lundi 24 octobre 2016

New version of Checkout4Mac (0.2)


Checkout4Mac for what ? 

How to quickly detect recent physical activities on your Mac OS X system? How to detect if someone attempted or succeeded to get an access to your Mac let in your hotel room during your dinner or party ? Just in analysing the system logs and files access dates with bash commands (like grep, find, ls, stat, awk, etc.) ... 

Proof of Concept in Python, CheckOut4Mac, has been developed in order to automate the search and identify malicious activities from 3 questions:
  • When did you leave your hotel room ? eg.: 22/6 
  • At what time did you leave your hotel room ? eg: 22 
  • How long time did you leave your hotel room ? eg: 2 
Several artefacts are exploited to answer to the question and you can check that manually:  http://sud0man.blogspot.fr/2015/05/artefacts-for-mac-os-x.html#2 
or automatically with a POC: https://github.com/sud0man/checkout4mac

HOME MENU



INTERACTIVE MENU





NON-INTERACTIVE MENU


EXTRACTED ACTIVITIES in normal mode


EXTRACTED ACTIVITIES in verbose mode



WHICH ACTIVITIES ARE EXTRACTED ?

[]STARTUP ACTIVITIES

[]SESSION ACTIVITIES

[]PHYSICAL CONNECTION ACTIVITIES

[]ESCALATION PRIVILEGES ACTIVITIES

[]APPLICATIONS ACTIVITIES





[]PERSISTENCE ACTIVITIES

[]NETWORK ACTIVITIES


16 commentaires:

  1. Hey man, thought you'd like a NON-spambot comment here. This is badass work. Bad. Ass. The fact that you share it is way appreciated, too. Just wanted to let you know. Keep up the good work, bro! I don't follow many blogs, but this one I keep an eye on. You're core, homie.

    -Z-

    RépondreSupprimer
  2. Wow its great post me…
    Sell Old Mobile Phones, Tablets & Laptops Online and Get Instant Cash now visit Recycle Device

    RépondreSupprimer
  3. Ce commentaire a été supprimé par son auteur.

    RépondreSupprimer
  4. Great Post....Keep Sharing....
    Looking for urgent sell old laptop online & you can get easy fast cash and best price through Recycle Device website.

    RépondreSupprimer
  5. Nice post thank you for sharing. Printer Tech Support Number 1-800-289-8149 for help you contact.Call us We are 24*7 available. https://www.printertechssupportnumber.com/

    RépondreSupprimer
  6. Nice post thank you for sharing. Antivirus Tech Support Number 1-800-524-2156 for your help.Call us We are 24*7 available. https://www.antivirustechsupports.com/avast-support/

    RépondreSupprimer
  7. Welcome to shopclueswinner.com check your lottery shopclues online lucky draw winner and win a tata safari car and others prize. just call on shopclues online prize department number 91-9835317379.

    Shopclues here thought of an Offer where you can win exceptional Shopclues prize by simply playing a game and win prizes Call @9835317379"
    Shopclues online lucky draw winner
    Shopclues winner 2020
    shopclues car lucky draw

    RépondreSupprimer
  8. Keep it up for more upates about this related blog. Get one of the best SEO Services at OGEN Infosystem the best Digital Marketing Agency in Noida at affordable price.
    SEO Services in Noida

    RépondreSupprimer
  9. Amazing blog, visit Protrek Adventure for Everest Base Camp Trek and Annapurna Base Camp Trek at the best price.
    Everest Base Camp Trek

    RépondreSupprimer
  10. Thanks for this amazing blog. Visit Create N Gift for the special Birthday Gifts for Men and Gifts for Girlfriend in India Online at affordable price.
    Birthday Gifts for Men

    RépondreSupprimer