Mac OS X Admin Group User List

#TRUSTED 95f6e9e866147bf3ad0afb104354b6c57904f8693b47330b78a9b2401e0d8b4e9e24beae25aa293ea3ba9c0d0c93e4527f3cb8df6765d24dbdb90f0a61199048808f1bcfa1cd6270e0e682d2c83601471345db4aa66471646bc9da3e5d7797b6bb0c036ec42c343fa68e6d80c9e33fe2b24855389562db51a5a812340622a0bbc184c2deda37e997d5137a57710eea8e062341690d87974184369c923ee7e3c90b62671e59e5db94639383ed30d18a9805a3190e62009a05f9937b6604dce2882cd2e56b20bb4ea192bb18af3c1a2775a8c042bb122f1f178460696649955b21d124b362db6e78c5ab2d39def24cd5e6c405a29bcdbffa50cca766b830921aaa6b36a42f4a03d77d3f4e0036b9671207e6e42d1d80f706599c9306177d28e15082e7170bf0e91a06c81a5edb2bd7f3c6f688438f8b6c4b0bb5391b7337d90e44b90e616b57cd03e1a6f8742c62024bcd5a5e9b5f82c288cc2ac5550faba044ecf0537e476d8a6e3ba6227efd9d71ae9d27e7a0a0fbc974331619ccc44b56c3cdefb60ebfd8a24f6f8e6abf6a6241e609a19366e6c33416b0d878d3f94b49b17bcfb19e0a748a41d2d84c4d42efc0a464dd7cb790b25ac250e0bed39bfad7eca60fe4f528f999a56b2bcf58e87b0c838e25d306335cd73d415885c3f0b81e7ee10d6fee9bd836cf87a58abc039bd022482b2661b5d3e297daed9ea6cd4139cb6e
#TRUST-RSA-SHA256 5ef071c9b6a2996c8daa75da8ece2b6b4227e634dd2f13d2ecec834f11770c736b096665c6666e23e1d93efa0ce913a960025284c2365441147e553218520c390cfa2ce29533e06465bdbca122ed05fffbad22f0fbf2acc3fe346145558bd5c40457a1b4af098db047f0eb2dd36678caca9a999ddbe6a00abbb7ac547806ae9837a7aae786960a0c903a98f8dc2ab03087cee7f40229a829f60790073f9f4270747a5b447cc2e61dd26d717cbd5d38b6a9ed4ea9cb1ef6a487d45e5d076d601c354006c758b20030e782b8c1972413e210f833ed2f32fed2da48375acee9f85c2741d8bc23b99cd014d18f521cd9837888929fda695cf9a624f205b0ce5b293b114398c37be669b8773623c3ef810c54ae2e72070160fe68b49dc2e8a590338aff11946ca086c91f489d63f420657be33285d100951823a2449bc97b8be9fc6fba22f868222e931e747bc1ad15f719ee6834ad3da0521c28a21bae45ea3bb074216f442e12b4cf6b939512f9931d05e357c2d42bd42c4d3cf9b2c18b45d2ac4b63d71597f573714992e45aba87c8aeb8676649fe569d6c04a2730c31e1abd9c585d674675cc4aa2937cf4212a1c377eb2ae01864ed08aba333add4d48089fadcfe5926b9417bbfa7c45f36616d1c54c45ce93db2e9cd38bb7151ed7c12add82ba79f7196990218a41bf612a991f03af977410a2076d87b7c2427026ea80c736c
#
# (C) Tenable Network Security, Inc.
#

if (!defined_func("bn_random")) exit(0);
if (NASL_LEVEL < 3000) exit(0);

include("compat.inc");

if (description)
{
  script_id(60019);
  script_version("1.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/21");

  script_name(english:"Mac OS X Admin Group User List");
  script_summary(english:"Lists users that are in special groups.");

  script_set_attribute(attribute:"synopsis", value:
"There is at least one user in the 'Admin' group.");
  script_set_attribute(attribute:"description", value:
"Using the supplied credentials, Nessus was able to extract the member
list of the 'Admin' and 'Wheel' groups. Members of these groups have
administrative access to the remote system.");
  script_set_attribute(attribute:"solution", value:
"Verify that each member of the group should have this type of access.");
  script_set_attribute(attribute:"risk_factor", value:"None");

  script_set_attribute(attribute:"plugin_publication_date", value:"2012/07/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2012-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version");

  exit(0);
}

include("global_settings.inc");
include("misc_func.inc");
include("ssh_func.inc");
include("macosx_func.inc");
include("data_protection.inc");
include('command_builder.inc');

enable_ssh_wrappers();

if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");

var os, cmd, res, info, info2, count, blocks, pattern, block, matches, user, report;

os = get_kb_item("Host/MacOSX/Version");
if (!os) exit(0, "The host does not appear to be running Mac OS X.");

cmd = "echo ; /usr/bin/dscl . -readall /Groups GroupMembership";

res = exec_cmd(cmd:cmd);

info = '';
info2 = '';

count = 0;
if (!isnull(res))
{
  blocks= split(res, sep:'-\n', keep:FALSE);
 
  pattern = '^(GroupMembership: (.*) )?RecordName: (.*)';
  foreach block (blocks)
  {
    block = str_replace(find:'\n', replace:' ', string:block);

    if ('RecordName: admin' >< block)
    {
      matches = eregmatch(string:block, pattern:pattern);
      if (!isnull(matches))
      {
        if (matches[2] != 'unknown')
        {
          foreach user (split(matches[2], sep:' ', keep:FALSE))
          {
            # Check user for unexpected chars
            if (!command_builder::validate_no_injection_denylist(user))
            {
              dbg::detailed_log(lvl:1, msg:'Continue due to injection attempt in User enumeration',
                  msg_details:{
                    'enumerated user':{'lvl':1, 'value':user}
                  }
              );
              continue;
            }

            count += 1;
            set_kb_item(name:"SSH/LocalAdmins/Members/"+count, value:user);
            user = data_protection::sanitize_user_enum(users:user);
            info += '  - ' + user + '\n';
          }
        }
      }
    }
    if ('RecordName: wheel' >< block)
    {
      matches = eregmatch(string:block, pattern:pattern);
      if (!isnull(matches))
      {
        if (matches[2] != 'unknown')
        {
          foreach user (split(matches[2], sep:' ', keep:FALSE))
          {
            # Check user for unexpected chars
            if (!command_builder::validate_no_injection_denylist(user))
            {
              dbg::detailed_log(lvl:1, msg:'Continue due to injection attempt in User enumeration',
                  msg_details:{
                    'enumerated user':{'lvl':1, 'value':user}
                  }
              );
              continue;
            }

            count += 1;
            set_kb_item(name:"SSH/LocalAdmins/Members/"+count, value:user);
            user = data_protection::sanitize_user_enum(users:user);
            info2 += '  - ' + user + '\n';
          }
        }
      }
    }
  }
}

if (info || info2)
{
  if (info)
  {
    if (max_index(split(info)) == 1)
      report = '\nThe following user is a member';
    else
      report = '\nThe following users are members';

    report =
      report + ' of the \'Admin\' group :\n' +
      chomp(info) + '\n';
  }

  if (info2)
  {
    if (max_index(split(info2)) == 1)
      report += 
        '\nThe following user is a member';
    else
      report += 
        '\nThe following users are members';

    report =
      report + ' of the \'Wheel\' group :\n' +
      chomp(info2) + '\n';
  }
      
  security_note(port:0, extra:report);
}
else exit(0, 'No members of the \'Admin\' or \'Wheel\' groups were found on the remote host.');