dissect.cobaltstrike 1.2.1.dev2__tar.gz → 1.2.1.dev3__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/PKG-INFO +1 -1
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/_version.py +2 -2
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/tests/conftest.py +8 -17
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/tox.ini +1 -1
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/.github/workflows/dissect-ci.yml +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/.gitignore +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/.lfs-assets-id +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/.pre-commit-config.yaml +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/.readthedocs.yml +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/LICENSE +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/README.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/codecov.yml +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/__init__.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/artifact.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/beacon.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/c2.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/c2profile.lark +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/c2profile.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/c_c2.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/client.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/pcap.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/pe.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/utils.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/version.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/xordecode.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/Makefile +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/c2profile-grammar.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/codespell-ignore-words.txt +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/conf.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/examples.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/images/beacon-client.png +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/images/teamserver-echoclient.png +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/images/teamserver_ls.png +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/images/vt-cobaltstrike-43-zip.png +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/index.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/installation.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/license.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/scripts/checksum8-accesslogs.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/scripts/dump_beacon_keys.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/scripts/example_client.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/scripts/index.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/structures/c2_def.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/structures/cs_def.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/structures/index.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/structures/pe_def.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/tools/beacon-artifact.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/tools/beacon-client.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/tools/beacon-dump.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/tools/beacon-pcap.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/tools/beacon-xordecode.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/tools/c2profile-dump.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/tutorials/decrypt_cobaltstrike_pcaps.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/tutorials/index.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/tutorials/minimal_beacon_client.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/pyproject.toml +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/scripts/checksum8-accesslogs.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/scripts/dump_beacon_keys.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/scripts/example_client.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/tests/test_beacon.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/tests/test_c2.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/tests/test_c2profile.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/tests/test_client.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/tests/test_pe.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/tests/test_utils.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/tests/test_version.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/tests/test_xordecode.py +0 -0
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.3
|
|
2
2
|
Name: dissect.cobaltstrike
|
|
3
|
-
Version: 1.2.1.
|
|
3
|
+
Version: 1.2.1.dev3
|
|
4
4
|
Summary: a Python library for dissecting Cobalt Strike related data
|
|
5
5
|
Project-URL: Homepage, https://github.com/fox-it/dissect.cobaltstrike
|
|
6
6
|
Project-URL: Documentation, https://dissect-cobaltstrike.readthedocs.io/
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/_version.py
RENAMED
|
@@ -12,5 +12,5 @@ __version__: str
|
|
|
12
12
|
__version_tuple__: VERSION_TUPLE
|
|
13
13
|
version_tuple: VERSION_TUPLE
|
|
14
14
|
|
|
15
|
-
__version__ = version = '1.2.1.
|
|
16
|
-
__version_tuple__ = version_tuple = (1, 2, 1, '
|
|
15
|
+
__version__ = version = '1.2.1.dev3'
|
|
16
|
+
__version_tuple__ = version_tuple = (1, 2, 1, 'dev3')
|
|
@@ -1,6 +1,5 @@
|
|
|
1
1
|
import io
|
|
2
2
|
import zipfile
|
|
3
|
-
from contextlib import contextmanager
|
|
4
3
|
from pathlib import Path
|
|
5
4
|
|
|
6
5
|
import pytest
|
|
@@ -31,15 +30,14 @@ def generate_beacon_file_fixture(filename):
|
|
|
31
30
|
beacon_zip_path = testpath / "beacons" / filename
|
|
32
31
|
if not beacon_zip_path.exists():
|
|
33
32
|
pytest.skip(f"Beacon {beacon_zip_path!r} not found")
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
yield fh
|
|
33
|
+
|
|
34
|
+
# Extract the beacon file from the zip archive
|
|
35
|
+
with zipfile.ZipFile(beacon_zip_path) as zf:
|
|
36
|
+
data = zf.read(beacon_zip_path.stem, pwd=b"dissect.cobaltstrike")
|
|
37
|
+
|
|
38
|
+
# Return the beacon file as a BytesIO object
|
|
39
|
+
with io.BytesIO(data) as fh:
|
|
40
|
+
yield fh
|
|
43
41
|
|
|
44
42
|
return my_fixture
|
|
45
43
|
|
|
@@ -86,13 +84,6 @@ for name, filename in beacons.items():
|
|
|
86
84
|
inject_beacon_bconfig_fixture(name)
|
|
87
85
|
|
|
88
86
|
|
|
89
|
-
@contextmanager
|
|
90
|
-
def unzip_beacon_as_fh(zip_file, pwd=b"dissect.cobaltstrike"):
|
|
91
|
-
"""Return file object of beacon from zipfile"""
|
|
92
|
-
with zipfile.ZipFile(zip_file) as zf:
|
|
93
|
-
yield zf.open(zip_file.stem, pwd=pwd)
|
|
94
|
-
|
|
95
|
-
|
|
96
87
|
@pytest.fixture()
|
|
97
88
|
def beacon_x64_config_block(beacon_x64_file):
|
|
98
89
|
return beacon.BeaconConfig.from_file(beacon_x64_file).config_block
|
|
@@ -4,7 +4,7 @@ envlist = py3,pypy3
|
|
|
4
4
|
[testenv]
|
|
5
5
|
usedevelop = true
|
|
6
6
|
extras = test
|
|
7
|
-
commands = pytest --cov=dissect.cobaltstrike --cov-context=test --cov-report=xml {posargs}
|
|
7
|
+
commands = pytest -v --cov=dissect.cobaltstrike --cov-context=test --cov-report=xml {posargs}
|
|
8
8
|
|
|
9
9
|
[testenv:docs]
|
|
10
10
|
extras = docs
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/.github/workflows/dissect-ci.yml
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/__init__.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/artifact.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/beacon.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/c2.py
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/c_c2.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/client.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/pcap.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/pe.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/utils.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/dissect/cobaltstrike/version.py
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/c2profile-grammar.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/codespell-ignore-words.txt
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/images/beacon-client.png
RENAMED
|
File without changes
|
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/images/teamserver_ls.png
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/scripts/example_client.rst
RENAMED
|
File without changes
|
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/structures/c2_def.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/structures/cs_def.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/structures/index.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/structures/pe_def.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/tools/beacon-artifact.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/tools/beacon-client.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/tools/beacon-dump.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/tools/beacon-pcap.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/tools/beacon-xordecode.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/tools/c2profile-dump.rst
RENAMED
|
File without changes
|
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/docs/tutorials/index.rst
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/scripts/checksum8-accesslogs.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/scripts/dump_beacon_keys.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev3}/scripts/example_client.py
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|