dissect.cobaltstrike 1.2.1.dev1__tar.gz → 1.2.1.dev3__tar.gz

{dissect_cobaltstrike-1.2.1.dev1 → dissect_cobaltstrike-1.2.1.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: dissect.cobaltstrike
-Version: 1.2.1.dev1
+Version: 1.2.1.dev3
 Summary: a Python library for dissecting Cobalt Strike related data
 Project-URL: Homepage, https://github.com/fox-it/dissect.cobaltstrike
 Project-URL: Documentation, https://dissect-cobaltstrike.readthedocs.io/

{dissect_cobaltstrike-1.2.1.dev1 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/_version.py

@@ -12,5 +12,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '1.2.1.dev1'
-__version_tuple__ = version_tuple = (1, 2, 1, 'dev1')
+__version__ = version = '1.2.1.dev3'
+__version_tuple__ = version_tuple = (1, 2, 1, 'dev3')

{dissect_cobaltstrike-1.2.1.dev1 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/beacon.py

@@ -794,7 +794,7 @@ class BeaconConfig:
         for setting in self.settings_tuple:
             val = setting.value
             if index_type == "name":
-                key = setting.index.name or str(setting.index)
+                key = setting.index.name or str(setting.index).replace(".", "_")
             elif index_type == "const":
                 key = setting.index.value
             else:

{dissect_cobaltstrike-1.2.1.dev1 → dissect_cobaltstrike-1.2.1.dev3}/tests/conftest.py

@@ -1,6 +1,5 @@
 import io
 import zipfile
-from contextlib import contextmanager
 from pathlib import Path
 
 import pytest
@@ -31,15 +30,14 @@ def generate_beacon_file_fixture(filename):
         beacon_zip_path = testpath / "beacons" / filename
         if not beacon_zip_path.exists():
             pytest.skip(f"Beacon {beacon_zip_path!r} not found")
-        with unzip_beacon_as_fh(beacon_zip_path) as beacon_file:
-            # ZipExtFile.seek() raises io.UnsupportedOperation on Python 3.6
-            try:
-                beacon_file.seek(0)
-                yield beacon_file
-            except io.UnsupportedOperation:
-                # fallback to BytesIO
-                with io.BytesIO(beacon_file.read()) as fh:
-                    yield fh
+
+        # Extract the beacon file from the zip archive
+        with zipfile.ZipFile(beacon_zip_path) as zf:
+            data = zf.read(beacon_zip_path.stem, pwd=b"dissect.cobaltstrike")
+
+        # Return the beacon file as a BytesIO object
+        with io.BytesIO(data) as fh:
+            yield fh
 
     return my_fixture
 
@@ -86,13 +84,6 @@ for name, filename in beacons.items():
     inject_beacon_bconfig_fixture(name)
 
 
-@contextmanager
-def unzip_beacon_as_fh(zip_file, pwd=b"dissect.cobaltstrike"):
-    """Return file object of beacon from zipfile"""
-    with zipfile.ZipFile(zip_file) as zf:
-        yield zf.open(zip_file.stem, pwd=pwd)
-
-
 @pytest.fixture()
 def beacon_x64_config_block(beacon_x64_file):
     return beacon.BeaconConfig.from_file(beacon_x64_file).config_block

{dissect_cobaltstrike-1.2.1.dev1 → dissect_cobaltstrike-1.2.1.dev3}/tests/test_beacon.py

@@ -314,12 +314,12 @@ def test_beacon_domains_punycode(punycode_beacon_file):
 
 
 def test_beacon_setting_unknown_enum():
-    setting = (
-        beacon.cs_struct.uint16(6969).dumps(),
-        beacon.SettingsType.TYPE_PTR.dumps(),
-        beacon.cs_struct.uint16(3).dumps(),
-        b"foo",
-    )
-    config = beacon.BeaconConfig(b"".join(setting))
+    data = beacon.Setting(
+        index=beacon.BeaconSetting(6969),
+        type=beacon.SettingsType.TYPE_PTR,
+        length=3,
+        value=b"foo",
+    ).dumps()
+    config = beacon.BeaconConfig(data)
     assert None not in config.settings
-    assert dict(config.settings) == {"BeaconSetting.6969": b"foo"}
+    assert dict(config.settings) == {"BeaconSetting_6969": b"foo"}

{dissect_cobaltstrike-1.2.1.dev1 → dissect_cobaltstrike-1.2.1.dev3}/tox.ini

@@ -4,7 +4,7 @@ envlist = py3,pypy3
 [testenv]
 usedevelop = true
 extras = test
-commands = pytest --cov=dissect.cobaltstrike --cov-context=test --cov-report=xml {posargs}
+commands = pytest -v --cov=dissect.cobaltstrike --cov-context=test --cov-report=xml {posargs}
 
 [testenv:docs]
 extras = docs