Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature Request: Add GlobalLoginItems plist to LoginItems enumeration #11

Open
D00MFist opened this issue May 21, 2021 · 1 comment
Open

Comments

@D00MFist
Copy link

D00MFist commented May 21, 2021

Feature Request: to expand existing loginitem enumeration to also include login items written using Launch Services Framework specifying all users ($.kLSSharedFileListGlobalLoginItems).
This is the method within the Apfell agent of Mythic
Example standalone JXA script adapted from Apfell agent:

testLogItem.js

function loginitem() {
    ObjC.import('CoreServices');
    ObjC.import('Security');
    ObjC.import('SystemConfiguration');
    let auth;
    let result = $.AuthorizationCreate($.nil, $.nil, $.kAuthorizationDefaults, Ref(auth));
    if (result === 0) {
        let temp = $.CFURLCreateFromFileSystemRepresentation($.kCFAllocatorDefault, '/Applications/Safari.app/Contents/MacOS/Safari', '/Applications/Safari.app/Contents/MacOS/Safari'.length, false);
        let items = $.LSSharedFileListCreate($.kCFAllocatorDefault, $.kLSSharedFileListGlobalLoginItems, $.nil);
        $.LSSharedFileListSetAuthorization(items, auth);
        let cfName = $.CFStringCreateWithCString($.nil, 'WebTest', $.kCFStringEncodingASCII);
        let itemRef = $.LSSharedFileListInsertItemURL(items, $.kLSSharedFileListItemLast, cfName, $.nil, temp, $.nil, $.nil);
        return {"user_output": "LoginItem installation successful", "completed": true};
    } else {
        return {"user_output": `LoginItem installation failed: AuthorizationCreate returned ${result}`, "completed": true};
    }
};
loginitem()

When this method is used the GlobalLoginItems.sfl2 is saved to and not backgrounditems.btm like in other instances.
If you replace the items line with the following (specifying current session) then the backgrounditems.btm is modified.

let items = $.LSSharedFileListCreate($.kCFAllocatorDefault, $.kLSSharedFileListSessionLoginItems, $.nil);

Also ~/Library/Application\ Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.GlobalLoginItems.sfl2 appears to be formatted similarly to ~/Library/Application\ Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm.

@x13a
Copy link

x13a commented Dec 18, 2021

com.apple.LSSharedFileList.GlobalLoginItems.sfl2 is protected, you can not get raw access by default, but using API: LSSharedFileListCreate.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants