Question

Getting LAPS password out of JamfPro (extension attribute) in PowerShell

Forum|Forum|3 years ago
March 22, 2022
6 replies
36 views

jacobkuj
New Contributor

Hello,

Our new Anti-Ransomware product needs a way to shut mac systems down.

Something like ‘echo <password> | sudo –S shutdown –h now ‘ deployed via ssh would probably do the job; However we are using LAPS script by Phil Redfern (root password is also stored as an extension attribute).

The question is how to get the LAPS password out of Jamf – the Anti-Ransomware product uses PowerShell?

Any ideas?

Thanks, Regards, JK

+16

kendalljjohnson
Valued Contributor
Forum|Forum|3 years ago
March 22, 2022

In general, EA's can definitely be pulled with an `Invoke-RestMethod -Method Get` via the API for the computer record. From there you would just need to drill down to the specific information you need.

jacobkuj
Author
New Contributor
Forum|Forum|3 years ago
March 23, 2022

Hi Kendal, Thanks for your reply - much appreciated.

I know a bit about Jamf (but I’m not a scripting guru) and the aniransomware guy knows his PowerShell but we are struggling. Does he need to authenticate to Jamf to get the data (that’s my logic).

Phil Redfern’s script looks like this:

udid=$(/usr/sbin/system_profiler SPHardwareDataType | /usr/bin/awk '/Hardware UUID:/ { print $3 }')

xmlString="<?xml version=\\"1.0\\" encoding=\\"UTF-8\\"?><computer><extension_attributes><extension_attribute><name>LAPS</name><value>$newPass</value></extension_attribute></extension_attributes></computer>"

extAttName="\\"LAPS\\""

oldPass=$(curl -s -f -u $apiUser:$apiPass -H "Accept: application/xml" $apiURL/JSSResource/computers/udid/$udid/subset/extension_attributes | xpath -e "//extension_attribute[name=$extAttName]" 2>&1 | awk -F'<value>|</value>' '{print $2}' | tail -n +1 )

We are looking for value of $oldPass – to get it we need udid first.

What he created so far is:

$apiUser="LAPS-API"
$apiPass="password"
$apiCred = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes("${apiUser}:${apiPass}"))
$AuthHeader = "Basic ${apiCred}"
$Headers = @{'Authorization' = $AuthHeader}
$apiURL = "https://ourjamfproserver.ac.uk:8443/api/v1/auth/token"
Try {
    [xml]$XMLResponse = (Invoke-WebRequest -Uri "${apiURL}" -Headers $Headers -Method Post -Body "" -ContentType "application/json").Content
    } catch [System.Net.WebException] {

        $res = $_.Exception.Response
        echo $res
    }
$apiURL = "https://ourjamfproserver.ac.uk:8443/JSSResource/computers/name/${Hostname}"
Try {

    [xml]$XMLResponse = (Invoke-WebRequest -Uri "${apiURL}" -Headers $Headers -Method Post).Content

    } catch [System.Net.WebException] {

        $res = $_.Exception.Response

        echo $res

    }
Select-Xml -Xml $XMLResponse -XPath "/"

apiURL2="https://casper.westherts.ac.uk:8443/JSSResource/computers/udid/$udid/subset/extension_attributes"

Pulling my hairs here

+16

kendalljjohnson
Valued Contributor
Forum|Forum|3 years ago
March 23, 2022

Hi Kendal, Thanks for your reply - much appreciated.

Phil Redfern’s script looks like this:

udid=$(/usr/sbin/system_profiler SPHardwareDataType | /usr/bin/awk '/Hardware UUID:/ { print $3 }')

xmlString="<?xml version=\\"1.0\\" encoding=\\"UTF-8\\"?><computer><extension_attributes><extension_attribute><name>LAPS</name><value>$newPass</value></extension_attribute></extension_attributes></computer>"

extAttName="\\"LAPS\\""

oldPass=$(curl -s -f -u $apiUser:$apiPass -H "Accept: application/xml" $apiURL/JSSResource/computers/udid/$udid/subset/extension_attributes | xpath -e "//extension_attribute[name=$extAttName]" 2>&1 | awk -F'<value>|</value>' '{print $2}' | tail -n +1 )

We are looking for value of $oldPass – to get it we need udid first.

What he created so far is:

$apiUser="LAPS-API"
$apiPass="password"
$apiCred = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes("${apiUser}:${apiPass}"))
$AuthHeader = "Basic ${apiCred}"
$Headers = @{'Authorization' = $AuthHeader}
$apiURL = "https://ourjamfproserver.ac.uk:8443/api/v1/auth/token"
Try {
    [xml]$XMLResponse = (Invoke-WebRequest -Uri "${apiURL}" -Headers $Headers -Method Post -Body "" -ContentType "application/json").Content
    } catch [System.Net.WebException] {

        $res = $_.Exception.Response
        echo $res
    }
$apiURL = "https://ourjamfproserver.ac.uk:8443/JSSResource/computers/name/${Hostname}"
Try {

    [xml]$XMLResponse = (Invoke-WebRequest -Uri "${apiURL}" -Headers $Headers -Method Post).Content

    } catch [System.Net.WebException] {

        $res = $_.Exception.Response

        echo $res

    }
Select-Xml -Xml $XMLResponse -XPath "/"

apiURL2="https://casper.westherts.ac.uk:8443/JSSResource/computers/udid/$udid/subset/extension_attributes"

Pulling my hairs here

Here's a blurb we have used for getting items from within the computer info

$username = "<user>"
$password = "<password>"
$Headers = @{
    Authorization = 'Basic {0}' -f [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes(('{0}:{1}' -f $username,$password)))
    Accept = 'application/json'
}
$url = "https://<yourURL>:8443/JSSResource/computers/name/$computerName"

$attributes = Invoke-RestMethod -Method Get -Uri $url -Headers $Headers
$computerInfo = $attributes.computer

jacobkuj
Author
New Contributor
Forum|Forum|3 years ago
March 23, 2022

Here's a blurb we have used for getting items from within the computer info

$username = "<user>"
$password = "<password>"
$Headers = @{
    Authorization = 'Basic {0}' -f [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes(('{0}:{1}' -f $username,$password)))
    Accept = 'application/json'
}
$url = "https://<yourURL>:8443/JSSResource/computers/name/$computerName"

$attributes = Invoke-RestMethod -Method Get -Uri $url -Headers $Headers
$computerInfo = $attributes.computer

Thank you! We should be able to test next week :)

jacobkuj
Author
New Contributor
Forum|Forum|3 years ago
March 28, 2022

Thank you! We should be able to test next week :)

Hi Kendal,

We run the script but the url results in error ‘not found’…

Real values replaced with Angle brackets – script run has real values.

$username = <username>
$password = <password>

$computername = <hostname>

$Headers = @{
    Authorization = 'Basic {0}' -f [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes(('{0}:{1}' -f $username,$password)))
    Accept = 'application/json'
}
$url = "https://<jamfurl>:8443/JSSResource/computers/name/${computername}"
write-host $url

$attributes = Invoke-RestMethod -Method Get -Uri $url -Headers $Headers
$computerInfo = $attributes.computer

this it the output:

PS C:\\Users\\Administrator> C:\\temp\\JAMF-get-computer-info.ps1

https://<jamfurl>:8443/JSSResource/computers/name/<hostname>
Invoke-RestMethod : 
   Status page
Not Found
The server has not found anything matching the request URI
You can get technical details here.
Please continue your visit at our home page.
At C:\\temp\\JAMF-get-computer-info.ps1:13 char:15
+ ... ttributes = Invoke-RestMethod -Method Get -Uri $url -Headers $Headers ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebExceptio 
   n
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand

PS C:\\Users\\Administrator>

What am I doing wrong?

GregE
Contributor
Forum|Forum|2 years ago
September 15, 2023

Hi Kendal,

We run the script but the url results in error ‘not found’…

Real values replaced with Angle brackets – script run has real values.

$username = <username>
$password = <password>

$computername = <hostname>

$Headers = @{
    Authorization = 'Basic {0}' -f [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes(('{0}:{1}' -f $username,$password)))
    Accept = 'application/json'
}
$url = "https://<jamfurl>:8443/JSSResource/computers/name/${computername}"
write-host $url

$attributes = Invoke-RestMethod -Method Get -Uri $url -Headers $Headers
$computerInfo = $attributes.computer

this it the output:

PS C:\\Users\\Administrator> C:\\temp\\JAMF-get-computer-info.ps1

https://<jamfurl>:8443/JSSResource/computers/name/<hostname>
Invoke-RestMethod : 
   Status page
Not Found
The server has not found anything matching the request URI
You can get technical details here.
Please continue your visit at our home page.
At C:\\temp\\JAMF-get-computer-info.ps1:13 char:15
+ ... ttributes = Invoke-RestMethod -Method Get -Uri $url -Headers $Headers ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebExceptio 
   n
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand

PS C:\\Users\\Administrator>

What am I doing wrong?

Presuming you're using Jamf Cloud, remove :8443 from your URL?

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded