys from in the code to environment variables

0.4.1

CHANGE: Search for generic backdoors in LaunchAgentPlist

0.4

NEW: extracts events (boot/shutdown, hibernation in/out, sudo commands, usb devices, ttys opened/closed, from the system logs and create a (not readable yet) timeline (-e/eventlogs)
NEW: extracts users' LoginItems
NEW: extracts users' RecentItems
NEW: extracts the LastSession from Safari artifacts
NEW: extract system groups and users details
FIX: wrong os.path.join() calls
FIX: bug in the recursive ParsePackagesDir()

0.3.1

NEW: provides with the system name, version and build of the audited system
NEW: ability to analyze installed Applications (-i/--installedapps)
NEW: extracts the Archived History from Google Chrome artifacts
NEW: a human readable HTML log report :)
FIX: HTMLLog() and SYSLOGLog() now handle exceptions
FIX: ParsePackagesDir() is now recursive and only tries to parse apps or kernel extensions. Some DEBUG output added as well
FIX: HUGE UTF-8/UNICODE improvement
FIX: .DS_Store and .localized files are ignored in ParsePackagesDir()

0.3

NEW: ability to parse Google Chrome artifacts (History and archives history, Cookies, Login Data, Top Sites, Web Data, HTML5 databases and local storage) with -b/--browsers
NEW: ability to extract the Wi-Fi APs the audited system has been connected to from the Airport Preferences and tries to geolocate them using Geomena (-A/--airportprefs). You must use -g/--wifiapgeolocate to enable the geolocation (or set GEOLOCATE_WIFI_AP to True in the code).
NEW: ability to extract users' social and email accounts (-U/--usersaccounts)
FIX: ability to handle the locked sqlite databases especially while auditing a live system
FIX: hashes duplicates removed
FIX: better identify md5 in the HTML output
CHANGE: indicates if a section (Startup items, Packages directory, Db tables, etc…) is empty to clarify the output
CHANGE: the downloads artifacts (-d/--downloads) include the old and new Mail.app default download directories

0.2.1

CHANGE/FIX: implement a BigFileMd5() function to hash very big files, avoid MemoryError execptions and reduce the memory footprint
FIX: UTF-8 entries from LSQuarantineEvent in ParseQuarantines()

0.2

NEW: ability to send the results to a remote syslogd server (-S)
NEW: ability to create a zipball of all the log files found on the audited system (-z)
CHANGE: the analysis of startup artifacts includes the old and deprecated StartupItems
CHANGE: the analysis of startup artifacts includes the ScriptingAdditions
CHANGE: the analysis of quarantined artifact includes the old QuarantineEvents for Mac OS X systems <= 10.6
CHANGE: great improvement of plist hangling using the Python ⟷ Objective-C bridge (PyObjC) and OS X Foundation
CHANGE: some changes in the options parameters (-t, -l)
CHANGE: license changed from CC to GPL
CHANGE: debug levels are now more consitent in the output logs
CHANGE: a small change with the Bootstrap CSS
CHANGE: the VirusTotal lookup is now done in a bulk mode
FIX: a bug in ParseLaunchAgents() on plist files containing both Program and ProgramArguments keys

0.1

Initial Release

Design & Capabilities

Artifacts

Users

Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
Library/Preferences/com.apple.LaunchServices.QuarantineEvents
Library/Preferences/com.apple.loginitems.plist
Library/Mail Downloads/
Library/Containers/com.apple.mail/Data/Library/Mail Downloads
Library/Accounts/Accounts3.sqlite
Library/Containers/com.apple.mail/Data/Library/Mail/V2/MailData/Accounts.plist
Library/Preferences/com.apple.recentitems.plist
Firefox

Library/Application Support/Firefox/Profiles/
cookies.sqlite
downloads.sqlite
formhistory.sqlite
places.sqlite
signons.sqlite
permissions.sqlite
addons.sqlite
extensions.sqlite
content-prefs.sqlite
healthreport.sqlite
webappsstore.sqlite

Safari

Library/Safari/
Downloads.plist
History.plist
TopSites.plist
LastSession.plist
Databases
LocalStorage

Chrome

Library/Application Support/Google/Chrome/Default/
History
Archived History
Cookies
Login Data
Top Sites
Web Data
databases
Local Storage

