dissect.cobaltstrike 1.2.2.dev2__py3-none-any.whl → 1.2.2.dev3__py3-none-any.whl

dissect/cobaltstrike/_version.py

@@ -1,21 +1,24 @@
-# file generated by setuptools-scm
+# file generated by vcs-versioning
 # don't change, don't track in version control
+from __future__ import annotations
 
-__all__ = ["__version__", "__version_tuple__", "version", "version_tuple"]
-
-TYPE_CHECKING = False
-if TYPE_CHECKING:
-    from typing import Tuple
-    from typing import Union
-
-    VERSION_TUPLE = Tuple[Union[int, str], ...]
-else:
-    VERSION_TUPLE = object
+__all__ = [
+    "__version__",
+    "__version_tuple__",
+    "version",
+    "version_tuple",
+    "__commit_id__",
+    "commit_id",
+]
 
 version: str
 __version__: str
-__version_tuple__: VERSION_TUPLE
-version_tuple: VERSION_TUPLE
+__version_tuple__: tuple[int | str, ...]
+version_tuple: tuple[int | str, ...]
+commit_id: str | None
+__commit_id__: str | None
+
+__version__ = version = '1.2.2.dev3'
+__version_tuple__ = version_tuple = (1, 2, 2, 'dev3')
 
-__version__ = version = '1.2.2.dev2'
-__version_tuple__ = version_tuple = (1, 2, 2, 'dev2')
+__commit_id__ = commit_id = None

dissect/cobaltstrike/beacon.py

@@ -369,7 +369,7 @@ def iter_beacon_config_blocks(
     # Try XorEncoded files first as they are more common
     if not found and xordecode:
         try:
-            fxor = cast(BinaryIO, XorEncodedFile.from_file(fobj))
+            fxor = cast("BinaryIO", XorEncodedFile.from_file(fobj))
             for xorkey in xor_keys:
                 for config_block in find_beacon_config_bytes(fxor, xorkey):
                     found = True

dissect/cobaltstrike/guardrails.py

@@ -23,9 +23,10 @@ import logging
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, BinaryIO
 
-from dissect.cobaltstrike.utils import grouper, u32be, xor
 from dissect.cstruct import cstruct
 
+from dissect.cobaltstrike.utils import grouper, u32be, xor
+
 if TYPE_CHECKING:
     from collections.abc import Iterator
 
@@ -172,7 +173,6 @@ def payload_checksum(data: bytes) -> int:
 
 def iter_guardrail_configs_with_beacon(fh: BinaryIO) -> Iterator[GuardrailMetadata]:
     for grconfig in iter_guardrail_configs(fh):
-
         # Unmask the beacon config, static single byte xor key should be 0x2E unless modified beacon
         # The beacon config is still masked with the environmental key
         grconfig.beacon_xor_key = b"\x2e"  # we currently only support the XOR default key

dissect/cobaltstrike/pe.py

@@ -8,6 +8,10 @@ import io
 import logging
 from typing import BinaryIO, Optional, Tuple
 
+from dissect.executable import PE
+from dissect.executable.pe.c_pe import c_pe
+from dissect.util.stream import OverlayStream, RangeStream
+
 from dissect import cstruct
 
 logger = logging.getLogger(__name__)
@@ -174,6 +178,39 @@ pestruct.load(PE_DEF)
 DOSHEADER_X64 = bytes.fromhex("554889e54881")
 DOSHEADER_X86 = bytes.fromhex("e8000000005b")
 
+NT_SIGNATURE = c_pe.IMAGE_NT_SIGNATURE.to_bytes(4, "little")
+OS2_SIGNATURE = c_pe.IMAGE_OS2_SIGNATURE.to_bytes(4, "little")
+IMAGE_DOS_SIGNATURE = c_pe.IMAGE_DOS_SIGNATURE.to_bytes(2, "little")
+
+
+class LenientPE(PE):
+    """Wrapper around :class:`dissect.executable.PE` that is lenient towards invalid PE signatures.
+
+    This is accomplished by using an OverlayStream to patch the PE signature when it's invalid.
+
+    It currently overlays the following fixes:
+
+        - Invalid PE signature (not "PE\0\0")
+        - Invalid MZ signature (not "MZ")
+    """
+
+    def __init__(self, fh: BinaryIO) -> None:
+        fh.seek(0)
+        mz_header = c_pe.IMAGE_DOS_HEADER(fh)
+        overlay = OverlayStream(fh, size=fh.seek(0, io.SEEK_END))
+        if mz_header.e_magic != c_pe.IMAGE_DOS_SIGNATURE:
+            logger.debug("Patching invalid MZ signature: %r -> %r", mz_header.e_magic, IMAGE_DOS_SIGNATURE)
+            overlay.add(0, IMAGE_DOS_SIGNATURE)
+            fh = overlay
+
+        fh.seek(mz_header.e_lfanew, io.SEEK_SET)
+        signature = fh.read(4)
+        if signature not in (NT_SIGNATURE, OS2_SIGNATURE):
+            logger.debug("Patching invalid PE signature: %r -> %r", signature, NT_SIGNATURE)
+            overlay.add(mz_header.e_lfanew, NT_SIGNATURE)
+            fh = overlay
+        super().__init__(fh)
+
 
 def find_mz_offset(fh: BinaryIO, start_offset: int = 0, maxrange: int = 1024) -> Optional[int]:
     """Find and return the start offset of a valid IMAGE_DOS_HEADER or ``None`` if it cannot be found.
@@ -226,35 +263,15 @@ def find_compile_stamps(
         Tuple with ``(IMAGE_FILE_HEADER.TimeDateStamp, IMAGE_EXPORT_DIRECTORY.TimeDateStamp)``.
         Either tuple values can be ``None`` if it's not found.
     """
-    mz_offset = find_mz_offset(fh, start_offset=start_offset, maxrange=maxrange)
-    if mz_offset is None:
-        return (None, None)
-
     compile_stamp = None
     export_stamp = None
-    fh.seek(mz_offset)
-    mz = pestruct.IMAGE_DOS_HEADER(fh)
-    fh.seek(mz.e_lfanew + mz_offset)
-    signature = pestruct.uint32(fh).to_bytes(4, "little")
-    logger.debug("PE signature: %r", signature)
-    image = pestruct.IMAGE_FILE_HEADER(fh)
-    compile_stamp = image.TimeDateStamp
-    if image.Machine == pestruct.IMAGE_FILE_MACHINE_AMD64:
-        optional_header = pestruct.IMAGE_OPTIONAL_HEADER64(fh)
-    else:
-        optional_header = pestruct.IMAGE_OPTIONAL_HEADER(fh)
-    export_dd = optional_header.DataDirectory[pestruct.IMAGE_DIRECTORY_ENTRY_EXPORT]
-    sections = [pestruct.IMAGE_SECTION_HEADER(fh) for _ in range(image.NumberOfSections)]
-    ds = None
-    for section in sections:
-        if section.VirtualAddress <= export_dd.VirtualAddress < (section.VirtualAddress + section.VirtualSize):
-            ds = section
-            break
-    if ds is not None:
-        offset = export_dd.VirtualAddress - ds.VirtualAddress + ds.PointerToRawData + mz_offset
-        fh.seek(offset)
-        export_dir = pestruct.IMAGE_EXPORT_DIRECTORY(fh)
-        export_stamp = export_dir.TimeDateStamp
+
+    mz_offset = find_mz_offset(fh, start_offset=start_offset, maxrange=maxrange)
+    if mz_offset is not None:
+        pe = LenientPE(RangeStream(fh, offset=mz_offset, size=None))
+        compile_stamp = int(pe.timestamp.timestamp())
+        export_stamp = int(pe.exports.timestamp.timestamp()) if pe.exports else None
+
     return (compile_stamp, export_stamp)
 
 

dissect/cobaltstrike/xordecode.py

@@ -118,7 +118,7 @@ class XorEncodedFile(io.RawIOBase):
             logger.debug(f"Found common nonce offset: {offset} ({count})")
             found_nonce_offset = offset
             xf = cls(fh, nonce_offset=found_nonce_offset)
-            if pe.find_mz_offset(cast(BinaryIO, xf)) is not None:
+            if pe.find_mz_offset(cast("BinaryIO", xf)) is not None:
                 xf.seek(0)
                 return xf
         raise ValueError(f"MZ header not found for: {fh}")

{dissect_cobaltstrike-1.2.2.dev2.dist-info → dissect_cobaltstrike-1.2.2.dev3.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.cobaltstrike
-Version: 1.2.2.dev2
+Version: 1.2.2.dev3
 Summary: a Python library for dissecting Cobalt Strike related data
 Project-URL: Homepage, https://github.com/fox-it/dissect.cobaltstrike
 Project-URL: Documentation, https://dissect-cobaltstrike.readthedocs.io/
@@ -19,17 +19,19 @@ Classifier: Operating System :: MacOS :: MacOS X
 Classifier: Operating System :: Microsoft :: Windows
 Classifier: Operating System :: POSIX
 Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Scientific/Engineering :: Information Analysis
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Utilities
-Requires-Python: >=3.9
-Requires-Dist: dissect-cstruct>=4.6.dev
+Requires-Python: >=3.10
+Requires-Dist: dissect-cstruct>=4.7
+Requires-Dist: dissect-executable>=1.11
+Requires-Dist: dissect-util>=3.24
 Requires-Dist: lark
 Provides-Extra: c2
 Requires-Dist: flow-record; extra == 'c2'
@@ -99,7 +101,7 @@ If you want to install the latest pre-release version, use the ``--pre`` flag::
 
    $ pip install --pre dissect.cobaltstrike
 
-**dissect.cobaltstrike** requires Python 3.9 or later.
+**dissect.cobaltstrike** requires Python 3.10 or later.
 
 Documentation
 -------------

{dissect_cobaltstrike-1.2.2.dev2.dist-info → dissect_cobaltstrike-1.2.2.dev3.dist-info}/RECORD

