hillu/local-log4j-vuln-scanner

Scans network shares on macOS

staze opened this issue ยท 9 comments

staze commented

Because Apple is dumb, they've placed both the Data partition and network shares in /System/Volumes

Can we add a flag to have it not scan network shares?

hillu commented

Sure. I suppose we could just determine the fs type for each directory and skip the directory if it's something weird.

The thing is: I have no idea what the actual values on MacOSX are. Could you please run the program (with the problematic paths as command line parameters) and paste its output? Thanks.

package main

import (
	"log"
	"os"
	"syscall"
)

func main() {
	var buf syscall.Statfs_t
	for _, path := range os.Args[1:] {
		if err := syscall.Statfs(path, &buf); err != nil {
			log.Fatalf("statfs: %s: %v", path, err)
		}
		log.Printf("path=%s: type=%08x\n", path, buf.Type)
	}
}
staze commented

ahhh... though this was python but it's actually go.

Here it is against the Data partition (standard Big Sur/Monterey partition):
go run test_path.go /System/Volumes/
2022/01/05 16:09:36 path=/System/Volumes/: type=0000001c

Here it is against a fileshare "GROUPS"
go run test_path.go /System/Volumes/Data/Volumes/GROUPS
2022/01/05 16:11:19 path=/System/Volumes/Data/Volumes/GROUPS: type=0000001e

hillu commented

@staze Could you try the change I just pushed?

staze commented

Hi @hillu I don't see a binary, just the go files. How would I test with those? Sorry...

hillu commented

You'll have to build it as described in the README.

staze commented

Got it!

Okay, so it ignored one share, then started looking at another. it show as:

2022/01/05 17:05:28 path=/System/Volumes/Data/Volumes/fsdp: type=0000001f

Not sure if you want to just keep adding exceptions though.

hillu commented

Can you build and run the following test program? It's likle the first but should give more output.

package main

import (
	"log"
	"os"
	"syscall"
)

import "C"

func main() {
	var buf syscall.Statfs_t
	for _, path := range os.Args[1:] {
		if err := syscall.Statfs(path, &buf); err != nil {
			log.Fatalf("statfs: %s: %v", path, err)
		}
		log.Printf("path=%s: type=%08x subtype=%08x typename=%s\n", path, buf.Type, buf.Fssubtype,
			C.GoString((*C.char)(&buf.Fstypename[0])))
	}
}

If that does not work, try this:

package main

import (
	"log"
	"os"
	"syscall"
	"unsafe"
)

func main() {
	var buf syscall.Statfs_t
	for _, path := range os.Args[1:] {
		if err := syscall.Statfs(path, &buf); err != nil {
			log.Fatalf("statfs: %s: %v", path, err)
		}
		log.Printf("path=%s: type=%08x subtype=%08x typename=%s\n", path, buf.Type, buf.Fssubtype,
			string((*[16]byte)((unsafe.Pointer(&buf.Fstypename[0])))[:]))
	}
}
hillu commented

@staze With the help of a few colleagues, I think I have found a reliable way to exclude specific filesystems. If a filesystem type is still missing in the code, feel free to open a pull request or reopen this issue. (The output of the mount command would be helpful in that case.)

staze commented

Sorry for delay, I had left work before last test you gave. running new code now, can confirm it's skipping both afp and smb fileshares. Thanks!