dissect.target 3.11.dev5__tar.gz → 3.11.dev6__tar.gz

{dissect.target-3.11.dev5/dissect.target.egg-info → dissect.target-3.11.dev6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.11.dev5
+Version: 3.11.dev6
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.11.dev5 → dissect.target-3.11.dev6}/dissect/target/plugins/os/windows/task_helpers/tasks_xml.py

@@ -19,11 +19,50 @@ from dissect.target.plugins.os.windows.task_helpers.tasks_records import (
     TimeTriggerRecord,
     TriggerRecord,
 )
-from dissect.target.target import Target
 
 warnings.simplefilter(action="ignore", category=FutureWarning)
 
 
+class ScheduledTasks:
+    def __init__(self, xml_file: TargetPath):
+        try:
+            self.xml_data = self.strip_namespace(ElementTree.fromstring(xml_file.open().read(), forbid_dtd=True))
+        except Exception as e:
+            raise InvalidTaskError(e)
+
+        self.task_path = xml_file
+        self.tasks = self.get_tasks()
+
+    def strip_namespace(self, data: Element) -> Element:
+        """Strip namespace from XML data.
+
+        If the data has a namespace, it will be removed from all the XML tags.
+
+        Args:
+            data: The XML data as an Element object.
+
+        Returns:
+            The XML data with the stripped namespace.
+        """
+        if data.tag.startswith("{"):
+            ns_length = data.tag.find("}")
+            ns = data.tag[0 : ns_length + 1]
+            for element in data.iter():
+                if element.tag.startswith(ns):
+                    element.tag = element.tag[len(ns) :]
+        return data
+
+    def get_tasks(self):
+        tasks = []
+        if self.xml_data.tag == "Task":
+            tasks.append(XmlTask(self.xml_data, self.task_path))
+        else:
+            for task_element in self.xml_data.findall(".//{*}Task"):
+                tasks.append(XmlTask(task_element, self.task_path))
+
+        return tasks
+
+
 class XmlTask:
     """Initialize the XmlTask class for open XML-based task files.
 
@@ -32,13 +71,21 @@ class XmlTask:
         target: the target system.
     """
 
-    def __init__(self, xml_file: TargetPath, target: Target):
-        try:
-            self.xml_data = self.strip_namespace(ElementTree.fromstring(xml_file.open().read(), forbid_dtd=True))
-        except Exception as e:
-            raise InvalidTaskError(e)
+    def __init__(self, task_element: Element, task_path: TargetPath):
+        self.task_path = task_path
+        self.task_element = task_element
+
+        # Properties
+        self.task_name = self.get_element("Properties", attribute="name")
+        self.app_name = self.get_element("Properties", attribute="appName")
+        self.args = self.get_element("Properties", attribute="args")
+        self.start_in = self.get_element("Properties", attribute="startIn")
+        self.comment = self.get_element("Properties", attribute="comment")
+        self.run_as = self.get_element("Properties", attribute="runAs")
+        self.cpassword = self.get_element("Properties", attribute="cpassword")
+        self.enabled = self.get_element("Properties", attribute="enabled")
+        self.action = self.get_element("Properties", attribute="action")
 
-        self.task_path = xml_file
         self.uri = self.get_element("RegistrationInfo/URI")
         self.security_descriptor = self.get_element("RegistrationInfo/SecurityDescriptor")
         self.source = self.get_element("RegistrationInfo/Source")
@@ -88,6 +135,8 @@ class XmlTask:
         # Data
         self.data = self.get_raw("Data")
 
+        self.raw_data = self.get_raw()
+
     def strip_namespace(self, data: Element) -> Element:
         """Strip namespace from XML data.
 
@@ -120,7 +169,7 @@ class XmlTask:
         Returns:
             str: The value of the XML element if found, otherwise None.
         """
-        xml_data = xml_data or self.xml_data
+        xml_data = xml_data or self.task_element
         data = xml_data.find(xml_path)
 
         if data is None:
@@ -130,7 +179,7 @@ class XmlTask:
 
         return data.text
 
-    def get_raw(self, xml_path: str) -> str:
+    def get_raw(self, xml_path: Optional[str] = None) -> str:
         """Get the raw XML data of the specified element.
 