@@ -6,7 +6,7 @@ docs/codespell-ignore-words.txt,sha256=R-rpUcpRDSYatkyoNGLtCBjB6jsZ2OQED-aDBtwUD
 docs/conf.py,sha256=r4z3EF5svm0-1RzL2VfCAydvuAzdpxw0yZsTNMS_lok,3209
 docs/examples.rst,sha256=Qw58xLGIaAeUfvexKzriU_KZH1UJkrLEW3SGLlSS4ZM,17947
 docs/index.rst,sha256=kFNp5D-xPdXII1YJhmKbcCFMxLnsfXkg6y41UvPcS6w,1452
-docs/installation.rst,sha256=4831YRv1atkMtBLoyzx5XySznLDERrNWgi5FPI2GzxQ,2737
+docs/installation.rst,sha256=vwJGWr-CY8Ygw9HZcBB2uz--F4ti-NU9bOMVZdJ21HY,3048
 docs/license.rst,sha256=vqdBO50raQicLlpFkAOTiBXFGOS9Pqa5i1m0O0Hjrxw,51
 docs/_ext/generate_beacon_version_csv.py,sha256=Fd4iwsGOY2E6RhXmPoS_eW0iZUeq6FRxY-YXQEZULfU,1020
 docs/images/beacon-client.png,sha256=zWGE7pqVWkanQL-InqVhtTJfTspYj5lejyJqe161T0o,125032
@@ -32,9 +32,9 @@ docs/tutorials/decrypt_cobaltstrike_pcaps.rst,sha256=5UcotEi5NV4SFfrdOb0jUNEe3Tf
 docs/tutorials/index.rst,sha256=Pf7J869qAYdDcwGqpwmrvPxyygrFe0S13lr2yKrnw7c,185
 docs/tutorials/minimal_beacon_client.rst,sha256=Y0EGR4pMI6Heg6Iux740EM2Pn-iViIcub0UBU5r0tAg,15999
 tests/conftest.py,sha256=TiTzz35pXHXMr_XbaZhZogyhPjjIbstCBoSU_YJAdK8,3031
-tests/test_beacon.py,sha256=4iBhFAA-ysRtOE9LbDGKf_6E57dkcyhvN4xnElCLPzg,13518
+tests/test_beacon.py,sha256=HxG-z13jaedG2Ql1K7awvXI8acitg_vV8TT7-s_FT_I,13505
 tests/test_c2.py,sha256=6d4YyjSGdIZuVx77Uo3zln-l6H9ZNL4dLr-gfJOS7Nk,16498
-tests/test_c2profile.py,sha256=SVLE0oV2wRMOmLipHaxASepcfaL0ShfKILskrNRlXkY,13466
+tests/test_c2profile.py,sha256=ChRbE9wys6eRQIgSu3vrfGQT9LXnoynZ-YMuJOi6iXI,13466
 tests/test_client.py,sha256=FrUKF1VJ5MZUWJwosbLsorncOTEHfMTxUp0FfDulBQc,9597
 tests/test_guardrails.py,sha256=GHTSjPiccmYbRLVdM-ywTYHOErq8AdVTt3_p8v8IfiA,2435
 tests/test_pe.py,sha256=RKpNAyI5EgkeCdpJN1fCj5KdW1AFacN7dSTqwpix0dc,1525
@@ -42,22 +42,22 @@ tests/test_utils.py,sha256=eW6q0_H4FbhpEwWeZo-VPkXe-yVRA-dqUZ1WVN8ioEo,3338
 tests/test_version.py,sha256=tTFOOeC-sIMOrAFpwgvneXQIWw3PdADv4X1kVzelmNM,3020
 tests/test_xordecode.py,sha256=0Bl86caRm56_Du7JZnCLLV1voev7xto4JKBfeWGVavI,1749
 dissect/cobaltstrike/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-dissect/cobaltstrike/_version.py,sha256=OCgz16bnwObLiXNdg7N1Y99-53IX5ZXcvHJ7ECPLWzg,524
+dissect/cobaltstrike/_version.py,sha256=OT805r5ytBBbFm-nzh0_TFyltiw5O101etZdrZ3nz44,533
 dissect/cobaltstrike/artifact.py,sha256=NPeDMWh8wToae6h3MhZqFIq3QT4zXIZn5xWzeKFQPdk,4087
-dissect/cobaltstrike/beacon.py,sha256=WuDFanCMApJPLzioZxqwMFLbW-v-xouPyzgtHQgR27E,43270
+dissect/cobaltstrike/beacon.py,sha256=NJCuyZMX_MIGSaj_RgzDZvNk5b-xyU3crjmPomZ4oR0,43272
 dissect/cobaltstrike/c2.py,sha256=gQbwAjZYwd1GdX6Tb1pz807c9ykD-DlNjC1_lWATo50,25285
 dissect/cobaltstrike/c2profile.lark,sha256=WHieIq07d03qntTrqkYw-I3p-_qznBE6SwegDnrSFdI,12408
 dissect/cobaltstrike/c2profile.py,sha256=SVRQS4cxm-rhkiF-NQfgNspxZojW63lkKTgDUDBZ9Co,32678
 dissect/cobaltstrike/c_c2.py,sha256=1Z791qjUEqgSNyZHmxtNQz78S7FG3VGwWXfshE7kalc,5284
 dissect/cobaltstrike/client.py,sha256=McxoKHwbSp5V-OD5o6lySna6sYzUPM5F10npJdL_6X8,28327
-dissect/cobaltstrike/guardrails.py,sha256=YBi-Wt5Kh3tTXRTAnR8MN67nxNtfph_i26q4COMeIv4,7152
+dissect/cobaltstrike/guardrails.py,sha256=QdpaHsXX8YqN-tNzMyMpeEjScQSmNt0Wp4zxyAtOrOk,7152
 dissect/cobaltstrike/pcap.py,sha256=Q7tUn5yBHPVVnw_ys3lNA-YYeMi3vi_Lj61XHBSthlU,15314
-dissect/cobaltstrike/pe.py,sha256=bEdasnP5BIOEjoFKebtbpvl5Zd6NlwkbqoBsyOesHhI,13968
+dissect/cobaltstrike/pe.py,sha256=L555QiSQIjqpfWQ68hBwZJ90_0fqI8DqzZeR7UXzq38,14510
 dissect/cobaltstrike/utils.py,sha256=o5w5PdpTPZUaKlgegqi-50VjRyIcat7m2Yp3fQiM1pQ,8976
 dissect/cobaltstrike/version.py,sha256=axzv9UNg9fBYLg1wsl6JOj62RmYGO3OBeSIM6zNFYSk,6748
-dissect/cobaltstrike/xordecode.py,sha256=A_1wTiYYc6DEVrKwfiBJZuQkCZS_FyzMPMfApzxXgCQ,8838
-dissect_cobaltstrike-1.2.2.dev2.dist-info/METADATA,sha256=G7pZMQyVkizrAiUrMHUfJtMz8Zey5zyWsqzhax5XAxo,8913
-dissect_cobaltstrike-1.2.2.dev2.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-dissect_cobaltstrike-1.2.2.dev2.dist-info/entry_points.txt,sha256=xf-wJSa9XS2vurnI0aGRFLdUY3qwXD7iWWFBxKp6Lx4,320
-dissect_cobaltstrike-1.2.2.dev2.dist-info/licenses/LICENSE,sha256=HwS45y5toEVmu15ev5771OiuMXCittB6HXO6BZXNBLA,1074
-dissect_cobaltstrike-1.2.2.dev2.dist-info/RECORD,,
+dissect/cobaltstrike/xordecode.py,sha256=e-QJ5KnO0PFE5Mjdt37ModfTDzJWd1_EYmKCcoXPSPA,8840
+dissect_cobaltstrike-1.2.2.dev3.dist-info/METADATA,sha256=mA2f6CSWi2mj7KwhcPot3Ri-OLWFgu6gkAzw2WmLgOo,8986
+dissect_cobaltstrike-1.2.2.dev3.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
+dissect_cobaltstrike-1.2.2.dev3.dist-info/entry_points.txt,sha256=xf-wJSa9XS2vurnI0aGRFLdUY3qwXD7iWWFBxKp6Lx4,320
+dissect_cobaltstrike-1.2.2.dev3.dist-info/licenses/LICENSE,sha256=HwS45y5toEVmu15ev5771OiuMXCittB6HXO6BZXNBLA,1074
+dissect_cobaltstrike-1.2.2.dev3.dist-info/RECORD,,

