#!/usr/bin/python

import os

import datetime

import logging

import math

import sys

import plistlib

import string

import struct

import xml.parsers.expat

import subprocess

import json

import socket

import Foundation

import Quartz

import argparse

import ctypes

import ctypes.util

import objc

import platform

import time

import hashlib

import sqlite3

import tempfile

import shutil

import binascii

import urllib2

import urllib

import base64

import hmac

import httplib

import urllib

import time

import random

import threading

# send the hash to VirusTotal for checking

vtResultRequested = False

attempts = 0

maxAttempts = 5759

#get the hostname of the system the script is running on

hostname = socket.gethostname()

#get UUID - https://apple.stackexchange.com/questions/72355/how-to-get-uuid-with-python/72360#72360

def getUUID():

return str(io_key("IOPlatformUUID".encode("utf-8")))

#uuid saved to variable

UUID = getUUID()

#get system information from the os

def getSystemInfo(output_file):

outfile.write("\n")

def getVTResult(fileHash):

return "shouldnt get here"

# get the sha256 hash of any file

def getHash(file, ignoreVFlag):

return(fileHash, vt_res)

#Code used from https://github.com/synack/knockknock/blob/master/knockknock.py - Patrick Wardle! - to get the signing information for a given executable

def checkSignature(file, bundle=None):

return (signingInfo)

def datetime_handler(x):

if isinstance(x, datetime.datetime):

return x.isoformat()

def parseAgentsDaemons(item,path):

return parsedPlist

def getLaunchAgents(path,output_file,ignoreVFlag):

outfile.write("\n")

def getLaunchDaemons(path,output_file,ignoreVFlag):

outfile.write("\n")

#get a list of users on the system

def getUsers(output_file):

return users_dict

#get all the safari extensions on the system

def getSafariExtensions(path,output_file):

outfile.write("\n")

#get all chrome extensions on the system

def getChromeExtensions(path,output_file):

outfile.write("\n")

# get chrome downloads and visit history

def getChromeDownloads(chromeHistoryDbPath,output_file):

os.remove(historyCopyPath)

#get all firefox extensions on the system

def getFirefoxExtensions(path,output_file):

outfile.write("\n")

def getInstallHistory(output_file):

output_file.write("\n")

def getCronJobs(users,output_file):

output_file.write("\n")

def getEmond(output_file):

output_file.write("\n")

def getKext(sipStatus,kextPath,output_file,ignoreVFlag):

output_file.write("\n")

def getEnv(output_file):

output_file.write("\n")

def getPeriodicScripts(output_file):

output_file.write("\n")

def getConnections(output_file):

output_file.write("\n")

def SIPStatus(output_file):

return sip

def GatekeeperStatus(output_file):

outfile.write("\n")

def parseApp(app,ignoreVFlag):

return appInfo

def getLoginItems(path,output_file,ignoreVFlag):

outfile.write("\n")

def getApps(path,output_file,ignoreVFlag):

outfile.write("\n")

def getEventTaps(output_file):

outfile.write("\n")

def getBashHistory(output_file, users):

outfile.write("\n")

def getShellStartupScripts(users, output_file):

output_file.write("\n")

#

# AWS UPLOAD (without requests module)

#

AMZN_SIGNED_HEADERS = ['content-md5', 'content-type',

'host', 'x-amz-content-sha256',

'x-amz-date']

AMZN_CONTENT_SHA256 = 'UNSIGNED-PAYLOAD'

def hmac_sha256(key, data):

return hmac.new(key, data, hashlib.sha256).digest()

def amzn_sig(secret_access_key, data, aws_region, aws_service='s3'):

return hmac.new(sign_key, data, hashlib.sha256).hexdigest()

def amzn_canonical_req(filename_path, headers_list):

AMZN_CONTENT_SHA256)

def s3_upload(data, content_type, filename_path, access_key_id, secret_access_key, s3_bucket, aws_region):

return conn.code == 200

if __name__ == '__main__':

script_start = time.time()

output_list = []

output = {}

sipStatus = True

outputFile = hostname

outputDirectory = os.getcwd()

print("%s" % """

__ __ _

\ \ / /__ _ __ __ _| |_ ___ _ __

\ \ / / _ \ '_ \ / _` | __/ _ \| '__|

\ V / __/ | | | (_| | || (_) | |

\_/ \___|_| |_|\__,_|\__\___/|_|

""")

parser = argparse.ArgumentParser(description='Helpful information for running your macOS Hunting Script.')

parser.add_argument('-f',metavar='File Name',default=outputFile, help='Name of your output file (by default the name is the hostname of the system).')

