daguy666 / transit Goto Github PK

MacOS incident Response Toolkit. Mostly written while stuck on a NJTransit train.

License: MIT License

Python 100.00%

transit's Introduction

Transit

Transit is a MacOS IR tool kit that I've been writing while on the train. Most of the time this is done while delayed.

======================================================================

         ___________________________. .___________________________.
     .--/____|______________________| |___|||||___|_|____|_|___ --|
     |    |-|                    | |=| |          |_|    |-|      |
     |  __|-|____________________|_|=|_|__________|_|____|-|__.   |
     |_/<_>=<_>\_________/<_>=<_>\_|=|_|<_>=<_>|_____|<_>=<_>|____|
=====================================================================

Transit can pull the following information from a system.

1. Run a full informational scan:
2. Gather preference lists for all users:
3. Gather preference lists for one user:
4. Gather all Root level preference lists: (May require root)
5. Tar up log directories:
6. Gather system information:

Well return a series of information about the system itself.
This option will return the plists for all users
Option 3 will return plists for one user
This will return all of the root level plists
This feature will currently zip up the root log directory
Gather system info.

Installation

Libaries to install

termcolor
biplist

pip install -r requirements.txt

helper.py has a class Gather_System_Info() this class will be the most heavily used class in this code. This is what will be used to shell out and run any system info retreival. Ideally I would like to stick to python libraries to call this data. But once in a while we need to shell out to obtain the data or result we are looking for. Anytime we call shell_cmd() from the Gather_System_Info() class we log the command ran to disk. By default this will log to ./logging/incidentR.log

There is still a lot of work that needs to get done. So send over a pull request if interested in helping out.

transit's People

Contributors

Stargazers

Watchers

Forkers

securycore awesome-security edmichael peet47 kartikeyap opexxx irasekh3

transit's Issues

feature request

Monitor atq

Running atq will dump the at tasks for the logged in user.

Iterate over all the users and run atq

Example:

❯ echo 'open ~' | at now +10 minutes                                                                                                                                                                         ─╯
job 1 at Wed Feb 17 18:55:00 2021


❯ atq                                                                                                                                                                                                        ─╯
1	Wed Feb 17 18:55:00 2021

document the libraries that may need to be installed.

For this to be complete a section needs to be added to list the prerequisites.

Identify and return the boot history

The following bash commands

$ last reboot
reboot    ~                         Fri Jan  5 19:30
reboot    ~                         Thu Sep 28 14:08
reboot    ~                         Thu Sep 28 12:53

wtmp begins Thu Sep 28 12:53

$ last shutdown
shutdown  ~                         Thu Jan 25 22:51

wtmp begins Wed Jan 24 20:23

Apply these to the Transit/utils/helper.py in the Gather_System_Info() Class
They can be broken down into two methods or one, no preference.

Build functionality that you can aim at a disk image.

Write up a feature to aim at a different directory. Suppose you mount a disk image and you want to run this against a different target or directory.

/Volumes/dfir_image

Add support for tmux

Write a method to check for any tmux sessions.

Add some error checking for

git/Transit $ tmux
-bash: tmux: command not found

Return an exception if command not found.

Add support for Mojave

Fix:

In utils/versions.py add support for os version mojave.

Something like

{'mojave': ['10.14.0',
            '10.14.1',
            '10.14.2',
            '10.14.3',
            '10.14.4',
            '10.14.5',
            '10.14.6',
            '10.14.7']
}

Listing wireless networks

If en0 is not the default wireless interface.

Traceback (most recent call last):
  File "./main.py", line 73, in <module>
    IS.main()
  File "/Users/<username>/git/Transit/utils/info_scan.py", line 48, in main
    self.build_up_system_info()
  File "/Users/<username>/git/Transit/utils/info_scan.py", line 41, in build_up_system_info
    for wifi in self.gsi.return_wireless_networks():
TypeError: 'NoneType' object is not iterable

Fix this bug when importing utils/helper.py

Python 2.7.10 (default, Aug 17 2018, 19:45:58)
[GCC 4.2.1 Compatible Apple LLVM 10.0.0 (clang-1000.0.42)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import helper
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "helper.py", line 7, in <module>
    from logger import LOGGER
  File "logger.py", line 10, in <module>
    LOG2FILE = logging.FileHandler('./log/incidentR.log')
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/logging/__init__.py", line 911, in __init__
    StreamHandler.__init__(self, self._open())
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/logging/__init__.py", line 941, in _open
    stream = open(self.baseFilename, self.mode)
IOError: [Errno 2] No such file or directory: '/Users/daguy666/git/Transit/utils/log/incidentR.log'

the path should be /Users/<username>/git/Transit/log/incidentR.log