{dissect_cobaltstrike-1.2.2.dev2.dist-info → dissect_cobaltstrike-1.2.2.dev3.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: hatchling 1.27.0
+Generator: hatchling 1.31.0
 Root-Is-Purelib: true
 Tag: py3-none-any

docs/installation.rst

@@ -7,12 +7,16 @@ The easiest way to install ``dissect.cobaltstrike`` is to use **pip**:
 
     $ pip install dissect.cobaltstrike
 
-Python 3.9 or higher is required and it has the following dependencies:
+Python 3.10 or higher is required and it has the following dependencies:
 
 * dissect.cstruct_ - for structure parsing
+* dissect.executable_ - for PE parsing
+* dissect.util_ - for useful file stream functions
 * lark_ - for parsing malleable c2 profiles
 
 .. _dissect.cstruct: https://github.com/fox-it/dissect.cstruct
+.. _dissect.executable: https://github.com/fox-it/dissect.executable
+.. _dissect.util: https://github.com/fox-it/dissect.util
 .. _lark: https://github.com/lark-parser/lark
 
 The following pip `extras` flavours are provided as well:
@@ -79,12 +83,18 @@ run tests with `checksum8` in the name including verbose and stdout logging:
 Linting
 -------
 
-For linting (black and flake8):
+For linting, run:
 
 .. code-block:: shell
 
      $ tox -e lint
 
+If there are any linting issues you can try to "fix" them using:
+
+.. code-block:: shell
+
+     $ tox -e fix
+
 Documentation
 -------------
 

tests/test_beacon.py

@@ -130,9 +130,7 @@ def test_setting_useragent_edgecase():
     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
     00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
     00 00 00 00 00 00
-    """.replace(
-        "\n", ""
-    )
+    """.replace("\n", "")
     config = beacon.BeaconConfig(bytes.fromhex(data))
 
     ua = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)"  # noqa: E501
@@ -290,7 +288,7 @@ def test_main(capfdbinary, request, fixture, options, ret, stdout, stderr):
 def test_beacon_public_key(beacon_x86_file):
     bconfig = beacon.BeaconConfig.from_file(beacon_x86_file)
     assert bconfig.public_key == bytes.fromhex(
-        "30819f300d06092a864886f70d010101050003818d0030818902818100c9bc2d82418688a2e4f8d645ca54dacce652ef725189444fa2def7acfaf0b40000d45933eceb80e7fc1e1e2a540a3e96c2ffc22026369d0ff07da59898f1752593876f69a80b763042abbb92c52f8a85556c5f8e8b052060231684e007a866fc010f69f4c1d79e236b1b90cbc3861bf9b3a366cf5dac02d39519dafc717dece50203010001"  # noqa: 501
+        "30819f300d06092a864886f70d010101050003818d0030818902818100c9bc2d82418688a2e4f8d645ca54dacce652ef725189444fa2def7acfaf0b40000d45933eceb80e7fc1e1e2a540a3e96c2ffc22026369d0ff07da59898f1752593876f69a80b763042abbb92c52f8a85556c5f8e8b052060231684e007a866fc010f69f4c1d79e236b1b90cbc3861bf9b3a366cf5dac02d39519dafc717dece50203010001"  # noqa: E501
     )
     assert hashlib.sha256(bconfig.public_key).hexdigest() == bconfig.settings["SETTING_PUBKEY"]
 

tests/test_c2profile.py

@@ -62,7 +62,7 @@ def test_c2profile_generator():
 
 
 def test_value_to_string():
-    val = b"\xCA\xFE\xBA\xBE"
+    val = b"\xca\xfe\xba\xbe"
     assert c2profile.value_to_string(val) == '"\\xca\\xfe\\xba\\xbe"'
     val = b"\x00\x22\x27"
     assert c2profile.value_to_string(val) == '"\\x00\\"\'"'