System

/System/Library/LaunchAgents/
/System/Library/LaunchDaemons/
/System/Library/ScriptingAdditions/
/System/Library/StartupItems/Library/ScriptingAdditions/
/System/Library/Extensions/
/System/Library/CoreServices/SystemVersion.plist
/Library/LaunchAgents/
/Library/LaunchDaemons/
/Library/StartupItems/
/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist
/Library/logs
/var/log
/etc/localtime
StartupParameters.plist
/private/var/db/dslocal/nodes/Default/groups/admin.plist
/private/var/db/dslocal/nodes/Default/users

TODO

extract user info from /private/var/db/dslocal/nodes/Default/users

Related work

Disk Arbitrator

Disk Arbitrator is Mac OS X forensic utility designed to help the user ensure correct forensic procedures are followed during imaging of a disk device. Disk Arbitrator is essentially a user interface to the Disk Arbitration framework, which enables a program to participate in the management of block storage devices, including the automatic mounting of file systems. When enabled, Disk Arbitrator will block the mounting of file systems to avoid mounting as read-write and violating the integrity of the evidence.

https://github.com/aburgh/Disk-Arbitrator

Volafox

volafox a.k.a 'Mac OS X Memory Analysis Toolkit' is developed on python 2.x

https://code.google.com/p/volafox/

Mandiant Memoryze(tm) for the Mac

Memoryze for the Mac is free memory forensic software that helps incident responders find evil in memory… on Macs. Memoryze for the Mac can acquire and/or analyze memory images. Analysis can be performed on offline memory images or on live systems.

http://www.mandiant.com/resources/download/mac-memoryze

Volatility MacMemoryForensics

https://code.google.com/p/volatility/wiki/MacMemoryForensics

License

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.

Bootstrap and JQuery have their own GPL compatible licences.

osxauditor's People

Contributors

Stargazers

Watchers

Forkers

samplenull tania188 mattsolomon 6fj7 queer1 weixu8 saulshanabrook mariusv vicgc ktneely juju4 tourountzis mrdfx loftierthoughts superpetboy gwerz pinperepette reluctantusr danetheory liufeigit wanghaiquan rainsome-org1 majl pandazheng aficionado ttruga ny2014 lazycrazyowl shayanb jpn592 eiriklv corbett3000 kevinmcalear martindale xeoron sethkontny qz267 sooshie calsaviour mamoo crystal520 chagge lucabongiorni pascougnou esaul bshort peixian danielshir ring0sec karlpilkington wcmc-its frankswu jjsanbra saferthanhouses ifireall dot-sean lenciel kykim ifghou hubert3 redorion bigsnarfdude rajaramang jbarcia tengfei1010 zavierxu c-rack aatifs josete04 claudioherrera-4th madconnon eunicep tdr130 thomassthelly cnbird1999 rtrocki bossadvisors macapplist sh4d0ws4int osalexis zigitax ryanlfoster peter158 toddhdow-xx cyblitz isamehahmed sdelavega jfnixon bsmartt13 turtlepa xsailor511 odin1314 unixboy caidongyun palaniyappanbala techraf godaccess smoriarty21 jfergie03 noscripter

osxauditor's Issues

bug

[INFO] /Users/xxxx/Library/Preferences/com.apple.loginitems.plist
App Tamer.apSSDApplications/App Tamer.app/
Traceback (most recent call last):
File "osxauditor.py", line 1697, in
Main()
File "osxauditor.py", line 1652, in Main
ParseStartup()
File "osxauditor.py", line 531, in ParseStartup
PrintAndLog(CustomListItem['Name'].decode('utf-8') + u' - ' + binascii.hexlify(CustomListItem['Alias']).decode('hex').decode('utf-8', 'ignore'), 'INFO')
File "osxauditor.py", line 227, in PrintAndLog
print(u'[INFO] ' + LogStr)
UnicodeEncodeError: 'ascii' codec can't encode character u'\u04b3' in position 41: ordinal not in range(128)

Traceback (most recent call last):
File "osxauditor.py", line 1700, in
Main()
File "osxauditor.py", line 1664, in Main
ParseDownloads()
File "osxauditor.py", line 562, in ParseDownloads
HashDir(User + u''s downloads', DlUserPath)
File "osxauditor.py", line 548, in HashDir
PrintAndLog(Md5 +' '+ FilePath.decode('utf-8') + u' - ' + time.ctime(os.path.getmtime(FilePath)) + u' - ' + time.ctime(os.path.getctime(FilePath)) + u'\n', 'INFO')
File "osxauditor.py", line 227, in PrintAndLog
print(u'[INFO] ' + LogStr)
UnicodeEncodeError: 'ascii' codec can't encode character u'\u0327' in position 83: ordinal not in range(128)

Multitude of "Command Not Found" errors

When running ./osxauditor.py, either as standard user or sudo, I get the following "command not found" errors. Obviously, it thinks those variables are instead commands.

