Skip to main content

Hey y'all, a query for the hive mind.



We've been running into users installing Awesome Screenshots (horrible name), which beacons out to websites tens of thousands of times a day. As you can imagine, InfoSec is not happy about it. I'm trying to find a way to do reporting to find out what extensions are installed on machines.



I found that the extensions are all stored in the same folder:



~/Library/Application Support/Google/Chrome/Default/Extensions/


But the names of the folders with are just random strings of letters and numbers:
external image link



Within the folder is a manifest.json file, which does have the app name in it:
external image link



So I'm assuming there is some way to grab that and throw it into an extension attribute or something. I think the main problem would be navigating through those extension folders, or at least finding a way to translate those folders into extension names.



Has anyone found a way to successfully report installed extensions? Any input on this would be appreciated. Thanks!

@jrwilcox How do we do this exactly?


I have done this using a configuration profile.





You need to create a plist file with the extensions you don't want. Ours has grown over the years. But it would look something like this:



<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>ExtensionInstallBlacklist</key>
<array>
<string>fdcgdnkidjaadafnichfpabhfomcebme</string>
<string>omghfjlpggmjjaagoclmmobgdodcjboh</string>
<string>ojhgknhfdjheakddcdenanbgaaepcijb</string>
<string>ckiahbcmlmkpfiijecbpflfahoimklke</string>
<string>eelphgpfmjhndihoopgadghfonahifel</string>
<string>gjgadmpbpojbdcehgijdlboanljfmnel</string>
<string>idefjamndcpplnamdlbodoebjgkpdmpn</string>
<string>mpmikmnnnoacchojfpdgfdgpkfgajhim</string>
<string>fcbnikgemihknccdjaihjnfbapinljpi</string>
<string>bkjcdfmmpdfjohenejbkaaafkoeknjnh</string>
<string>gnenekpofbpieiafoofnnphgdmloiheo</string>
<string>jhdlphnpjdilnjmhgepbgaompckdjdbf</string>
<string>dpplabbmogkhghncfbfdeeokoefdjegm</string>
<string>egnccllcfmpcmeccejlbbnmobnaglbka</string>
<string>gbchcmhmhahfdphkhkmpfmihenigjmpp</string>
<string>pohhhgpookhmdgjnngkgkbhklplbompp</string>
<string>lledpflfnanamkogoclkgaggfdgoalok</string>
<string>pdkmdmbjlgckgcffnndhhlmifaobafji</string>
<string>padekgcemlokbadohgkifijomclgjgif</string>
<string>omihnninlhneakfglooiofgdbpmnhjgn</string>
<string>gchhimlnjdafdlkojbffdkogjhhkdepf</string>
<string>okeigjflfhffjfkjkgaipencahpaiipd</string>
<string>eifppljhjomneeocmoogcpfdkbemkbln</string>
<string>jdhebjohjpgicipoimkglgledckdalke</string>
<string>ipdbcacaocfljmgjidojcfgohgfnjeli</string>
<string>dffcdhcicpnijbiloigogbgigiepgbpn</string>
<string>ldikpbpacmiafmhiifihmicokeallbim</string>
<string>cjnfcmkfdcoeckplikldabeggcohmbmj</string>
<string>cldflcjakandmfifipfanklcdfhdiaph</string>
<string>gohbopcmfdjomkmighlcflfjoleafmgj</string>
<string>hghdlbnadahkknlbmckfljpcoilldcoa</string>
<string>gcknhkkoolaabfmlnjonogaaifnjlfnp</string>
<string>eiojlieidcgfibngioiipcabhhheklpi</string>
<string>ocneleoikjgphlhjpeoabocgcegemegd</string>
<string>kpiecbcckbofpmkkkdibbllpinceiihk</string>
<string>dookpfaalaaappcdneeahomimbllocnb</string>
<string>kphedknfgjnjghfjgjnggidjefechgak</string>
<string>gjknjjomckknofjidppipffbpoekiipm</string>
<string>kdgfdpeigidmiagopmgmnpkaokkofnbb</string>
<string>ikdfimhecflbddjmblgbkinhfjlkmeni</string>
<string>bibmocmlcdhadgblaekimealfcnafgfn</string>
<string>deoodoglhbmpafkajmlggnjnngdclnie</string>
<string>kcndmbbelllkmioekdagahekgimemejo</string>
<string>iobkgicmookonkhaijnhoodijfhiljha</string>
<string>eggfigcgijdfegcagkmkbdjokhkhgiek</string>
<string>cmgnmcnlncejehjlnhaglpnoolgbflbd</string>
<string>iilpibhiihokecnbdkaminemnmecjfed</string>
<string>angbhbjbplfpkbcijbkhecjfcfgjbjoc</string>
<string>nijojjpfbokhhlkphhjdlhdigfhgpndd</string>
<string>fepeagfcjjbnchdgkglpinpiocbjbbhn</string>
<string>ondofellpdgkikhlhfkiecjnkdmghpah</string>
<string>gonhdadhgidiinkldgjolmnjlcekjffj</string>
<string>gdocgbfmddcfnlnpmnghmjicjognhonm</string>
<string>maicibfoihmlppibfkljeljefamfndbp</string>
<string>mnjmjnofadekgmfahkikcjbckdofddbb</string>
<string>mdlcjoghfabibdedbcpobangfgppnnbo</string>
<string>lcojcmfieongdpblaefmjnegimcilifa</string>
<string>cbipoicmapnmmmcbaagfagnlcdhgohfj</string>
<string>bjgbkkeghhelcgfnklahganohbmpldke</string>
<string>gpabelodkfbnigmjdlhdjcbjoimjjmap</string>
<string>ggmdpepbjljkkkdaklfihhngmmgmpggp</string>
<string>pminladjmndipkjkmdjhhbidegbjoemn</string>
<string>bojjojmafbggldbgcohmpnedmimmicjf</string>
<string>cegfejpmmodikpdebjkdnkgcifhfepfi</string>
<string>cmnfgkpgdakahclbpekkppahnkcbogka</string>
<string>gkojfkhlekighikafcpjkiklfbnlmeio</string>
<string>epbfmioobedknooiakdehepogalbgkng</string>
<string>gcbommkclmclpchllfjekcdonpmejbdp</string>
<string>aadhbdhoolgcjfdplbjpfmmobcjmhklf</string>
<string>gkopihinfioonpbajbajblgphaicajpn</string>
<string>mnloefcpaepkpmhaoipjkpikbnkmbnic</string>
<string>kbiknomhfomgpmobhoapjocngjmhdlhk</string>
<string>nokjbkkpjgooeoegnbodmelenklgabpm</string>
<string>bghpialiocekfipnbidmbhcbibpchjpb</string>
<string>nabijffolhanhlbkmakkfgfeadcgkmna</string>
<string>mjnbclmflcpookeapghfhapeffmpodij</string>
<string>joglidlgpbjaokkllogcnodcjckajdni</string>
<string>nlbejmccbhkncgokjcmghpfloaajcffj</string>
<string>hbgknjagaclofapkgkeapamhmglnbphi</string>
<string>baiknijknkfpoaehpnnjnjiidjonhfbb</string>
<string>haagnpmcndhgepbnileochmgmdenapjg</string>
<string>lebpnjmmkockepeffbadcnechelmhekc</string>
<string>ifalmiidchkjjmkkbkoaibpmoeichmki</string>
<string>lpgemjggacakklinlcfamaemnkbngmcf</string>
<string>oicamophdnojgacgbobolcnhbbgpiknb</string>
<string>baaclllfceolpgfimibgppgeojbeebcd</string>
<string>mfoejjmlljjjiokompekfbdhaikjpijg</string>
<string>mbnapgdcalopgfpleapnelndfhlebpmg</string>
<string>njconeaigoafkdkcoaioddgmcioocabh</string>
<string>lecomokapcbeofiomnjihgbkfcnhogil</string>
<string>omdakjcmkglenbhjadbccaookpfjihpa</string>
<string>dbgcbfajoppbhoakhjnfcpbkhomfabko</string>
<string>eiddfaedmgnpnnojolcknhpjbmmpplgd</string>
<string>eaadkdmjbccopjhknndhjpnbhbklonbc</string>
<string>jlgkdcolhnlfkojbhjdbgeghollibcga</string>
<string>ocmcdcmdgjejpidljphlgcgedlpjbfhh</string>
<string>aifcmpjfhomafllokdkefjkbepbghhlk</string>
<string>fhmfcdjnaimddaiemgmnggelpajkhngi</string>
<string>jincbfompjbjnkbldjdhnkekihdanila</string>
<string>lbggnklgidgdboipgkcefdeojekpcomo</string>
<string>jnepnignpggeebkgdmdbmjgdkeapkhmp</string>
<string>fjpglcmmjcmnfigjjgpnajgiejppjfha</string>
<string>iklpfnjfjjdghbldecfhmkpnnojaifpk</string>
<string>objkcphggobldholmnidihoibcapbmdi</string>
<string>lbhdjpmomigdcfkidmimojhnoacaffcg</string>
<string>gammobjddihgegcpnbmgipcmbejcjffn</string>
<string>pooljnboifbodgifngpppfklhifechoe</string>
<string>ngppcmdmopkgobmmcankecnpkkdkoeng</string>
<string>deoeenbkoccjaefmmhpmlegngdjohdcm</string>
<string>ikdfimhecflbddjmblgbkinhfjlkmeni</string>
<string>alakcphnkenhpgmjgcpapeiaifddhbop</string>
<string>ojfgcfilbphjeipkknjlkkkjboklihcn</string>
<string>jcgcdicmlhepcpjcnafjfdcgdofcoleo</string>
<string>omghfjlpggmjjaagoclmmobgdodcjboh</string>
<string>acbclpnddfeendndgplngifjjihimbcg</string>
<string>nfhpjjacpaacbcncddkhmhdgkfgnkffh</string>
<string>opalpjjboefohnelaemnhdhlceibbcgl</string>
<string>kfblffmcfhcclgeeialffpdamibbpkma</string>
<string>aennjkgpfcjeilhccfkohcpmkgpeaiih</string>
<string>edljfdnikiehndnhcfaohnijpfidhhpc</string>
<string>fjfggdolkejgbladjgiafdfdddahiipg</string>
<string>aonncbclmineeaebnfdadmaclpbogbdl</string>
<string>bihmplhobchoageeokmgbdihknkjbknd</string>
<string>opalpjjboefohnelaemnhdhlceibbcgl</string>
<string>apepmbbejdeohmablkgnmngfpfapkhba</string>
<string>bohjiepdaibaajbeedilfpdniijmmccf</string>
<string>fdehilofdbonobjnkoijeiggnaddekdm</string>
<string>aghegkgojapdjklinomabbgdlanpkdmk</string>
<string>jbmkeiogkjmcmmkojnebgaglcideikab</string>
<string>pphbjiclbdndpilnpjiamjonmpfddfma</string>
<string>kebmnjndjbfhllgaengdjdobfhokkpca</string>
<string>jccmoegogckfgbnllaapbhbpcohhknmc</string>
<string>loenplbihejlgppngjjplpnejgdmhlpc</string>
<string>fdhfkpocplboibnjgpiijhnchmeffalo</string>
<string>enhcpffgidjhkgnnmiaeennhgjldopeh</string>
<string>mfmeacflmeoggmfbimnmoobleekojlca</string>
<string>ibgnlbelphlakpocgjhmfgeegfminhel</string>
<string>gmolfjcfkljcegibacpmhnanbfkbmcnh</string>
<string>ocdlmemhcamdekmepajibiaepaajaepo</string>
<string>bkommgglgedojaffpdbadghkofkjfiej</string>
<string>jiicoamlefgfcjdiaoggmclhndecenpm</string>
<string>kcgfoobdbmnnpmoagfkgjgmiipnolhbj</string>
<string>aieheoflmhngknnnimkhooklagfidikp</string>
<string>olkbmocoahljgmegapgaefipjpdklpdd</string>
<string>gmakhlakpiackdmiodepgbllmejakkgf</string>
<string>epophiljpfjmehfmmifggbgpdhlpflfa</string>
<string>bjdoolacknjicapllfnlnmfmppifnpba</string>
<string>ogfnpoaboimnmogpddgkphgkbgooomhg</string>
<string>nbkcgajmoblcepfdmpfnphjjmbfnckhp</string>
<string>eoeecjmgnmpnljngnagabdpmahamaaoh</string>
<string>heajfgnegopeedndeahkdjedjkjcmnpb</string>
<string>mafcnffiekamcoipelofhbnpnhjppged</string>
<string>odiddbcijempnhhobijfbggjogofdlgl</string>
<string>hoapmlpnmpaehilehggglehfdlnoegck</string>
<string>oknedbefhljbabbioodiahaapfbogceg</string>
<string>cocfojppfigjeefejbpfmedgjbpchcng</string>
<string>gacjfopciepniimkpbikjinckfncgmid</string>
<string>ledoohjcfaalphjbfhldfdpnpmnfgdhe</string>
<string>kgdohnpohekcfdpcindahcedncliibij</string>
<string>gfmpdjndpbomeamnkmjepilkkcoeicma</string>
<string>oeejfcielojbbeepbdginbpijbfhmkcg</string>
<string>ajfiodhbiellfpcjjedhmmmpeeaebmep</string>
<string>fjhcpnpblahnhdmalehachcdlnlggehd</string>
<string>idgiipeogajjpkgheijapngmlbohdhjg</string>
<string>pddlkidaibpbhpkfbhkbeolbagpmkhhn</string>
<string>bdbcklhdhokpgjjdhilhaoaidapanofb</string>
<string>mlekbhaipaoidoahjmgecceeecfondjb</string>
<string>ojedkepkekklpjcgdfiahladdbopbooh</string>
<string>nbcojefnccbanplpoffopkoepjmhgdgh</string>
<string>lkjblbljedhgggafaigpdpjjpphhmnoo</string>
<string>ehfljgbbpjgcfondpjcmbfmmpnhchfkg</string>
<string>hpfbfcdoiipkblfeknfggcmfppacjife</string>
<string>lgpiomikidaaibmkadpabhakjeapkgnm</string>
<string>ibdpficdcmlkjnaigfebpbomaneenpll</string>
<string>johnlmmilpdeggdcdbgepopajkbmbheh</string>
<string>joaobgacfnccmhgahonaofjigfiadllb</string>
<string>lfbhcdkmkklcpifcnknkjhogjpijihkl</string>
<string>jfjeodcjjbbmblgpakgmaedoilnhmcnp</string>
<string>eaflheocdgkooaonmhhfjfalgeljkknk</string>
<string>degbkghkliblcgkegaeofdmfjfbfnmfb</string>
<string>ghfbbjimolmcijjfnohefkggjgnpmmcg</string>
<string>bgfegfkfcickgjmkibdilgmmdoobpdkb</string>
<string>hlacajbkonocfmdfgdkdjmpneojpbllj</string>
<string>epepldfkiegplfikfabpojdolifladlk</string>
<string>bhapkddefgijeoiecegphobpgpjcgbcj</string>
<string>hbfeadheangdffoapflbkeablgbgloja</string>
<string>pbajhjcjhieagcbiljmekgechllcdhcd</string>
<string>gjpmoooajbcolkelmdengjinljlcbiie</string>
<string>ljejahkefpkedlaabpmepcikgmnknile</string>
<string>oofgbpoabipfcfjapgnbbjjaenockbdp</string>
<string>dgflkllhdalglbkeogdoihcigiekmjgk</string>
<string>ojagfgibjiofppmilfbgmipfelkhcccn</string>
<string>hnmpcagpplmpfojmgmnngilcnanddlhb</string>
<string>gfglncanejnkbknnmemmelgcjfodcejl</string>
<string>bdbmnbbkhbnhamnhndkacfibdlbooihm</string>
<string>lflaacejokglacdflhelmdnneieidhmj</string>
<string>agooajdlfljhhbliomhpincjnnndgffk</string>
<string>obdgehdaihabnaagihegbkacgfefdjpc</string>
<string>flgagpabgbihkajlfcaeplgnpicdojab</string>
<string>dlmiaagjplojbkjdceggjmaabanocndi</string>
<string>mpcaainmfjjigeicjnlkdfajbioopjko</string>
<string>jopjlpjeekmmnpdiplggikdjkgkfklno</string>
<string>pcmmjfpfjlcdhhngjkkfbeoaohbgjhgp</string>
<string>nenecalochlgjiegbfppigfhkjdpglnm</string>
<string>mhjhchlgdmkmgfgjobpbajakhlmajjpj</string>
<string>egjnnogealenpdnalnponnakmimmhklf</string>
<string>nijebgacophnpgohfblkmdbjbmfcjagd</string>
<string>lobjodcpekhnpndpjgkikjecmcjbdifd</string>
<string>mpcaainmfjjigeicjnlkdfajbioopjko</string>
<string>apkmkagbnjdldlchjaodkghnknglccal</string>
<string>eocembdiaelakgjoheclffagagbgpejg</string>
<string>nocfiicinjlacbcpohmbcndlmmfmlidk</string>
<string>nknebiagdodnminbdpflhpkgfpeijdbf</string>
</array>
</dict>
</plist>

Thank you @jrwilcox for sharing all those ID's to add to my list. This has seemed like the best way for me to handle it too. It works very well!


Worked like a charm! Thanks Emily.


Hey all,
Loving these extension attributes, but looking for one that reports the Extension name from chrome, then the ID number for the same extension. Anyone have a working version that does this?



Gabe Shackney
Princeton Public Schools


In looking at our installs of Chrome, most (if not all) of our users have multiple profiles, making the



/Users/${loggedInUser}/Library/Application Support/Google/Chrome/Default/Extensions/


line irrelevant. Instead of "Default", we see "Profile 1", "Profile 2", etc.
I am having trouble making the "find" command work with a wildcard in place of "Default" in the path.
Any suggestions?


Anyone have an updated EA script that works with Monterey & Big Sur with the profile changes to Google Chrome?

/Users/${loggedInUser}/Library/Application Support/Google/Chrome/Profile [#]/Extensions/


Like @gburcham stated, does anyone have a new EA script? Can't get any of the ones above to work correctly.


@gburcham and @MPL 

FWIF, I am using $(whoami) in place of ${loggedINUser} and at least getting output. It is not reporting an extension that I know is installed and listing more information than the extension, but with the script below, this is the furthest I have made it.

I am very much a beginner with scripting, but let me know if it helped at all?

 

#!/bin/bash

# Get logged in user
CURRENT_USER=$(whoami)

# Path to the Chrome extension directory
JSONS=$( find "/Users/$(whoami)/Library/Application Support/Google/Chrome/Default/Extensions/" -name "manifest.json" )

while read JSON; do
NAME=$(awk -F'"' '/name/{print $4}' "$JSON")
if [[ ! -z "$NAME" ]] && [[ ! "$NAME" =~ "__MSG_appName__","__MSG_APP_NAME__" ]]; then
EXTS+=("${NAME}
" )
fi
done < <(echo "$JSONS")

echo "$(echo "${EXTS[@]}")"