0xmachos / mOrc

mOrc is a post-exploitation framework for macOS written in Bash
MIT License
18 stars 2 forks source link

Implement FileVault detection (getfv) #3

Open 0xmachos opened 5 years ago

0xmachos commented 5 years ago

This is easily done with fdesetup:

fdesetup status

However it's probably more stealthy to use diskutil. I'd imagine it's quite rare that even a power user runs fdesetup.

Something like:

fs_type=$(diskutil info / | grep 'File System Personality:' | awk '{print $4}')
if [[ "${fs_type}" == "APFS" ]]; then
   enc_volume_info=$(diskutil apfs list | grep -B  6 'FileVault:                 Yes' )
fi 

Then parse the info in $enc_volume_info. Need to double check the commands for HFS(+) and CoreStorage volumes.