$ ./osxauditor.py -h
./osxauditor.py: line 10: description: command not found
./osxauditor.py: line 11: author: command not found
./osxauditor.py: line 12: version: command not found
./osxauditor.py: line 14: ROOT_PATH: command not found
usage: hostname [-fs] [name-of-host]
./osxauditor.py: line 17: HASHES: command not found
./osxauditor.py: line 18: LOCAL_HASHES_DB: command not found
./osxauditor.py: line 20: HTML_LOG_FILE: command not found
./osxauditor.py: line 21: HTML_LOG_CONTENT: command not found
./osxauditor.py: line 22: HTML_LOG_MENU: command not found
./osxauditor.py: line 24: HTML_EVENTS_TL: command not found
./osxauditor.py: line 25: HTML_EVENTS_LANES: command not found
./osxauditor.py: line 26: HTML_EVENTS_ITEMS: command not found
./osxauditor.py: line 28: FOUNDATION_IS_IMPORTED: command not found
./osxauditor.py: line 29: BIPLIST_IS_IMPORTED: command not found
./osxauditor.py: line 30: PLISTLIB_IS_IMPORTED: command not found
./osxauditor.py: line 32: SYSLOG_SERVER: command not found
./osxauditor.py: line 33: SYSLOG_PORT: command not found
./osxauditor.py: line 35: MRH_HOST: command not found
./osxauditor.py: line 36: MRH_PORT: command not found
./osxauditor.py: line 38: GEOLOCATE_WIFI_AP: command not found
./osxauditor.py: line 39: GEOMENA_API_HOST: command not found
./osxauditor.py: line 41: VT_HOST: command not found
./osxauditor.py: line 43: ADMINS: command not found
./osxauditor.py: line 45: OSX_VERSION: command not found
./osxauditor.py: line 47: import: command not found
./osxauditor.py: line 48: syntax error near unexpected token sys' ./osxauditor.py: line 48:reload(sys)'

I'm running Python 2.7.10 and just installed pyobjc via "pip install pyobjc" (required a "pip install pyobjc-core --upgrade" in order to work).

Unable to parse "com.apple.loginitems.plist"

When I run with:
sudo python osxauditor.py -a -m -l localhashes.db -H log.html
I get the following error:

[INFO] Users' LoginItems
[INFO] sligodave's LoginItems
[INFO] /Users/sligodave/Library/Preferences/com.apple.loginitems.plist
[INFO] Cannot parse /Users/sligodave/Library/Preferences/com.apple.loginitems.plist (Binary or JSON plist may FAIL)

Traceback (most recent call last):
  File "osxauditor.py", line 1702, in <module>
    Main()
  File "osxauditor.py", line 1651, in Main
    ParseStartup()
  File "osxauditor.py", line 550, in ParseStartup
    if "SessionItems" in LoginItemsPlist:
TypeError: argument of type 'bool' is not iterable

Also, the log.html is empty, so I'm afraid I can't help with anything from that.

IndexError: list index out of range for SystemVersionPlist array

I'm having this error

PrimaVita:OSXAuditor-master asb$ sudo python osxauditor.py
DEBUG: Mac OS X Obj-C Foundation successfully imported
[INFO] Header
Traceback (most recent call last):
  File "osxauditor.py", line 1702, in <module>
    Main()
  File "osxauditor.py", line 1635, in Main
    AuditedSystemVersion = GetAuditedSystemVersion()
  File "osxauditor.py", line 1228, in GetAuditedSystemVersion
    "PatchVersion": int(SystemVersionPlist["ProductVersion"].split('.')[2])
IndexError: list index out of range
PrimaVita:OSXAuditor-master asb$ sudo /usr/bin/python osxcollector.py
/usr/bin/python: can't open file 'osxcollector.py': [Errno 2] No such file or directory

python: can't open file 'osxcollector.py': [Errno 2] No such file or directory

I'm getting errors: python: can't open file 'osxcollector.py': [Errno 2] No such file or directory

UnicodeDecode Error on OSX 10.9.4 with python 2.7.5

I ran the osxauditor and got following error:

Traceback (most recent call last):
  File "osxauditor.py", line 1702, in 
    Main()
  File "osxauditor.py", line 1657, in Main
    ParseQuarantines()
  File "osxauditor.py", line 440, in ParseQuarantines
    JointLSQuarantineEvent += u";" + unicode(Q)
UnicodeDecodeError: 'ascii' codec can't decode byte 0x9c in position 4: ordinal not in range(128)

I am also trying to figure out and fix it, but thought to log it so that you are aware of this.

KeyError

I know this is not in development anymore, but I came across this:

root@data-recovery:~/osx/OSXAuditor-master# sudo python osxauditor.py --path=/root/osx/OSXAuditor-master/ -A
DEBUG: Cannot import Mac OS X Obj-C Foundation. Installing PyObjC on OS X is highly recommended
[INFO] Header
[INFO] Cannot open /System/Library/CoreServices/SystemVersion.plist
[INFO] Cannot determine the system version
[INFO] Report generated by OS X Auditor v0.4.4 on 06/12/20 14:45:54 EEST running as 0/0
[INFO] Audited system path: /root/osx/OSXAuditor-master/
[INFO] Version of the audited system: Unknown system version
[INFO] Current timezone of the audited system: etc/localtime

[INFO] Airport preferences
[INFO] /root/osx/OSXAuditor-master/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist
76
Traceback (most recent call last):
  File "osxauditor.py", line 1697, in <module>
    Main()
  File "osxauditor.py", line 1670, in Main
    ParseAirportPrefs()
  File "osxauditor.py", line 954, in ParseAirportPrefs
    if KnownNetworks[KnownNetwork]['LastConnected']:
KeyError: 'LastConnected'
root@data-recovery:~/osx/OSXAuditor-master# sudo python osxauditor.py --path=/root/osx/OSXAuditor-master/ -A > audit.txt
Traceback (most recent call last):
  File "osxauditor.py", line 1697, in <module>
    Main()
  File "osxauditor.py", line 1670, in Main
    ParseAirportPrefs()
  File "osxauditor.py", line 954, in ParseAirportPrefs
    if KnownNetworks[KnownNetwork]['LastConnected']:
KeyError: 'LastConnected'

I'm running the script against a folder with SystemConfiguration plists and I'm using Ubuntu 16.04 headless.

needs unit tests

How are you going to prevent breaking pull requests?

KeyError: 'CachedScanRecord'

...
[INFO] /Users/saul/Library/Application Support/Google/Chrome/Default/Local Storage/https_www.netflix.com_0.localstorage
[INFO] Table ItemTable
[INFO] (u'SID', <read-write buffer ptr 0x10783eed0, size 92 at 0x10783ee90>)

[INFO] Airport preferences
[INFO] /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist
Traceback (most recent call last):
  File "osxauditor.py", line 1667, in <module>
    Main()
  File "osxauditor.py", line 1634, in Main
    ParseAirportPrefs()
  File "osxauditor.py", line 954, in ParseAirportPrefs
    PrintAndLog(u"SSID: " + RememberedNetwork["SSIDString"].decode("utf-8") + u" - BSSID: " + RememberedNetwork["CachedScanRecord"]["BSSID"] + u" - RSSI: " + str(RememberedNetwork["CachedScanRecord"]["RSSI"]) + u" - Last connected: " + str(RememberedNetwork["LastConnected"]) + u" - Security type: " + RememberedNetwork["SecurityType"] + u" - Geolocation: " + Geolocation, "INFO")
  File "/usr/local/Cellar/python/2.7.6/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/PyObjC/objc/_convenience.py", line 162, in __getitem__objectForKey_
    return container_unwrap(res, KeyError, key)
  File "/usr/local/Cellar/python/2.7.6/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/PyObjC/objc/_convenience.py", line 659, in container_unwrap
    raise exc_type(*exc_args)
KeyError: 'CachedScanRecord'

package it properly.

Needs a setup.py to be pip installable.

