Madhur Jodhwani
09/07/2021, 5:39 AMalessandrogario
09/07/2021, 7:16 AMMadhur Jodhwani
09/07/2021, 7:58 AMsharvil
09/07/2021, 8:12 AMalessandrogario
09/07/2021, 8:43 AMMadhur Jodhwani
09/07/2021, 9:57 AMalessandrogario
09/07/2021, 10:00 AM7z x osquery-xxx.pkg
. This will create a (possibly hidden) file named Payload~
2. Extract the Payload~
file: 7z x Payload~
. This will create the standard deployment folders, such as usr
.
3. Locate the osqueryd binary under ./usr
Madhur Jodhwani
09/07/2021, 10:01 AMalessandrogario
09/07/2021, 10:01 AMMadhur Jodhwani
09/07/2021, 10:02 AMalessandrogario
09/07/2021, 10:03 AM.pkg
archive, what new files do you get?.pkg
file should look like this:
7z x osquery-4.9.0.pkg
7-Zip [64] 17.04 : Copyright (c) 1999-2021 Igor Pavlov : 2017-08-28
p7zip Version 17.04 (locale=en_US.utf8,Utf16=on,HugeFiles=on,64 bits,16 CPUs x64)
Scanning the drive for archives:
1 file, 10864742 bytes (11 MiB)
Extracting archive: osquery-4.9.0.pkg
--
Path = osquery-4.9.0.pkg
Type = Xar
Physical Size = 10864742
SubType = pkg
Headers Size = 4328
----
Path = Payload
Size = 10842254
Packed Size = 10842254
Modified = 2021-06-22 21:04:41
Created = 2021-06-22 21:04:41
Accessed = 2021-06-22 21:04:40
Mode = -rw-r--r--
User = reed
Group = staff
Method = octet-stream
--
Path = Payload
Type = gzip
Headers Size = 10
Everything is Ok
Size: 41235968
Compressed: 10864742
Path
messages in the 7z
output to determine what files have been createdsharvil
09/07/2021, 10:32 AMpkgutil —-expand-full osquery-4.9.0.pkg temp-dir
Madhur Jodhwani
09/07/2021, 11:26 AM