dissect.target 3.14.dev22__tar.gz → 3.14.dev23__tar.gz

{dissect.target-3.14.dev22/dissect.target.egg-info → dissect.target-3.14.dev23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.14.dev22
+Version: 3.14.dev23
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.14.dev22 → dissect.target-3.14.dev23}/dissect/target/loaders/smb.py

@@ -11,6 +11,7 @@ from urllib.parse import ParseResult, parse_qsl
 from dissect.regf import regf
 from dissect.util import ts
 from impacket.dcerpc.v5 import rpcrt, rrp, scmr, transport
+from impacket.dcerpc.v5.rpcrt import DCERPCException
 from impacket.smbconnection import SessionError, SMBConnection
 
 from dissect.target import Target
@@ -189,18 +190,24 @@ class SmbRegistry(RegistryPlugin):
         return False
 
     def _init_registry(self) -> None:
-        self._svcctl = _connect_rpc(self.conn, "ncacn_np:445[\\pipe\\svcctl]", scmr.MSRPC_UUID_SCMR)
-        self._check_service_status()
+        try:
+            self._svcctl = _connect_rpc(self.conn, "ncacn_np:445[\\pipe\\svcctl]", scmr.MSRPC_UUID_SCMR)
+            self._check_service_status()
 
-        self._winreg = _connect_rpc(self.conn, "ncacn_np:445[\\pipe\\winreg]", rrp.MSRPC_UUID_RRP)
+            self._winreg = _connect_rpc(self.conn, "ncacn_np:445[\\pipe\\winreg]", rrp.MSRPC_UUID_RRP)
 
-        hklm_hive = SmbRegistryHive(self._winreg, "HKEY_LOCAL_MACHINE", rrp.hOpenLocalMachine(self._winreg)["phKey"])
-        hku_hive = SmbRegistryHive(self._winreg, "HKEY_USERS", rrp.hOpenUsers(self._winreg)["phKey"])
+            hklm_hive = SmbRegistryHive(
+                self._winreg, "HKEY_LOCAL_MACHINE", rrp.hOpenLocalMachine(self._winreg)["phKey"]
+            )
+            hku_hive = SmbRegistryHive(self._winreg, "HKEY_USERS", rrp.hOpenUsers(self._winreg)["phKey"])
 
-        self._add_hive("HKLM", hklm_hive, TargetPath(self.target.fs, "HKLM"))
-        self._add_hive("HKU", hku_hive, TargetPath(self.target.fs, "HKU"))
-        self._map_hive("HKEY_LOCAL_MACHINE", hklm_hive)
-        self._map_hive("HKEY_USERS", hku_hive)
+            self._add_hive("HKLM", hklm_hive, TargetPath(self.target.fs, "HKLM"))
+            self._add_hive("HKU", hku_hive, TargetPath(self.target.fs, "HKU"))
+            self._map_hive("HKEY_LOCAL_MACHINE", hklm_hive)
+            self._map_hive("HKEY_USERS", hku_hive)
+        except SessionError:
+            self.target.log.info("Failed to open remote registry, registry will not be available")
+            return  # no registry access, probably no access rights
 
     def _init_users(self) -> None:
         pass
@@ -212,15 +219,18 @@ class SmbRegistry(RegistryPlugin):
         if hasattr(self, "_was_disabled") and self._was_disabled:
             scmr.hRChangeServiceConfigW(self._svcctl, self._svc_handle, dwStartType=0x4)
 
-        if hasattr(self, "_svcctl"):
+        if getattr(self, "_svcctl", None):
             self._svcctl.disconnect()
 
-        if hasattr(self, "_winreg"):
+        if getattr(self, "_winreg", None):
             self._winreg.disconnect()
 
     def _check_service_status(self) -> None:
-        manager_handle = scmr.hROpenSCManagerW(self._svcctl)["lpScHandle"]
-        self._svc_handle = scmr.hROpenServiceW(self._svcctl, manager_handle, "RemoteRegistry")["lpServiceHandle"]
+        try:
+            manager_handle = scmr.hROpenSCManagerW(self._svcctl)["lpScHandle"]
+            self._svc_handle = scmr.hROpenServiceW(self._svcctl, manager_handle, "RemoteRegistry")["lpServiceHandle"]
+        except DCERPCException:
+            return
 
         current_state = scmr.hRQueryServiceStatus(self._svcctl, self._svc_handle)["lpServiceStatus"]["dwCurrentState"]
         if current_state == scmr.SERVICE_STOPPED:

{dissect.target-3.14.dev22 → dissect.target-3.14.dev23}/dissect/target/plugins/os/windows/_os.py

@@ -77,7 +77,8 @@ class WindowsPlugin(OSPlugin):
                                             self.target.fs.mount(drive, volume.fs)
                                             break
         except Exception as e:
-            self.target.log.warning("Failed to map drive letters", exc_info=e)
+            self.target.log.warning("Failed to map drive letters")
+            self.target.log.debug("", exc_info=e)
 
     @export(property=True)
     def hostname(self) -> Optional[str]:

{dissect.target-3.14.dev22 → dissect.target-3.14.dev23}/dissect/target/target.py

@@ -426,7 +426,8 @@ class Target:
             if isinstance(os_plugin, plugin.OSPlugin):
                 self._os_plugin = os_plugin.__class__
             elif issubclass(os_plugin, plugin.OSPlugin):
-                os_plugin = os_plugin.create(self, os_plugin.detect(self))
+                if fs := os_plugin.detect(self):
+                    os_plugin = os_plugin.create(self, fs)
 
             self._os = self.add_plugin(os_plugin)
             return

{dissect.target-3.14.dev22 → dissect.target-3.14.dev23/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.14.dev22
+Version: 3.14.dev23
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.14.dev22 → dissect.target-3.14.dev23}/tests/loaders/test_smb.py

@@ -19,6 +19,7 @@ def mock_impacket(monkeypatch: pytest.MonkeyPatch) -> Iterator[MagicMock]:
         m.setitem(sys.modules, "impacket", mock_impacket)
         m.setitem(sys.modules, "impacket.dcerpc", mock_impacket.dcerpc)
         m.setitem(sys.modules, "impacket.dcerpc.v5", mock_impacket.dcerpc.v5)
+        m.setitem(sys.modules, "impacket.dcerpc.v5.rpcrt", mock_impacket.dcerpc.v5.rpcrt)
         m.setitem(sys.modules, "impacket.nt_errors", mock_impacket.nt_errors)
         m.setitem(sys.modules, "impacket.smb", mock_impacket.smb)
         m.setitem(sys.modules, "impacket.smb3structs", mock_impacket.smb3structs)