         Args:
@@ -139,9 +188,9 @@ class XmlTask:
         Returns:
             bytes: The raw XML data as string of the element if found, otherwise None.
         """
-        data = self.xml_data.find(xml_path)
+        data = self.task_element.find(xml_path) if xml_path else self.task_element
         if data:
-            return ElementTree.tostring(data, encoding="utf-8")
+            return ElementTree.tostring(data, encoding="utf-8").strip()
 
     def get_triggers(self) -> Iterator[GroupedRecord]:
         """Get the triggers from the XML task data.
@@ -149,7 +198,7 @@ class XmlTask:
         Yields:
             GroupedRecord: The grouped record representing a trigger.
         """
-        for trigger in self.xml_data.findall("Triggers/*"):
+        for trigger in self.task_element.findall("Triggers/*"):
             trigger_type = trigger.tag
             enabled = self.get_element("Enabled", trigger)
             start_boundary = self.get_element("StartBoundary", trigger)
@@ -233,7 +282,7 @@ class XmlTask:
         Yields:
             ActionRecord: The action record representing an action.
         """
-        for action in self.xml_data.findall("Actions/*"):
+        for action in self.task_element.findall("Actions/*"):
             action_type = action.tag
             if action_type == "Exec":
                 command = self.get_element("Actions/Exec/Command")

{dissect.target-3.11.dev5 → dissect.target-3.11.dev6}/dissect/target/plugins/os/windows/tasks.py

@@ -7,7 +7,7 @@ from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import DynamicDescriptor, TargetRecordDescriptor
 from dissect.target.plugin import Plugin, export
 from dissect.target.plugins.os.windows.task_helpers.tasks_job import AtTask
-from dissect.target.plugins.os.windows.task_helpers.tasks_xml import XmlTask
+from dissect.target.plugins.os.windows.task_helpers.tasks_xml import ScheduledTasks
 from dissect.target.target import Target
 
 warnings.simplefilter(action="ignore", category=FutureWarning)
@@ -25,6 +25,15 @@ TaskRecord = TargetRecordDescriptor(
         ("string", "version"),
         ("string", "description"),
         ("string", "documentation"),
+        ("string", "task_name"),
+        ("string", "app_name"),
+        ("string", "args"),
+        ("string", "start_in"),
+        ("string", "comment"),
+        ("string", "run_as"),
+        ("string", "cpassword"),
+        ("string", "enabled"),
+        ("string", "action"),
         ("string", "principal_id"),
         ("string", "user_id"),
         ("string", "logon_type"),
@@ -59,6 +68,7 @@ TaskRecord = TargetRecordDescriptor(
         ("string", "unified_scheduling_engine"),
         ("string", "disallow_start_on_remote_app_session"),
         ("string", "data"),
+        ("string", "raw_data"),
     ],
 )
 
@@ -119,23 +129,24 @@ class TasksPlugin(Plugin):
         """
         for task_file in self.task_files:
             if not task_file.suffix or task_file.suffix == ".xml":
-                task_object = XmlTask(task_file, self.target)
+                task_objects = ScheduledTasks(task_file).tasks
             else:
-                task_object = AtTask(task_file, self.target)
+                task_objects = [AtTask(task_file, self.target)]
 
-            record_kwargs = {}
-            for attr in TaskRecord.fields.keys():
-                record_kwargs[attr] = getattr(task_object, attr, None)
+            for task_object in task_objects:
+                record_kwargs = {}
+                for attr in TaskRecord.fields.keys():
+                    record_kwargs[attr] = getattr(task_object, attr, None)
 
-            record = TaskRecord(**record_kwargs, _target=self.target)
-            yield record
+                record = TaskRecord(**record_kwargs, _target=self.target)
+                yield record
 
-            # Actions
-            for action in task_object.get_actions():
-                grouped = GroupedRecord("filesystem/windows/task/grouped", [record, action])
-                yield grouped
+                # Actions
+                for action in task_object.get_actions():
+                    grouped = GroupedRecord("filesystem/windows/task/grouped", [record, action])
+                    yield grouped
 
-            # Triggers
-            for trigger in task_object.get_triggers():
-                grouped = GroupedRecord("filesystem/windows/task/grouped", [record, trigger])
-                yield grouped
+                # Triggers
+                for trigger in task_object.get_triggers():
+                    grouped = GroupedRecord("filesystem/windows/task/grouped", [record, trigger])
+                    yield grouped

{dissect.target-3.11.dev5 → dissect.target-3.11.dev6/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.11.dev5
+Version: 3.11.dev6
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.11.dev5 → dissect.target-3.11.dev6}/tests/test_plugins_os_windows_tasks.py

@@ -2,6 +2,7 @@ import re
 from datetime import datetime
 
 import pytest
+from flow.record import GroupedRecord
 
 from dissect.target.plugins.os.windows.tasks import TasksPlugin
 
@@ -217,5 +218,5 @@ def test_grouped_record_properties(target_win, setup_tasks_test, assert_func, ma
     records = list(target_win.tasks())
     assert len(records) == 10
     pat = re.compile(rf"{marker}")
-    grouped_records = filter(lambda x: re.findall(pat, str(x)), records)
+    grouped_records = filter(lambda x: re.findall(pat, str(x)) and isinstance(x, GroupedRecord), records)
     assert_func(list(grouped_records)[0])