spookerlabs
09/12/2018, 7:00 PMBeetleJuice:Downloads root# pwd
/Users/rodrigomontoro/Downloads
BeetleJuice:Downloads root# whoami
root
BeetleJuice:Downloads root# ./osqueryi
I0912 15:59:59.400579 2302239616 database.cpp:563] Checking database version for migration
I0912 15:59:59.401804 2302239616 database.cpp:587] Performing migration: 0 -> 1
I0912 15:59:59.402393 2302239616 database.cpp:619] Migration 0 -> 1 successfully completed!
I0912 15:59:59.402410 2302239616 database.cpp:587] Performing migration: 1 -> 2
I0912 15:59:59.402441 2302239616 database.cpp:619] Migration 1 -> 2 successfully completed!
I0912 15:59:59.403223 2302239616 dispatcher.cpp:81] Adding new service: ExtensionWatcher (0x7fe77cc3d338) to thread: 0x70000e291000 (0x7fe77cc41100) in process 61022
I0912 15:59:59.404122 2302239616 dispatcher.cpp:81] Adding new service: ExtensionRunnerCore (0x7fe77cc5a688) to thread: 0x70000e314000 (0x7fe77cc2b580) in process 61022
canonical for: /var/root/.osquery/shell.em.
Using a virtual database. Need help, type '.help'
osquery> select u.uid,u.shell,username,path,encrypted from users u JOIN user_ssh_keys USING(uid);
canonical for: /Users/rodrigomontoro/.ssh/
canonical for: /var/root/.ssh/
+-----+-----------+----------------+----------------------------------------+-----------+
| uid | shell | username | path | encrypted |
+-----+-----------+----------------+----------------------------------------+-----------+
| 502 | /bin/bash | rodrigomontoro | /Users/rodrigomontoro/.ssh/googlelabs | 0 |
| 502 | /bin/bash | rodrigomontoro | /Users/rodrigomontoro/.ssh/nw_chave | 1 |
| 502 | /bin/bash | rodrigomontoro | /Users/rodrigomontoro/.ssh/nw_ids | 1 |
| 502 | /bin/bash | rodrigomontoro | /Users/rodrigomontoro/.ssh/nw_machines | 1 |
| 502 | /bin/bash | rodrigomontoro | /Users/rodrigomontoro/.ssh/spookerlabs | 1 |
| 0 | /bin/sh | root | /private/var/root/.ssh/debug | 1 |
+-----+-----------+----------------+----------------------------------------+-----------+
osquery>