Mac OS X Wireless Networks List

#TRUSTED 35be9a79d49981473ac7d0c11c32a15f6933006be441efff6fbdc4ab7a745569c84df392c4b1bbe76fe84972521e7cb1c7e7b9874ce83fdd836740f11fad339344a3a23ad476eda53c47696fee4cae67bb999effdc299f505a794c6b373d196813716c18c5104f3b3e7ee70133a0979112c3fb3ba1328aeeaec6a83ac6869e300f6775861d7df0e1654779e94a55c5e82a6bc09306aedf3c60c60acc23b36983d10b14225851c6ad9107ee497445e3439c2793f15712d340f0da4cae0986638b52a57fc215c4aedd07202bb39a60253526f71697d8d66654ffe4b90f1c46b0a37eb77b675c8d754683a725d16b6a389b13e94949670993392c385a8f079b2ecc9fac0e7d6c7d3f4268b5ff7eac865c180abbcdce30dd6f9804c70b55bb2c635e57fb11ac10f453547e70ad5dbe1211fef53cf5236cbab995859d05cf8a5938dbbcdbc6b9ccaf12eb16c0fbcaf33236a2f2b1c2bc80686b2e8e419cfc49f3109868ee70b527b7856b74f17c91f85d389dc606d9603fe56991c2748d6df7ee71d2874c2016d24fcfedd8e42b841dd3a20bffd744ce97085f947889efbddb176bff3545a6b6498da7fd54fa95949ba011a982f7e05eba4fbb7190588f5b81ec72ebd3167b8a885d7d13c6d85179b6ddc5b09999a02b681be4258565e328fcdd4376e4390d2e5f56aa1c8c866ccfdf14581e79578a6a440be747a5515bf7b686b474
#TRUST-RSA-SHA256 b1b8229ea862b80babb5d67dfefe08afbda6ccface405b5f46513978cd0d2be57ca8cd537f8d3b2453d175ddbc51e07c749f96da1c3c9c5672a15e737ba38402c19e950593d914b5c93160656b1a006d0505bf3f7898e27dd11e2fbbf737609ebb3ca4270b6dce9c9669a6b1c470cdc106a3b06f002d16c5e1e2bbb9953d7be1ca9374ea29ff1296eb8e8d12039661ac6a660b59ce00492fa8506ed4a7e6561069030d02022f68fb651169eef47855326b38815d17bab904f7e05844522757f55407746a24285d2491401597a3d4a14cc0f5d8e2e9a12eb869075c39a5a6071343106ea84e4877519ba3a207c5f94b49d37c1122d7e5b344b7bb72a2d79dfce7da0ddb35e9a6afc5a710f41a5857f151236d00e6810077edf97f41f1275accc87022e819a3c4c187f434af96a0ecff7a79ca4a765058ed76e6962b88fdfa1724398cdba0a7d5ccc45da48023ae698db0183c5082353a59738a7250e5a53180e4c482bcca2bc447b0539f4a992c6da8cea8379962cfd5308e1b14f6374442537bb0ac577d2a5e528946a55d7c125c9eae81c4edc2f29ed8ab6a43f9f287bb47b3ba7c84f37b35e9a483dc8526db8d5e77a1f4aec17106cc54630e519c911cce30282a81d4b5ee3d3d227cca0591207eded73366a431dfbffd242d3e20b4b2c2d149b08f8454d9442dfbcf5f7839a54f57d701c3c754760fe38a276a8492ff5aaf
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(63340);
  script_version("1.8");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/08");

  script_name(english:"Mac OS X Wireless Networks List");

  script_set_attribute(attribute:"synopsis", value:"The remote host has connected to wireless networks in the past.");
  script_set_attribute(attribute:"description", value:
"Using the supplied credentials, it is possible to extract the list of
networks to which the remote host has connected in the past.");
  script_set_attribute(attribute:"solution", value:
"Ensure that use of Wi-Fi networks is done in accordance to your
organization's acceptable use and security policies.");
  script_set_attribute(attribute:"risk_factor", value:"None");

  script_set_attribute(attribute:"plugin_publication_date", value:"2012/12/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2012-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version");

  exit(0);
}


include("ssh_func.inc");
include("macosx_func.inc");


enable_ssh_wrappers();

