dissect.cobaltstrike 1.2.1.dev14__tar.gz → 1.2.2.dev2__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (72) hide show
  1. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/PKG-INFO +2 -2
  2. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/_version.py +2 -2
  3. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/beacon.py +1 -1
  4. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/pcap.py +1 -1
  5. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/version.py +1 -0
  6. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/pyproject.toml +1 -1
  7. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/.github/workflows/dissect-ci.yml +0 -0
  8. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/.gitignore +0 -0
  9. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/.lfs-assets-id +0 -0
  10. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/.pre-commit-config.yaml +0 -0
  11. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/.readthedocs.yml +0 -0
  12. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/LICENSE +0 -0
  13. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/README.rst +0 -0
  14. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/codecov.yml +0 -0
  15. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/__init__.py +0 -0
  16. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/artifact.py +0 -0
  17. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/c2.py +0 -0
  18. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/c2profile.lark +0 -0
  19. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/c2profile.py +0 -0
  20. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/c_c2.py +0 -0
  21. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/client.py +0 -0
  22. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/guardrails.py +0 -0
  23. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/pe.py +0 -0
  24. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/utils.py +0 -0
  25. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/xordecode.py +0 -0
  26. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/Makefile +0 -0
  27. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/_ext/generate_beacon_version_csv.py +0 -0
  28. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/beacon-version-identification.rst +0 -0
  29. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/c2profile-grammar.rst +0 -0
  30. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/cobaltstrike-beacon-versions.csv +0 -0
  31. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/codespell-ignore-words.txt +0 -0
  32. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/conf.py +0 -0
  33. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/examples.rst +0 -0
  34. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/images/beacon-client.png +0 -0
  35. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/images/teamserver-echoclient.png +0 -0
  36. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/images/teamserver_ls.png +0 -0
  37. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/images/vt-cobaltstrike-43-zip.png +0 -0
  38. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/index.rst +0 -0
  39. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/installation.rst +0 -0
  40. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/license.rst +0 -0
  41. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/scripts/checksum8-accesslogs.rst +0 -0
  42. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/scripts/dump_beacon_keys.rst +0 -0
  43. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/scripts/example_client.rst +0 -0
  44. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/scripts/index.rst +0 -0
  45. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/structures/c2_def.rst +0 -0
  46. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/structures/cs_def.rst +0 -0
  47. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/structures/guardrails_def.rst +0 -0
  48. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/structures/index.rst +0 -0
  49. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/structures/pe_def.rst +0 -0
  50. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/tools/beacon-artifact.rst +0 -0
  51. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/tools/beacon-client.rst +0 -0
  52. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/tools/beacon-dump.rst +0 -0
  53. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/tools/beacon-pcap.rst +0 -0
  54. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/tools/beacon-xordecode.rst +0 -0
  55. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/tools/c2profile-dump.rst +0 -0
  56. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/tutorials/decrypt_cobaltstrike_pcaps.rst +0 -0
  57. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/tutorials/index.rst +0 -0
  58. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/docs/tutorials/minimal_beacon_client.rst +0 -0
  59. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/scripts/checksum8-accesslogs.py +0 -0
  60. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/scripts/dump_beacon_keys.py +0 -0
  61. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/scripts/example_client.py +0 -0
  62. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/tests/conftest.py +0 -0
  63. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/tests/test_beacon.py +0 -0
  64. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/tests/test_c2.py +0 -0
  65. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/tests/test_c2profile.py +0 -0
  66. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/tests/test_client.py +0 -0
  67. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/tests/test_guardrails.py +0 -0
  68. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/tests/test_pe.py +0 -0
  69. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/tests/test_utils.py +0 -0
  70. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/tests/test_version.py +0 -0
  71. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/tests/test_xordecode.py +0 -0
  72. {dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/tox.ini +0 -0
{dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/PKG-INFO RENAMED
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.4
2
2
  Name: dissect.cobaltstrike
3
- Version: 1.2.1.dev14
3
+ Version: 1.2.2.dev2
4
4
  Summary: a Python library for dissecting Cobalt Strike related data
5
5
  Project-URL: Homepage, https://github.com/fox-it/dissect.cobaltstrike
6
6
  Project-URL: Documentation, https://dissect-cobaltstrike.readthedocs.io/
@@ -29,7 +29,7 @@ Classifier: Topic :: Security
29
29
  Classifier: Topic :: Software Development :: Libraries :: Python Modules
30
30
  Classifier: Topic :: Utilities
31
31
  Requires-Python: >=3.9
32
- Requires-Dist: dissect-cstruct>=4.2
32
+ Requires-Dist: dissect-cstruct>=4.6.dev
33
33
  Requires-Dist: lark
34
34
  Provides-Extra: c2
35
35
  Requires-Dist: flow-record; extra == 'c2'
{dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/_version.py RENAMED
@@ -17,5 +17,5 @@ __version__: str
17
17
  __version_tuple__: VERSION_TUPLE
18
18
  version_tuple: VERSION_TUPLE
19
19
 
20
- __version__ = version = '1.2.1.dev14'
21
- __version_tuple__ = version_tuple = (1, 2, 1, 'dev14')
20
+ __version__ = version = '1.2.2.dev2'
21
+ __version_tuple__ = version_tuple = (1, 2, 2, 'dev2')
{dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/beacon.py RENAMED
@@ -617,7 +617,7 @@ def parse_beacon_gate(data: bytes) -> BeaconGateOptions:
617
617
 
618
618
  def beacon_gate_options_string(bgo: BeaconGateOptions) -> list[str]:
619
619
  """Return the enabled BeaconGate WinAPI's as a list of strings"""
620
- options = {k for k, v in bgo._values.items() if v}
620
+ options = {k for k, v in bgo.__values__.items() if v}
621
621
 
622
622
  comms = {"InternetOpenA", "InternetConnectA"}
623
623
  core = {
{dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/pcap.py RENAMED
@@ -77,7 +77,7 @@ def c2packet_to_record(c2packet: C2Packet) -> Record:
77
77
  """Convert `c2packet` to a flow.record."""
78
78
  fields = []
79
79
  fields.append(("bytes", "raw_http"))
80
- kv = c2packet._values
80
+ kv = c2packet.__values__
81
81
  for field in c2packet._type.fields:
82
82
  ftype = str(field.type)
83
83
  if ftype.startswith("char"):
{dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/dissect/cobaltstrike/version.py RENAMED
@@ -88,6 +88,7 @@ PE_EXPORT_STAMP_TO_VERSION: Dict[int, str] = {
88
88
  0x66915022: "Cobalt Strike 4.10 (Jul 16, 2024)",
89
89
  0x66915024: "Cobalt Strike 4.10 (Jul 16, 2024)",
90
90
  0x66915027: "Cobalt Strike 4.10 (Jul 16, 2024)",
91
+ 0x6691503D: "Cobalt Strike 4.10 (Jul 16, 2024)",
91
92
  0x674E0D02: "Cobalt Strike 4.10.1 (Dec 10, 2024)",
92
93
  0x674E0D13: "Cobalt Strike 4.10.1 (Dec 10, 2024)",
93
94
  0x674E0D17: "Cobalt Strike 4.10.1 (Dec 10, 2024)",
{dissect_cobaltstrike-1.2.1.dev14 → dissect_cobaltstrike-1.2.2.dev2}/pyproject.toml RENAMED
@@ -13,7 +13,7 @@ authors = [
13
13
  {name = "Yun Zheng Hu", email = "hu@fox-it.com"},
14
14
  ]
15
15
  dependencies = [
16
- "dissect.cstruct >= 4.2",
16
+ "dissect.cstruct >= 4.6.dev",
17
17
  "lark",
18
18
  ]
19
19
  keywords = ["dissect", "cobaltstrike", "beacon", "parser", "parsing", "lark", "cstruct"]