Scans network shares on macOS about local-log4j-vuln-scanner

[hillu]

@staze With the help of a few colleagues, I think I have found a reliable way to exclude specific filesystems. If a filesystem type is still missing in the code, feel free to open a pull request or reopen this issue. (The output of the mount command would be helpful in that case.)

[hillu]

You'll have to build it as described in the README.

[hillu]

Sure. I suppose we could just determine the fs type for each directory and skip the directory if it's something weird.

The thing is: I have no idea what the actual values on MacOSX are. Could you please run the program (with the problematic paths as command line parameters) and paste its output? Thanks.

package main

import (
	"log"
	"os"
	"syscall"
)

func main() {
	var buf syscall.Statfs_t
	for _, path := range os.Args[1:] {
		if err := syscall.Statfs(path, &buf); err != nil {
			log.Fatalf("statfs: %s: %v", path, err)
		}
		log.Printf("path=%s: type=%08x\n", path, buf.Type)
	}
}

[staze]

ahhh... though this was python but it's actually go.

Here it is against the Data partition (standard Big Sur/Monterey partition):
go run test_path.go /System/Volumes/
2022/01/05 16:09:36 path=/System/Volumes/: type=0000001c

Here it is against a fileshare "GROUPS"
go run test_path.go /System/Volumes/Data/Volumes/GROUPS
2022/01/05 16:11:19 path=/System/Volumes/Data/Volumes/GROUPS: type=0000001e

[hillu]

@staze Could you try the change I just pushed?

[staze]

Hi @hillu I don't see a binary, just the go files. How would I test with those? Sorry...

[staze]

Got it!

Okay, so it ignored one share, then started looking at another. it show as:

2022/01/05 17:05:28 path=/System/Volumes/Data/Volumes/fsdp: type=0000001f

Not sure if you want to just keep adding exceptions though.

[hillu]

Can you build and run the following test program? It's likle the first but should give more output.

package main

import (
	"log"
	"os"
	"syscall"
)

import "C"

func main() {
	var buf syscall.Statfs_t
	for _, path := range os.Args[1:] {
		if err := syscall.Statfs(path, &buf); err != nil {
			log.Fatalf("statfs: %s: %v", path, err)
		}
		log.Printf("path=%s: type=%08x subtype=%08x typename=%s\n", path, buf.Type, buf.Fssubtype,
			C.GoString((*C.char)(&buf.Fstypename[0])))
	}
}

If that does not work, try this:

package main

import (
	"log"
	"os"
	"syscall"
	"unsafe"
)

func main() {
	var buf syscall.Statfs_t
	for _, path := range os.Args[1:] {
		if err := syscall.Statfs(path, &buf); err != nil {
			log.Fatalf("statfs: %s: %v", path, err)
		}
		log.Printf("path=%s: type=%08x subtype=%08x typename=%s\n", path, buf.Type, buf.Fssubtype,
			string((*[16]byte)((unsafe.Pointer(&buf.Fstypename[0])))[:]))
	}
}

[staze]

Sorry for delay, I had left work before last test you gave. running new code now, can confirm it's skipping both afp and smb fileshares. Thanks!