cvlong

import datetime
import json
import requests
from requests_oauthlib import OAuth2Session
from oauthlib.oauth2 import BackendApplicationClient

from config import client_id, client_secret, refresh_token


def run():

pudquick

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>PayloadDisplayName</key>
			<string>Privacy Preferences Policy Control</string>
			<key>PayloadIdentifier</key>

zrzka

#!python3

from ctypes import c_int, c_void_p, POINTER, byref, c_ulong
from objc_util import (
    load_framework, c, ns, ObjCInstance, nsdata_to_bytes, NSString, NSData, NSNumber,
    ObjCClass, NSArray, NSDictionary
)
from enum import Enum, IntFlag
from typing import Union
import datetime

ygini

Reversing 10.13 RootGate, hands notes

Inital discovery process

Original state of the root.plist

Dict {
    smb_sid = Array {
        S-1-5-18

bruienne

sudo /usr/libexec/PlistBuddy -x -c 'Print :ShadowHashData' /var/db/dslocal/nodes/Default/users/root.plist | awk '/\t[^\<]/{print $1}' | base64 -D | plutil -convert xml1 -o - -- - | python -c 'import plistlib; import sys; plist = plistlib.readPlistFromString(sys.stdin.read()); print plist["SALTED-SHA512-PBKDF2"]["iterations"]'

rkitover

diff -ruN Python-3.6.3.orig/setup.py Python-3.6.3.new/setup.py
--- Python-3.6.3.orig/setup.py	2017-10-02 22:52:02.000000000 -0700
+++ Python-3.6.3.new/setup.py	2017-11-16 13:35:45.000000000 -0800
@@ -811,10 +811,15 @@
         exts.append( Extension('_socket', ['socketmodule.c'],
                                depends = ['socketmodule.h']) )
         # Detect SSL support for the socket module (via _ssl)
+        openssl_root = os.getenv('OPENSSL_ROOT')
+
         search_for_ssl_incs_in = [

pudquick

#!/usr/bin/python
approved_UUIDs     = ['your-beacon-UUID-here'] # see line 64
path_to_lock_sound = '/Users/frogor/Desktop/car_lock.m4a'
path_to_warn_sound = '/Users/frogor/Desktop/viper_warning.m4a'

import time
import objc
from objc import NO
from Foundation import NSBundle, NSClassFromString, NSObject, NSRunLoop, NSDate, NSUUID, NSMakeRange, NSURL
from AVFoundation import AVAudioPlayer

pudquick

from subprocess import Popen, PIPE, STDOUT, check_output
from mimetools import Message
from StringIO import StringIO
from urlparse import urlparse, parse_qs
from urllib import quote, basejoin, urlencode

DEV_SITE  = 'https://developer.apple.com'
AUTH_SITE = 'https://idmsa.apple.com'
AUTH_PATH = '/IDMSWebAuth/authenticate'
APPIDKEY_PATH = "/services-account/download?path=%s"

pudquick

import objc
from Foundation import NSBundle

IOKit = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit')

functions = [("IOServiceGetMatchingService", b"II@"),
             ("IOServiceMatching", b"@*"),
             ("IORegistryEntryCreateCFProperties", b"IIo^@@I"),
             ("IOPSCopyPowerSourcesByType", b"@I"),
             ("IOPSCopyPowerSourcesInfo", b"@"),

pudquick

# Using: https://developer.apple.com/library/mac/documentation/Cocoa/Reference/ObjCRuntimeRef
# Thank you to this for inspiration: https://github.com/MacLeek/trackmac/blob/master/trackmac/cocoa.py

import objc
from ctypes import CDLL, c_void_p, byref, c_char_p
from ctypes.util import find_library
from Foundation import NSMutableArray

Security = CDLL(find_library("Security"))
AuthorizationRightGet = Security.AuthorizationRightGet