You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Feature Request: to expand existing loginitem enumeration to also include login items written using Launch Services Framework specifying all users ($.kLSSharedFileListGlobalLoginItems).
This is the method within the Apfell agent of Mythic
Example standalone JXA script adapted from Apfell agent:
testLogItem.js
function loginitem() {
ObjC.import('CoreServices');
ObjC.import('Security');
ObjC.import('SystemConfiguration');
let auth;
let result = $.AuthorizationCreate($.nil, $.nil, $.kAuthorizationDefaults, Ref(auth));
if (result === 0) {
let temp = $.CFURLCreateFromFileSystemRepresentation($.kCFAllocatorDefault, '/Applications/Safari.app/Contents/MacOS/Safari', '/Applications/Safari.app/Contents/MacOS/Safari'.length, false);
let items = $.LSSharedFileListCreate($.kCFAllocatorDefault, $.kLSSharedFileListGlobalLoginItems, $.nil);
$.LSSharedFileListSetAuthorization(items, auth);
let cfName = $.CFStringCreateWithCString($.nil, 'WebTest', $.kCFStringEncodingASCII);
let itemRef = $.LSSharedFileListInsertItemURL(items, $.kLSSharedFileListItemLast, cfName, $.nil, temp, $.nil, $.nil);
return {"user_output": "LoginItem installation successful", "completed": true};
} else {
return {"user_output": `LoginItem installation failed: AuthorizationCreate returned ${result}`, "completed": true};
}
};
loginitem()
When this method is used the GlobalLoginItems.sfl2 is saved to and not backgrounditems.btm like in other instances.
If you replace the items line with the following (specifying current session) then the backgrounditems.btm is modified.
let items = $.LSSharedFileListCreate($.kCFAllocatorDefault, $.kLSSharedFileListSessionLoginItems, $.nil);
Also ~/Library/Application\ Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.GlobalLoginItems.sfl2 appears to be formatted similarly to ~/Library/Application\ Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm.
The text was updated successfully, but these errors were encountered:
Feature Request: to expand existing loginitem enumeration to also include login items written using
Launch Services Framework
specifying all users ($.kLSSharedFileListGlobalLoginItems
).This is the method within the
Apfell
agent of MythicExample standalone JXA script adapted from
Apfell
agent:testLogItem.js
When this method is used the
GlobalLoginItems.sfl2
is saved to and notbackgrounditems.btm
like in other instances.If you replace the
items
line with the following (specifying current session) then thebackgrounditems.btm
is modified.Also
~/Library/Application\ Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.GlobalLoginItems.sfl2
appears to be formatted similarly to~/Library/Application\ Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm
.The text was updated successfully, but these errors were encountered: