pudquick

#include <CoreFoundation/CoreFoundation.h>

CFPropertyListRef _CFPreferencesCopyApplicationMap(CFStringRef userName, CFStringRef hostName);

int main()
{
	CFPropertyListRef app_map;

	app_map = _CFPreferencesCopyApplicationMap(kCFPreferencesCurrentUser, kCFPreferencesAnyHost);

pudquick

app_map

pudquick

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>dsAttrTypeStandard:AppleMetaNodeLocation</key>
	<array>
		<string>/Local/Default</string>
	</array>
	<key>dsAttrTypeStandard:AuthenticationAuthority</key>
	<array>

pudquick

# You need to add these two lines to your bash environment

shopt -s histappend
export PROMPT_COMMAND="${PROMPT_COMMAND:+$PROMPT_COMMAND$'\n'}history -a; history -c; history -r"

# In most *nix variants, that means adding them to your .bashrc file.
# However, on OS X, the default session for Terminal is a login session,
# meaning that it doesn't run .bashrc.
# As such, you'll need to include these commands into your
# .profile or .bash_profile (whichever you have/want).

pudquick

# This expects that you're already running as sudo'd / root account 

cat <<EOF | security -i
authorize -C adminUserNameHere com.apple.uninstalld.uninstall
execute-with-privileges /usr/sbin/uninstall /Applications/SomeMASapp.app
EOF

# In the example above, if you're already running as root / sudo'd admin,
# you still get a prompt for the password of the account in question.
# We aren't dodging proving we know the password - we're just doing it

pudquick

A study of the 'com.apple.uninstalld.uninstall' right

From /System/Library/Security/authorization.plist:

<key>com.apple.uninstalld.uninstall</key>
<dict>
    <key>class</key>
    <string>rule</string>

pudquick

Downloads:

• Xcode command line tools (https://developer.apple.com/downloads/)
• Packages (http://s.sudre.free.fr/Software/Packages/about.html)
• XQuartz (http://xquartz.macosforge.org/landing/)
• libpng and libjpeg combo package (http://ethan.tira-thompson.com/Mac_OS_X_Ports.html)
• Mercurial aka 'hg' command (http://mercurial.selenic.com/downloads)
• Each of the following SDL 1.2 frameworks:
• SDL: https://www.libsdl.org/download-1.2.php
• SDL_ttf: https://www.libsdl.org/projects/SDL_ttf/release-1.2.html (Download will say 2.x, but it's still for 1.2)

pudquick

import base64, hashlib
from ctypes import CDLL, POINTER, Structure, create_string_buffer, byref
from ctypes.util import find_library

Security = CDLL(find_library('Security'))
# Importing this via C because haven't figured out how to mix in pyObjc version yet
c_CoreFoundation = CDLL(find_library('CoreFoundation'))

class OpaqueType(Structure):
    pass

pudquick

IFJS_IFDContext
IFJS: Package Authoring Error: system.run()/runOnce() require <options allow-external-scripts='yes'/>
IFJS: Path for embedded script %s not available
IFJS: Error while running task %s %s
IFJS: %s: Error getting process info for PSN %d:%d
IFJS: *** exception: %s
IFJS: choices delegate must respond to allChoices and choiceForIdentifier:
IFJS: Package Authoring Error: access to path "%s" requires <options allow-external-scripts='true'>
IFJS: Failed to stat root path %s (%s)
_IFJS_IFDCustomizationItemClassDefinition

pudquick

$TESTREG = "SOFTWARE\\Adobe\\Adobe ARM\\1.0\\ARM"
$TESTKEY = "iCheck"
$IPS = Get-Content 'C:\Users\yourname\Desktop\ips.txt'
$OUTPUT = 'C:\Users\yourname\Desktop\ips_log.txt'

function GetName($ipaddr) {
    # Resolve a computer name if we can
    try {
        [System.Net.Dns]::GetHostByAddress($ipaddr).HostName
    } catch [System.Exception] {