sheagcraig

#!/usr/bin/python
"""Identify or remove files known to be involved in Adware/Malware
infection.

Most of the code applies to building a list of malware files. Thus,
both extension attribute and removal handling are included.

Cleans files as a Casper script policy; thus, it expects four total
arguments, the first three of which it doesn't use, followed by
--remove

sheagcraig

UninstallLync

According to Microsoft, Lync must be completely uninstalled, following the procedures documented at https://technet.microsoft.com/en-us/library/jj945448(v=office.14).aspx, at least for Calendar functionality to work correctly.

This repo contains a python script for removing all referenced Lync components for all normal users on a machine, i.e., with homes in /Users.

It is somewhat naive in that it assumes the users have not moved the Lync keychain items out of the Login keychain and into some other keychain. It handles the potential for multiple "your.email@domain.com" certificates in the login keychain, however. This is all done by running the security command as a subprocess. Improvements could probably be made to do this all with the Security Framework and the PyObjC bridge, but this gets the job done.

Using UninstallLync in Your Environment

You will need to edit the pattern global APP_PW_PATTERN at the top of the uninstall_lync.py script to look for your environment's email domai

sheagcraig

from Foundation import NSString, NSUTF8StringEncoding
from Security import *


# As per: https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/storing_keys_in_the_secure_enclave?language=objc
# and: https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/generating_new_cryptographic_keys?language=objc#2863927

access = SecAccessControlCreateWithFlags(
    kCFAllocatorDefault, 
    kSecAttrAccessibleWhenUnlockedThisDeviceOnly,

sheagcraig

include /usr/local/share/luggage/luggage.make

TITLE=set_default_outlook
REVERSE_DOMAIN=com.sas
PAYLOAD=\
	pack-outset-login-once-set_outlook_default_handler.py \

PACKAGE_VERSION=1.0.0

sheagcraig

#!/usr/bin/python

# Completely uninstall Office 2016, as per:
# https://support.office.com/en-us/article/Uninstall-Office-2016-for-Mac-eefa1199-5b58-43af-8a3d-b73dc1a8cae3
# and
# https://support.office.com/en-us/article/Troubleshoot-Office-2016-for-Mac-issues-by-completely-uninstalling-before-you-reinstall-ec3aa66e-6a76-451f-9d35-cba2e14e94c0?ui=en-US&rs=en-US&ad=US


import glob
import os

sheagcraig

include /usr/local/share/luggage/luggage.make

TITLE=set_apple_mail_handler
REVERSE_DOMAIN=com.sas
PAYLOAD=\
		pack-usr-local-sas-sas.png \
		pack-script-postinstall \
		pack-outset-on-demand-set_apple_mail_handler.py \

PACKAGE_VERSION=1.0.0

sheagcraig

#!/usr/bin/env python
"""https://twitter.com/krispayne/status/859833552078225408:

@shea_craig is possible with python-jss to generate a list of IP addresses for
computers in the JSS?
"""


from operator import itemgetter

sheagcraig

# https://support.apple.com/en-us/ht203987

# TODO: handle Safari extensions:
# Amazon Shopping Assistant by Spigot Inc.
# Ebay Shopping Assistant by Spigot Inc.
# Searchme by Spigot, Inc.
# Slick Savings by Spigot Inc.
# GoPhoto.It
# Omnibar

sheagcraig

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>_metadata</key>
	<dict>
		<key>created_by</key>
		<string>itadmn</string>
		<key>creation_date</key>
		<date>2016-01-15T14:29:44Z</date>

sheagcraig

#!/usr/bin/python

import ssl

import requests
from requests.adapters import HTTPAdapter
from requests.packages.urllib3.poolmanager import PoolManager
from requests.packages.urllib3.contrib import pyopenssl

#import jss