PortNumber errors

When I ran sudo python osxauditor.py -qsidAUe -l localhashes.db -H log.html, I got

Traceback (most recent call last):
  File "osxauditor.py", line 1702, in <module>
    Main()
  File "osxauditor.py", line 1672, in Main
    ParseUsersAccounts()
  File "osxauditor.py", line 1185, in ParseUsersAccounts
    ParseMailAppAccount(MailAccountPlistPath)
  File "osxauditor.py", line 1006, in ParseMailAppAccount
    if "PortNumber" in MailAccount: MAccountPref += "(" + MailAccount["PortNumber"]  + ") - "
TypeError: cannot concatenate 'str' and 'OC_PythonLong' objects

After I fixed the above error, I got this:

Traceback (most recent call last):
  File "osxauditor.py", line 1702, in <module>
    Main()
  File "osxauditor.py", line 1672, in Main
    ParseUsersAccounts()
  File "osxauditor.py", line 1185, in ParseUsersAccounts
    ParseMailAppAccount(MailAccountPlistPath)
  File "osxauditor.py", line 1027, in ParseMailAppAccount
    if "PortNumber" in DeliveryAccount: DAccountPref += "(" + MailAccount["PortNumber"]  + ") - "
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/PyObjC/objc/_convenience.py", line 188, in __getitem__objectForKey_
    return container_unwrap(res, KeyError, key)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/PyObjC/objc/_convenience.py", line 654, in container_unwrap
    raise exc_type(*exc_args)
KeyError: 'PortNumber'

Traceback when checking Safari's LastSession

[INFO] sam's Safari LastSession
[INFO] /Users/sam/Library/Safari/LastSession.plist
Traceback (most recent call last):
  File "osxauditor.py", line 1702, in <module>
    Main()
  File "osxauditor.py", line 1663, in Main
    ParseBrowsers()
  File "osxauditor.py", line 808, in ParseBrowsers
    ParseSafari()
  File "osxauditor.py", line 745, in ParseSafari
    ParseSafariProfile(User, UserSafariProfilePath)
  File "osxauditor.py", line 717, in ParseSafariProfile
    LastSession = LastSessionPlist["SessionWindows"][0]["TabStates"][0]
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/PyObjC/objc/_convenience.py", line 451, in __getitem__objectAtIndex_
    return container_unwrap(self.objectAtIndex_(idx), RuntimeError)
IndexError: NSRangeException - -[__NSCFArray objectAtIndex:]: index (0) beyond bounds (0)

Python Version:

2.7.5 (default, Mar  9 2014, 22:15:05) 
[GCC 4.2.1 Compatible Apple LLVM 5.0 (clang-500.0.68)]

I'm running on a Mac with Mountain Lion 10.9.4. Any ideas?

Relative symlinks can go into an infinite loop

OSXAuditor will get stuck in a loop if there are relative symlinks that can cause a loop:

[INFO] /Applications/Papers2.app/Contents/SharedSupport/Citations.app/Contents/SharedSupport/Citations.app/Contents/SharedSupport/Citations.app/Contents/SharedSupport/Citations.app/Contents/SharedSupport/Citations.app/Contents/SharedSupport/Citations.app/Contents/SharedSupport/Citations.app/Contents/SharedSupport/Citations.app/Contents/SharedSupport/Citations.app/Contents/SharedSupport/Citations.app/Contents/SharedSupport/Citations.app/Contents/SharedSupport/Citations.app/Contents/SharedSupport/Citations.app/Contents/SharedSupport/Citations.app/Contents/SharedSupport/Citations.app/Contents/SharedSupport/Citations.app/Contents/SharedSupport/papers_migration2095.app/Contents/SharedSupport/Citations.app/Contents/SharedSupport/papers_migration2094.app/Contents/SharedSupport/papers_migration2094.app/Contents/SharedSupport/papers_migration2095.app/Contents/SharedSupport/papers_migration2095.app/Contents/SharedSupport/papers_migration2095.app/Contents/SharedSupport/papers_migration2094.app

lrwxr-xr-x  1 jeff  admin  22 Dec 20  2013 /Applications/Papers2.app/Contents/SharedSupport/Citations.app/Contents/SharedSupport -> ../../../SharedSupport

Array index beyond bounds on Safari LastSession

Fails on LastSession.plist. Recently updated to Safari 7.1 and Maverick 10.9.5.

Here's full stack of the error and file contents:

[INFO] /Users/[username]/Library/Safari/LastSession.plist
Traceback (most recent call last):
  File "osxauditor.py", line 1702, in <module>
    Main()
  File "osxauditor.py", line 1663, in Main
    ParseBrowsers()
  File "osxauditor.py", line 808, in ParseBrowsers
    ParseSafari()
  File "osxauditor.py", line 745, in ParseSafari
    ParseSafariProfile(User, UserSafariProfilePath)
  File "osxauditor.py", line 717, in ParseSafariProfile
    LastSession = LastSessionPlist["SessionWindows"][0]["TabStates"][0]
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/PyObjC/objc/_convenience.py", line 451, in __getitem__objectAtIndex_
    return container_unwrap(self.objectAtIndex_(idx), RuntimeError)
IndexError: NSRangeException - -[__NSCFArray objectAtIndex:]: index (0) beyond bounds (0)


OSXAuditor ➤ cat  /Users/[username]/Library/Safari/LastSession.plist                                                                                                                               git:master
+/0%

remove auditor

How does one remove auditor?

argument of type 'bool' is not iterable

[INFO] Users' LoginItems
[INFO] lx0741 LoginItems
[INFO] /Users/lx0741/Library/Preferences/com.apple.loginitems.plist
[INFO] Cannot parse /Users/lx0741/Library/Preferences/com.apple.loginitems.plist (Binary or JSON plist may FAIL)

Traceback (most recent call last):
File "osxauditor.py", line 1702, in
Main()
File "osxauditor.py", line 1651, in Main
ParseStartup()
File "osxauditor.py", line 550, in ParseStartup
if "SessionItems" in LoginItemsPlist:
TypeError: argument of type 'bool' is not iterable

UnicodeDecodeError

An interesting error.

Traceback (most recent call last):
  File "osxauditor.py", line 1702, in <module>
    Main()
  File "osxauditor.py", line 1657, in Main
    ParseQuarantines()
  File "osxauditor.py", line 440, in ParseQuarantines
    JointLSQuarantineEvent += u";" + unicode(Q)
UnicodeDecodeError: 'ascii' codec can't decode byte 0xd8 in position 48: ordinal not in range(128)

Crashes when /Users/user/Library/Safari/Databases is non existant

[INFO] user's Safari databases
Traceback (most recent call last):
  File "osxauditor.py", line 1702, in <module>
    Main()
  File "osxauditor.py", line 1663, in Main
    ParseBrowsers()
  File "osxauditor.py", line 808, in ParseBrowsers
    ParseSafari()
  File "osxauditor.py", line 745, in ParseSafari
    ParseSafariProfile(User, UserSafariProfilePath)
  File "osxauditor.py", line 723, in ParseSafariProfile
    for Db in os.listdir(os.path.join(Path, "Databases")):
OSError: [Errno 2] No such file or directory: '/Users/user/Library/Safari/Databases'

Geolocation API Dead

So I can't pull up the website for http://geomena.org/ap/. I think it might need to be removed or replaced.

No such file or directory

NameError: global name 'DbPath' is not defined

Running as root:

osxauditor.py -H report.html -qsbk

[...]

/Users/xxx/Library/Safari/Databases/https_xxxxxx_0

Traceback (most recent call last):
File "osxauditor.py", line 598, in
Main()
File "osxauditor.py", line 572, in Main
ParseBrowsers()
File "osxauditor.py", line 462, in ParseBrowsers
ParseSafari()
File "osxauditor.py", line 452, in ParseSafari
ParseSafariProfile(User, os.path.join(ROOT_PATH + "Users/" + User + "/Library/Safari"))
File "osxauditor.py", line 441, in ParseSafariProfile
DumpSQLiteDb(os.path.join(Path + "/Databases/" + Db))
File "osxauditor.py", line 340, in DumpSQLiteDb
PrintAndLog(DbPath + "not found\n", "WARNING")
NameError: global name 'DbPath' is not defined

osxcollector

I'm curious if this project has any overlap with osxcollector. It would be pretty awesome if this project could run all of those tests as well 👍

TypeError: cannot concatenate 'str' and 'OC_PythonLong' objects

[INFO] Email accounts Traceback (most recent call last): File "osxauditor.py", line 1705, in <module> Main() File "osxauditor.py", line 1675, in Main ParseUsersAccounts() File "osxauditor.py", line 1188, in ParseUsersAccounts ParseMailAppAccount(MailAccountPlistPath) File "osxauditor.py", line 1009, in ParseMailAppAccount if "PortNumber" in MailAccount: MAccountPref += "(" + MailAccount["PortNumber"] + ") - " TypeError: cannot concatenate 'str' and 'OC_PythonLong' objects

Dang. This program has been running for 2 hours, then I get this error. :/

I've had three errors so far trying to run this script -- it seems that some try-except blocks would be a great way to make this code more robust to errors like this...