parser.add_argument('-d', metavar='Directory',default=outputDirectory, help='Directory of your output file (by default it is the current working directory).')

parser.add_argument('-a', metavar='<BUCKET_NAME>:<AWS_KEY_ID>:<AWS_KEY_SECRET>:<AWS_REGION>', help='Your AWS Key if you want to upload to S3 bucket.')

parser.add_argument('-v', action="store_true",dest="vtResultRequested", help='If present, hashes will be sent to VirusTotal for checking (severely slows down performance)')

args = parser.parse_args()

outputFilename = args.f + '.json'

outputPath = os.path.join(args.d, outputFilename)

if args.vtResultRequested:

vtResultRequested = True

ignoreVT = False

vtAPIKey = os.getenv("VTKEY")

if vtAPIKey is None:

print("You asked for results from VirusTotal but did not put an API key in the variable VTKEY")

sys.exit(-1)

else:

ignoreVT = True

outputPath = args.d+"/"+args.f+".json"

if not os.geteuid()==0:

sys.exit('This script must be run as root!')

with open(outputPath, 'w') as outfile:

lst_of_users = getUsers(outfile).get("users")

sipEnabled = SIPStatus(outfile).get("sip_status")

modules = [getSystemInfo(outfile),getInstallHistory(outfile),GatekeeperStatus(outfile),getConnections(outfile),

getEnv(outfile),getPeriodicScripts(outfile), getCronJobs(lst_of_users,outfile),getEmond(outfile),getLaunchAgents('/Library/LaunchAgents',outfile,ignoreVT),getShellStartupScripts(lst_of_users,outfile),

getLaunchDaemons('/Library/LaunchDaemons',outfile,ignoreVT),getKext(sipStatus,'/Library/Extensions',outfile,ignoreVT),getApps('/Applications',outfile,ignoreVT),getEventTaps(outfile),getBashHistory(outfile,lst_of_users)]

for module in modules:

module

#user specific modules

for user in lst_of_users:

userLaunchAgent = '/Users/'+user+'/Library/LaunchAgents'

chromeEx = '/Users/'+user+'/Library/Application Support/Google/Chrome/Default/Extensions/'

chromeHistory = '/Users/'+user+'/Library/Application Support/Google/Chrome/Default/History'

firefoxEx = '/Users/'+user+'/Library/Application Support/Firefox/'

safariEx = '/Users/'+user+'/Library/Safari/Extensions'

loginItemDir = '/Users/'+user+'/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm'

apps_dir = '/Users/'+user+'/Applications'

if os.path.exists(userLaunchAgent):

getLaunchAgents(userLaunchAgent,outfile,ignoreVT)

if os.path.exists(chromeEx):

getChromeExtensions(chromeEx,outfile)

if os.path.exists(chromeHistory):

getChromeDownloads(chromeHistory,outfile)

if os.path.exists(firefoxEx):

getFirefoxExtensions(firefoxEx,outfile)

if os.path.exists(safariEx):

getSafariExtensions(safariEx,outfile)

if os.path.exists(loginItemDir):

getLoginItems(loginItemDir,outfile,ignoreVT)

if os.path.exists(apps_dir):

getApps(apps_dir,outfile,ignoreVT)

if (sipEnabled != 'enabled'):

sipStatus = False

#if SIP is disabled, check for items in /System directory

if sipStatus == False:

print("%s" % "[!!!!!] System Integrity Protection is disabled. Gathering additional data launch agent/daemon data.")

output_list.append(getLaunchAgents('/System/Library/LaunchAgents',outfile))

output_list.append(getLaunchDaemons('/System/Library/LaunchDaemons',outfile,ignoreVT))

output_list.append(getKext(sipStatus,'/System/Library/Extensions',outfile,ignoreVT))

#time.sleep(60)

records_count = len(open(outputPath).readlines( ))

if args.a:

bucket_name, aws_key, aws_secret, aws_region = args.a.split(':')

with open(outputPath, 'r') as oh:

didUpload = s3_upload(oh.read(), 'application/json', '/uploads/' + outputFilename,

aws_key, aws_secret, bucket_name, aws_region)

if didUpload == True:

print("[+] results uploaded to S3 (%s)" % outputFilename)

try:

os.remove(outputPath)

except:

pass

else:

print("[+] results were not uploaded to S3 (%s)" % outputFilename)

script_end = time.time()

total_time = script_end - script_start

print("[***] Venator collection completed in %s seconds. Location of your output file:%s" % (str(total_time),outputPath))

print("[***] Venator collection completed in %s seconds with %s records. Location of your output file:%s" % (str(total_time),str(records_count),outputPath))