dissect.cobaltstrike 1.2.1.dev2__tar.gz → 1.2.1.dev4__tar.gz

{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: dissect.cobaltstrike
-Version: 1.2.1.dev2
+Version: 1.2.1.dev4
 Summary: a Python library for dissecting Cobalt Strike related data
 Project-URL: Homepage, https://github.com/fox-it/dissect.cobaltstrike
 Project-URL: Documentation, https://dissect-cobaltstrike.readthedocs.io/

{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev4}/dissect/cobaltstrike/_version.py

@@ -12,5 +12,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '1.2.1.dev2'
-__version_tuple__ = version_tuple = (1, 2, 1, 'dev2')
+__version__ = version = '1.2.1.dev4'
+__version_tuple__ = version_tuple = (1, 2, 1, 'dev4')

{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev4}/dissect/cobaltstrike/version.py

@@ -32,6 +32,8 @@ MAX_ENUM_TO_VERSION: Dict[int, str] = {
     70: "Cobalt Strike 4.3 (Mar 03, 2021)",
     73: "Cobalt Strike 4.5 (Dec 14, 2021)",
     74: "Cobalt Strike 4.7 (Aug 17, 2022)",
+    76: "Cobalt Strike 4.9 (Sep 19, 2023)",
+    78: "Cobalt Strike 4.10 (Jul 16, 2024)",
 }
 """ Max setting enum to Cobalt Strike version mapping """
 
@@ -77,6 +79,12 @@ PE_EXPORT_STAMP_TO_VERSION: Dict[int, str] = {
     0x63EE0552: "Cobalt Strike 4.8 (Feb 28, 2023)",
     0x63EE056C: "Cobalt Strike 4.8 (Feb 28, 2023)",
     0x63EE0587: "Cobalt Strike 4.8 (Feb 28, 2023)",
+    0x64F88C5E: "Cobalt Strike 4.9 (Sep 19, 2023)",
+    0x64F88C9E: "Cobalt Strike 4.9 (Sep 19, 2023)",
+    0x64F88CDE: "Cobalt Strike 4.9 (Sep 19, 2023)",
+    0x6691500F: "Cobalt Strike 4.10 (Jul 16, 2024)",
+    0x66915020: "Cobalt Strike 4.10 (Jul 16, 2024)",
+    0x66915022: "Cobalt Strike 4.10 (Jul 16, 2024)",
 }
 """ PE export timestamp to Cobalt Strike version mapping """
 

{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev4}/tests/conftest.py

@@ -1,6 +1,5 @@
 import io
 import zipfile
-from contextlib import contextmanager
 from pathlib import Path
 
 import pytest
@@ -31,15 +30,14 @@ def generate_beacon_file_fixture(filename):
         beacon_zip_path = testpath / "beacons" / filename
         if not beacon_zip_path.exists():
             pytest.skip(f"Beacon {beacon_zip_path!r} not found")
-        with unzip_beacon_as_fh(beacon_zip_path) as beacon_file:
-            # ZipExtFile.seek() raises io.UnsupportedOperation on Python 3.6
-            try:
-                beacon_file.seek(0)
-                yield beacon_file
-            except io.UnsupportedOperation:
-                # fallback to BytesIO
-                with io.BytesIO(beacon_file.read()) as fh:
-                    yield fh
+
+        # Extract the beacon file from the zip archive
+        with zipfile.ZipFile(beacon_zip_path) as zf:
+            data = zf.read(beacon_zip_path.stem, pwd=b"dissect.cobaltstrike")
+
+        # Return the beacon file as a BytesIO object
+        with io.BytesIO(data) as fh:
+            yield fh
 
     return my_fixture
 
@@ -86,13 +84,6 @@ for name, filename in beacons.items():
     inject_beacon_bconfig_fixture(name)
 
 
-@contextmanager
-def unzip_beacon_as_fh(zip_file, pwd=b"dissect.cobaltstrike"):
-    """Return file object of beacon from zipfile"""
-    with zipfile.ZipFile(zip_file) as zf:
-        yield zf.open(zip_file.stem, pwd=pwd)
-
-
 @pytest.fixture()
 def beacon_x64_config_block(beacon_x64_file):
     return beacon.BeaconConfig.from_file(beacon_x64_file).config_block

{dissect_cobaltstrike-1.2.1.dev2 → dissect_cobaltstrike-1.2.1.dev4}/tox.ini

@@ -4,7 +4,7 @@ envlist = py3,pypy3
 [testenv]
 usedevelop = true
 extras = test
-commands = pytest --cov=dissect.cobaltstrike --cov-context=test --cov-report=xml {posargs}
+commands = pytest -v --cov=dissect.cobaltstrike --cov-context=test --cov-report=xml {posargs}
 
 [testenv:docs]
 extras = docs