bruienne

sudo /usr/libexec/PlistBuddy -x -c 'Print :ShadowHashData' /var/db/dslocal/nodes/Default/users/root.plist | awk '/\t[^\<]/{print $1}' | base64 -D | plutil -convert xml1 -o - -- - | python -c 'import plistlib; import sys; plist = plistlib.readPlistFromString(sys.stdin.read()); print plist["SALTED-SHA512-PBKDF2"]["iterations"]'

evgenius

#!/bin/bash
#
# Watch current directory (recursively) for file changes, and execute
# a command when a file or directory is created, modified or deleted.
#
# Written by: Senko Rasic <senko.rasic@dobarkod.hr>
#
# Requires Linux, bash and inotifywait (from inotify-tools package).
#
# To avoid executing the command multiple times when a sequence of

pudquick

# This code must run as root

# We're mixing ObjC and C-style dylibs, so this is really fun
# The only reason we're doing this is that the OS is _really really_ picky about trying to do
# ANYTHING with the CoreStorage Family Properties CFDictionary that's in-memory EXCEPT for
# making a mutable copy of it.

# Once we've done that, we can bring it into pyObjC to play nicely with the data.

import objc

pudquick

import objc
packagekit_bundle = objc.loadBundle('PackageKit', module_globals=globals(), bundle_path='/System/Library/PrivateFrameworks/PackageKit.framework', scan_classes=False)
PKReceipt = objc.lookUpClass('PKReceipt')

receipts = PKReceipt.receiptsOnVolumeAtPath_('/')

first_receipt = receipts[0]

# Things you can look up:
# installPrefixPath

pudquick

import sys, os, os.path, tempfile, plistlib, shutil, marshal, subprocess, pickle, textwrap

class TempApp(object):
    _skeleton_app = textwrap.dedent("""
                      import sys, marshal, types, pickle
                      main_func_marshal = %s
                      args_pickle       = %s
                      code = marshal.loads(main_func_marshal)
                      main_func = types.FunctionType(code, globals(), "main_func")
                      args = dict(pickle.loads(args_pickle))

pudquick

from CoreFoundation import CFPreferencesCopyAppValue, CFPreferencesSetAppValue, CFPropertyListCreateDeepCopy, kCFPropertyListMutableContainersAndLeaves, CFPreferencesAppSynchronize

folder_to_add = u'/Abosulte/Path/To/Folder'

desktop_settings = CFPreferencesCopyAppValue('DSKDesktopPrefPane', 'com.apple.systempreferences') or dict()

mutable_desktop_settings = CFPropertyListCreateDeepCopy(None, desktop_settings, kCFPropertyListMutableContainersAndLeaves)

folder_paths = mutable_desktop_settings.get('UserFolderPaths', list())

pudquick

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>PayloadDisplayName</key>
			<string>Privacy Preferences Policy Control</string>
			<key>PayloadIdentifier</key>

pudquick

import objc
from Foundation import NSBundle

CG_bundle = NSBundle.bundleWithIdentifier_('com.apple.CoreGraphics')

functions = [("CGSSessionCopyAllSessionProperties", b"@"),]

objc.loadBundleFunctions(CG_bundle, globals(), functions)

# example usage: graphical_security_sessions = CGSSessionCopyAllSessionProperties()

pudquick

# Based on: https://developer.apple.com/library/mac/documentation/Cocoa/Conceptual/URLLoadingSystem/Tasks/UsingNSURLConnection.html#//apple_ref/doc/uid/20001836-SW5

from gurl import *
from Foundation import NSData, NSString

class Purl(Gurl):
    '''A POST variant of Gurl'''
    def initWithOptions_(self, options):
        '''Set up our Purl object'''
        # Inherit our basic setup from Gurl

pudquick

import os.path, base64
from ctypes import CDLL, Structure, POINTER, byref, addressof, create_string_buffer, c_int, c_uint, c_ubyte, c_void_p, c_size_t
from CoreFoundation import kCFStringEncodingUTF8

# Wheee!
Security    = CDLL('/System/Library/Frameworks/Security.Framework/Versions/Current/Security')
# I don't use the pyObjC CoreFoundation import because it attempts to bridge between CF, NS, and python.
# When you try to mix it with Security.Foundation (pure C / CF), you get nasty results.
# So I directly import CoreFoundation to work with CFTypes to keep it pure of NS/python bridges.
CFoundation = CDLL('/System/Library/Frameworks/CoreFoundation.Framework/Versions/Current/CoreFoundation')