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var os = get_kb_item("Host/MacOSX/Version");
if (!os) audit(AUDIT_OS_NOT, "Mac OS X");

var report = NULL;

function checkAirportPreferencePlist()
{
  local_var cmd, res, network, security, date, in_security_array;
  local_var array, line, sec_val, result;

  cmd = 'defaults read /Library/Preferences/com.apple.wifi.known-networks';
  res = exec_cmd(cmd:cmd);
  if ("SSIDString" >!< res) return NULL;

  network = NULL;
  security = NULL;
  date = NULL;
  in_security_array = FALSE;
  result = '';

  array = split(res, keep:FALSE);
  foreach line (array)
  {
    if (in_security_array)
    {
      if (");" >< line || preg(pattern:"^[ \t]*\)", string:line))
      {
        in_security_array = FALSE;
      }
      else
      {
        sec_val = preg_replace(pattern:'^[ \t]*"([^"]*)"[, \t]*$', string:line, replace:"\1");
        if (sec_val != line && strlen(sec_val) > 0 && sec_val != "None")
        {
          if (strlen(security))
            security += ', ' + sec_val;
          else
            security = sec_val;
        }
      }
    }
    else if ("SupportedSecurityTypes" >< line)
    {
      in_security_array = TRUE;
      security = NULL;
    }
    else if ("LastAutoJoinAt" >< line)
      date = str_replace(find:'"', replace:"", string:preg_replace(pattern:".*LastAutoJoinAt = (.*);$", string:line, replace:"\1"));
    else if ("LastAssociatedAt" >< line && empty_or_null(date))
      date = str_replace(find:'"', replace:"", string:preg_replace(pattern:".*LastAssociatedAt = (.*);$", string:line, replace:"\1"));
    else if ("JoinedByUserAt" >< line && empty_or_null(date))
      date = str_replace(find:'"', replace:"", string:preg_replace(pattern:".*JoinedByUserAt = (.*);$", string:line, replace:"\1"));
    else if ("AddedAt" >< line && empty_or_null(date))
      date = str_replace(find:'"', replace:"", string:preg_replace(pattern:".*AddedAt = (.*);$", string:line, replace:"\1"));
    else if ("SSIDString" >< line)
      network = str_replace(find:'"', replace:"", string:preg_replace(pattern:".*SSIDString = (.*);$", string:line, replace:"\1"));

    if (preg(pattern:"^[ \t]*\};", string:line) && strlen(network) > 0)
    {
      result += '-  Network name : ' + network;
      if (strlen(date))
        result += '\n   Last connected : ' + date;
      else
        result += '\n   Last connected : N/A';
      if (strlen(security))
        result += '\n   Security: ' + security;
      else
        result += '\n   Security: Open';
      result += '\n\n';
      network = security = date = NULL;
    }
  }
  if (strlen(result)) return result;
  return NULL;
}

var cmd, res, array, flag, network, security, date;
var wifi_flag = FALSE;
var preferences = [ 'KnownNetworks', 'RememberedNetworks' ];

foreach var preference (preferences)
{
  cmd = strcat('defaults read /Library/Preferences/SystemConfiguration/com.apple.airport.preferences ', preference, ' | egrep "(SSIDString|LastConnected|SecurityType)"');

  res = exec_cmd(cmd:cmd);
  if ( "SSIDString =" >!< res ) continue;
  array = split(res, keep:FALSE);
  flag = 0;
  foreach var line ( array )
  {
   if ( "LastConnected" >< line )
    date = str_replace(find:'"', replace:"", string:preg_replace(pattern:".*LastConnected = (.*);$", string:line, replace:"\1"));
   else if ( "SecurityType" >< line )
   {
    security = str_replace(find:'"', replace:"", string:preg_replace(pattern:".*SecurityType = (.*);$", string:line, replace:"\1"));
    flag = 1;
   }
   else if ( "SSIDString" >< line )
   {
    network = str_replace(find:'"', replace:"", string:preg_replace(pattern:".*SSIDString = (.*);$", string:line, replace:"\1"));
    flag = 1;
   }

   if( (strlen(network) > 0 && strlen(security) > 0) ||
       (strlen(date) > 0 && strlen(network) > 0 && flag == 0 ) ) # No "SecurityType" associated to this network
   {
    wifi_flag = TRUE;
    report += '-  Network name : ' + network;
    if ( flag != 0 )
    {
     if ( strlen(date) ) report += '\n   Last connected : ' + date;
     else report += '\n   Last connected : N/A';
     date = NULL;
    }
    if ( strlen(security) )
    {
     report += '\n   Security: ' + security;
    }
    network = security = NULL;
    flag = 0;
    report += '\n\n';
   }
  }
  break;
}

if (!wifi_flag)
{
  var fallback = checkAirportPreferencePlist();
  if (!empty_or_null(fallback))
  {
    report = fallback;
    wifi_flag = TRUE;
  }
}

if (wifi_flag == FALSE) exit(0, "Could not extract the list of Wi-Fi networks.");

security_report_v4(port:0, extra:report, severity:SECURITY_NOTE);