richiercyrus / venator Goto Github PK

Encountered this issue when running Venator on macOS 10.14.4 and current Chrome version (74.0.3729.131):

[+] Gathering Chrome Extensions data.
Traceback (most recent call last):
  File "Venator.py", line 728, in <module>
    getChromeExtensions(chromeEx,outfile)
  File "Venator.py", line 308, in getChromeExtensions
    extensions.update({"extension_update_url":manifest_json.get("update_url").strip('u\'')})
AttributeError: 'NoneType' object has no attribute 'strip'

getting error below:

$ python -V
Python 2.7.16
$ sudo /usr/bin/python ./Venator.py
Password:
\

\ \ / /__ _ __ __ | | ___ _ __
\ \ / / _ \ '_ \ / ` | / _ | '|
\ V / __/ | | | (| | || () | |
_/ ___|| ||_,|____/|_|

[+] Gathering users on the system.
[+] Gathering System Intergrity Protection status.
[+] Getting system information.
[+] Gathering Install History data.
[+] Gathering Gatekeeper status.
[+] Gathering current network connections.
[+] Gathering Environment Variables.
[+] Gathering Periodic Scripts.
[+] Gathering current cron jobs.
[+] Gathering Emond Rules.
[+] Gathering Launch Agent data.
[+] Gathering any shell startup scripts ('~/.bash_profile', etc.)
[+] Gathering Launch Daemon data.
[+] Gathering Kernel Extensions data.
[+] Gathering Applications for each user.
[+] Gathering installed Event Taps.
[+] Gathering Bash History data.
[+] Gathering Launch Agent data.
Traceback (most recent call last):
File "./Venator.py", line 725, in
getLaunchAgents(userLaunchAgent,outfile)
File "./Venator.py", line 231, in getLaunchAgents
parsedAgent.update({"module":"launch_agents"})
AttributeError: 'NoneType' object has no attribute 'update'

Adding a requirements.txt file to have the ability to execute pip to install the required packages:

pip install -r requirements.txt

Most of the libraries are standard python libraries but others are not:
os
datetime
logging
math
sys
plistlib
string
struct
xml.parsers.expat
subprocess
json
socket
Foundation
Quartz
argparse
ctypes
ctypes.util
objc
platform
time
hashlib

This is also running on python2.

Here's the output:

[+] Gathering Kernel Extensions data.
Traceback (most recent call last):
  File "~/.local/bin/Venator.py", line 620, in <module>
    getLaunchDaemons('/Library/LaunchDaemons',outfile),getKext(sipStatus,'/Library/Extensions',outfile),getApps('/Applications',outfile),getEventTaps(outfile),getBashHistory(outfile,lst_of_users)]
  File "~/.local/bin/Venator.py", line 384, in getKext
    kextPlist = plistlib.readPlist(os.path.join(root, name))
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/plistlib.py", line 78, in readPlist
    rootObject = p.parse(pathOrFile)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/plistlib.py", line 406, in parse
    parser.ParseFile(fileobj)
xml.parsers.expat.ExpatError: not well-formed (invalid token): line 1, column 8

Hi, I'm getting this error when running the script on MacOS Mojave. Thanks for your help

`[+] Gathering users on the system.

[+] Gathering System Intergrity Protection status.

[+] Getting system information.

[+] Gathering Install History data.

[+] Gathering Gatekeeper status.

[+] Gathering current network connections.

[+] Gathering Environment Variables.

[+] Gathering Periodic Scripts.

[+] Gathering current cron jobs.

[+] Gathering Emond Rules.

[+] Gathering Launch Agent data.

[+] Gathering Launch Daemon data.

[+] Gathering Kernel Extensions data.

[+] Gathering Applications for each user.

[+] Gathering installed Event Taps.

[+] Gathering Bash History data.

[+] Gathering Launch Agent data.

[+] Gathering Chrome Extensions data.

[+] Gathering Firefox Extensions data.

[+] Gathering Safari Extensions data.

[+] Gathering Login Items for each user.

[+] Gathering Applications for each user.

[+] Gathering Launch Agent data.

[+] Gathering Chrome Extensions data.

[+] Gathering Firefox Extensions data.

[+] Gathering Applications for each user.

[!!!!!] System Integrity Protection is disabled. Gathering additional data launch agent/daemon data.

[+] Gathering Launch Agent data.

[+] Gathering Launch Daemon data.

Traceback (most recent call last):

File "./Venator.py", line 674, in

output_list.append(getLaunchDaemons('/System/Library/LaunchDaemons',outfile))

File "./Venator.py", line 220, in getLaunchDaemons

parsedDaemon = parseAgentsDaemons(daemon,path)

File "./Venator.py", line 194, in parseAgentsDaemons

parsedPlist.update({"signing_info":checkSignature(progExecutable)})

UnboundLocalError: local variable 'progExecutable' referenced before assignment`

Could you add the host UUID as an additional field along with the hostname? I have found hostnames can change more often then I would like, which can make correlating data across different runs over a longer period of time a bit complicated.

Thank you!