current_user - SpecterOps Open Source

Summary

This uses AppleEvents or ObjectiveC APIs to get information about the current user.

Needs Admin: False
Version: 1
Author: @its_a_feature_

If the JXA method is selected: In Mojave+ (10.14+) this will cause a popup the first time asking for permission for your process to access System Events.

Arguments

method

Description: Use AppleEvents or ObjectiveC calls to get user information
Required Value: True
Default Value: api

Usage

current_user

MITRE ATT&CK Mapping

T1033

Detailed Summary

This boils down to AppleEvents to System Events or an ObjectiveC API call:

if(method === "jxa"){
    let user = Application("System Events").currentUser;
    let info = "Name: " + user.name() +
    "\nFullName: " + user.fullName() +
    "\nhomeDirectory: " + user.homeDirectory() +
    "\npicturePath: " + user.picturePath();
    return {"user_output":info, "completed": true};
}
else if(method === "api"){
    let output = "\nUserName: " + $.NSUserName().js +
    "\nFull UserName: " + $.NSFullUserName().js +
    "\nHome Directory: " + $.NSHomeDirectory().js;
    return {"user_output":output, "completed": true};
}

clipboard download

⌘I

​Summary

​Arguments

​method

​Usage

​MITRE ATT&CK Mapping

​Detailed Summary

Summary

Arguments

method

Usage

MITRE ATT&CK Mapping

Detailed Summary