UnicodeDecodeError

$ sudo python osxauditor.py -a -m -u -v -H log.html
DEBUG: Mac OS X Obj-C Foundation successfully imported
[INFO] Header
[INFO] Report generated by OS X Auditor v0.4.1 on 03/26/14 02:08:05 EDT running as 0/0
[INFO] Audited system path: /
[INFO] Version of the audited system: Mac OS X 10.9.2 build 13C64
[INFO] Current timezone of the audited system: America/New_York
...

[INFO] BAFEC7D3-F95B-4FA4-B52D-63DD8DDD19C7;414876165.0;com.google.Chrome.canary;Google Chrome Canary.app;https://clients2.googleusercontent.com/crx/blobs/QgAAAC6zw0qH2DJtnXe8Z7rUJP1LCBcQFXnsDBWtzc8TuHoP32t_g71nlolfDcqxMxX0MG6V426YJ_zSC0_gWDncJjfbtx0DIkVTho71ZSHVSqLsAMZSmuXi6_hEG2gwCDom6hkadLlag_KGbg/extension_37.crx;None;None;0;None;https://chrome.google.com/webstore/detail/pushbullet/chlffgpmiacpedhhbkiomidkjlcfhogd;None

[INFO] 478DBA8B-3223-4F43-875C-5FC5E67F7F37;414877643.0;com.google.Chrome.canary;Google Chrome Canary.app;https://mail-attachment.googleusercontent.com/attachment/b/476/u/0/?ui=2&ik=0e093b1064&view=att&th=14452100c25371f7&attid=0.1&disp=safe&zw&saduie=AG9B_P9aJIRk40xr9SD--gUNRcEm&sadet=1393184862873&sads=bdQ2PR7myal1bIzvrgaE6M02wiU;None;None;0;None;https://mail.google.com/mail/b/476/u/0/;None

Traceback (most recent call last):
  File "osxauditor.py", line 1666, in <module>
    Main()
  File "osxauditor.py", line 1621, in Main
    ParseQuarantines()
  File "osxauditor.py", line 437, in ParseQuarantines
    JointLSQuarantineEvent += u";" + unicode(Q)
UnicodeDecodeError: 'ascii' codec can't decode byte 0xb8 in position 4: ordinal not in range(128)

Spelling error

https://github.com/jipegit/OSXAuditor/blob/master/CONTRIBUTING.md
In the Philosophy section bullet point list, last item:
All the hases go into the global hash db.

I think "hases" should be "hashes"

the contributing guidelines dictate non-pythonic standards

The guide says to use 2 spaces for indentation. This is pretty atypical in open-source Python projects. Consider making it 4?

Traceback when checking SMTP email's port

DEBUG: Mac OS X Obj-C Foundation successfully imported
[INFO] Report generated by OS X Auditor v0.4.4 on ...
[INFO] Audited system path: /
[INFO] Version of the audited system: Mac OS X 10.8.5 build 12F2560
.
.
.
[INFO] SMTP accounts
Traceback (most recent call last):
  File "osxauditor.py", line 1693, in <module>
    Main()
  File "osxauditor.py", line 1669, in Main
    ParseUsersAccounts()
  File "osxauditor.py", line 1166, in ParseUsersAccounts
    ParseMailAppAccount(MailAccountPlistPath)
  File "osxauditor.py", line 1005, in ParseMailAppAccount
    if 'PortNumber' in DeliveryAccount: DAccountPref += '(' + str(MailAccount['PortNumber'])  + ') - '
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/PyObjC/objc/_convenience.py", line 168, in __getitem__objectForKey_
    return container_unwrap(res, KeyError, key)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/PyObjC/objc/_convenience.py", line 634, in container_unwrap
    raise exc_type(*exc_args)
KeyError: 'PortNumber'

NSRangeException index 0 beyond bounds for SessionWindow

When running OSXAuditor on a system in which a user does not have any saved Session data from Safari, an error is generated. The error is:

IndexError: NSRangeException - -[__NSCFArray objectAtIndex:]: index (0) beyond bounds (0)

The contents of the LastSession.plist are:

{
SessionVersion = "1.0";
SessionWindows = (
);
}

From what I can gather, this section (line 713) is not validating there are objects within the SessionWindows key of the plist.

if "SessionWindows" in LastSessionPlist:
    LastSession = LastSessionPlist["SessionWindows"][0]["TabStates"][0]
    PrintAndLog(LastSession["TabURL"].decode("utf-8") + u" - " + binascii.hexlify(LastSession["SessionState"]).decode("hex").decode("utf-8", "ignore"), "INFO")

Once I open some tabs in Safari and quit, the LastSession.plist file contains data in the SessionWindows key, and the osxauditor.py script runs without issue.

KeyError: LastConnected

sudo python osxauditor.py -a > audit.txt
Traceback (most recent call last):
  File "osxauditor.py", line 1684, in <module>
    Main()
  File "osxauditor.py", line 1657, in Main
    ParseAirportPrefs()
  File "osxauditor.py", line 946, in ParseAirportPrefs
    PrintAndLog(u'SSID: ' + KnownNetworks[KnownNetwork]['SSIDString'].decode('utf-8') + u' - SSID: ' + str(KnownNetworks[KnownNetwork]['SSID']) + u' - Last connected: ' + str(KnownNetworks[KnownNetwork]['LastConnected']) + u' - Security type: ' + KnownNetworks[KnownNetwork]['SecurityType'] + u' - Geolocation: ' + Geolocation, 'INFO')
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/PyObjC/objc/_convenience.py", line 162, in __getitem__objectForKey_
    return container_unwrap(res, KeyError, key)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/PyObjC/objc/_convenience.py", line 659, in container_unwrap
    raise exc_type(*exc_args)
KeyError: 'LastConnected'

AggregateLogs combines file path incorrectly

Receive the error when running with -z ../TEMP:

[INFO] Log files aggregation
[INFO] All log files are aggregated in ../TEMP/OSXAuditor_report_/HOSTNAME/_/20140916-160436/.zip
[INFO] Log files aggregation FAILED (2, 'No such file or directory')

Each argument in the function is joined with the system path delimiter (/ in OSX's case) in this call:

ZipLogsFilePath = os.path.join(ZipLogsFile, "OSXAuditor_report_", HOSTNAME, "_", time.strftime("%Y%m%d-%H%M%S", time.gmtime()), ".zip")

Change the commas to + like this:

ZipLogsFilePath = os.path.join(ZipLogsFile, "OSXAuditor_report_" + HOSTNAME + "_" + time.strftime("%Y%m%d-%H%M%S", time.gmtime()) + ".zip")

Disclosure of script in blog (Brazilian Portuguese)

First of all, congratulations to the script and to spread it in the community. It's fantastic!

I created a post, in Portuguese from Brazil, in my blog about your script (OSXAuditor). My intention is to spread knowledge and present to the Brazilian public its excellent tool. If at any time you can reference my post, I will be very happy!

When you have news on new tools and scripts, let me know!

Best regards,

Crash no output report log.html generated

Ran with

sudo python osxauditor.py -a -m -l localhashes.db -H log.html

runs for a while but does produce report. log.html. log is empty. Here is the crash

[INFO] Error with /Users/macadmin/Library/Application Support/Google/Chrome/Default/Web Data: ("Could not decode to UTF-8 column 'value' with text '^\xb4|\xc6W\x81\xc42UW\xe5\xc2\x9e\xfbj\xdd\xff\xfcE\x9f\xd3\xf2q\x10\xf2\x90\xa1DT\x9b\x94\xe0'",)
[INFO] macadmin's Chrome databases
Traceback (most recent call last):
  File "osxauditor.py", line 1702, in <module>
    Main()
  File "osxauditor.py", line 1663, in Main
    ParseBrowsers()
  File "osxauditor.py", line 810, in ParseBrowsers
    ParseChrome()
  File "osxauditor.py", line 801, in ParseChrome
    ParseChromeProfile(User, UsersChromePath)
  File "osxauditor.py", line 773, in ParseChromeProfile
    for Db in os.listdir(os.path.join(Path, "databases")):
OSError: [Errno 2] No such file or directory: '/Users/macadmin/Library/Application Support/Google/Chrome/Default/databases'

then it exits