Function Main

osxauditor.py:1576–1694

Here we go

()

        HTML_LOG_CONTENT += HTML_EVENTS_TL

def Main():
    ''' Here we go '''

    global ROOT_PATH
    global HTML_LOG_FILE
    global HOSTNAME
    global GEOLOCATE_WIFI_AP
    global OSX_VERSION

    HOSTNAME = socket.gethostname()
    Euid = str(os.geteuid())
    Egid = str(os.getegid())

    Parser = optparse.OptionParser(usage='usage: %prog [options]\n' + __description__ + ' v' + __version__, version='%prog ' + __version__)
    Parser.add_option('-p', '--path', dest='RootPath', help='Path to the OS X system to audit (e.g. /mnt/xxx). The running system will be audited if not specified')
    Parser.add_option('-t', '--txtoutput', dest='TxtLogFile', help='Path to the txt output log file')
    Parser.add_option('-H', '--htmloutput', dest='HTMLLogFile', help='Path to the HTML output log file')
    Parser.add_option('-z', '--ziplogs', dest='ZipLogsFile', help='Create a zip file containing all system and users\' logs. Path to directory to put the zip file in')
    Parser.add_option('-S', '--syslog', dest='SyslogServer', default=False, help='Syslog server to send the report to')
    Parser.add_option('-a', '--all', action='store_true', default=False, help='Analyze all (it is equal to -qsidbAkUe)')
    Parser.add_option('-q', '--quarantines', action='store_true', default=False, help='Analyze quarantined files')
    Parser.add_option('-s', '--startup', action='store_true', default=False, help='Analyze startup agents and daemons ')
    Parser.add_option('-i', '--installedapps', action='store_true', default=False, help='Analyze installed applications')
    Parser.add_option('-d', '--downloads', action='store_true', default=False, help='Analyze downloaded files ')
    Parser.add_option('-b', '--browsers', action='store_true', default=False, help='Analyze browsers (Safari, FF & Chrome) ')
    Parser.add_option('-A', '--airportprefs', action='store_true', default=False, help='Analyze Airport preferences ')
    Parser.add_option('-g', '--wifiapgeolocate', action='store_true', default=False, help='Tries to geolocate WiFi AP found in AirportPrefs using Geomena.org')
    Parser.add_option('-k', '--kext', action='store_true', default=False, help='Analyze kernel extensions (kext) ')
    Parser.add_option('-U', '--usersaccounts', action='store_true', default=False, help='Analyze users\' accounts ')
    Parser.add_option('-e', '--eventlogs', action='store_true', default=False, help='Analyze system event logs')
    Parser.add_option('-m', '--mrh', action='store_true', default=False, help='Perform a reputation lookup in Team Cymru\'s MRH')
    Parser.add_option('-v', '--virustotal', action='store_true', default=False, help='Perform a lookup in VirusTotal database.')
    Parser.add_option('-l', '--localhashesdb', dest='LocalDatabase', default=False, help='Path to a local database of suspicious hashes to perform a lookup in')

    (options, args) = Parser.parse_args()

    if sys.version_info < (2, 7) or sys.version_info > (3, 0):
        PrintAndLog(u'You must use python 2.7 or greater but not python 3', 'ERROR')                        # This error won't be logged
        exit(1)

    if options.RootPath:
        ROOT_PATH = options.RootPath

    if options.TxtLogFile:
        logging.basicConfig(filename=options.TxtLogFile, filemode='w', level=logging.DEBUG)

    if options.SyslogServer:
        SyslogSetup(options.SyslogServer)

    if options.HTMLLogFile:
        try:
            HTML_LOG_FILE = codecs.open(options.HTMLLogFile, 'w', 'utf-8')
        except (IOError):
            PrintAndLog(u'Cannot open ' + options.HTMLLogFile.decode('utf-8') + u'\n', 'ERROR')
        except:
            PrintAndLog(u'HTML Log setup failed, HTML Log is disabled ', 'ERROR')
            HTML_LOG_FILE = False