dissect.target 3.15.dev13__tar.gz → 3.15.dev14__tar.gz

{dissect.target-3.15.dev13/dissect.target.egg-info → dissect.target-3.15.dev14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.15.dev13
+Version: 3.15.dev14
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.15.dev13 → dissect.target-3.15.dev14}/dissect/target/plugins/apps/ssh/openssh.py

@@ -5,59 +5,15 @@ from typing import Iterator
 
 from dissect.target import Target
 from dissect.target.exceptions import UnsupportedPluginError
-from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
 from dissect.target.helpers.fsutil import TargetPath
-from dissect.target.helpers.record import create_extended_descriptor
 from dissect.target.helpers.ssh import SSHPrivateKey
-from dissect.target.plugin import Plugin, export
-
-OpenSSHUserRecordDescriptor = create_extended_descriptor([UserRecordDescriptorExtension])
-
-COMMON_ELLEMENTS = [
-    ("string", "key_type"),
-    ("string", "comment"),
-    ("path", "path"),
-]
-
-AuthorizedKeysRecord = OpenSSHUserRecordDescriptor(
-    "application/openssh/authorized_keys",
-    [
-        *COMMON_ELLEMENTS,
-        ("string", "public_key"),
-        ("string", "options"),
-    ],
-)
-
-
-KnownHostRecord = OpenSSHUserRecordDescriptor(
-    "application/openssh/known_host",
-    [
-        *COMMON_ELLEMENTS,
-        ("string", "hostname_pattern"),
-        ("string", "public_key"),
-        ("string", "marker"),
-    ],
-)
-
-
-PrivateKeyRecord = OpenSSHUserRecordDescriptor(
-    "application/openssh/private_key",
-    [
-        *COMMON_ELLEMENTS,
-        ("datetime", "mtime_ts"),
-        ("string", "key_format"),
-        ("string", "public_key"),
-        ("boolean", "encrypted"),
-    ],
-)
-
-PublicKeyRecord = OpenSSHUserRecordDescriptor(
-    "application/openssh/public_key",
-    [
-        *COMMON_ELLEMENTS,
-        ("datetime", "mtime_ts"),
-        ("string", "public_key"),
-    ],
+from dissect.target.plugin import export
+from dissect.target.plugins.apps.ssh.ssh import (
+    AuthorizedKeysRecord,
+    KnownHostRecord,
+    PrivateKeyRecord,
+    PublicKeyRecord,
+    SSHPlugin,
 )
 
 
@@ -72,8 +28,8 @@ def find_sshd_directory(target: Target) -> TargetPath:
     return target.fs.path("/etc/ssh/")
 
 
-class OpenSSHPlugin(Plugin):
-    __namespace__ = "ssh"
+class OpenSSHPlugin(SSHPlugin):
+    __namespace__ = "openssh"
 
     SSHD_DIRECTORIES = ["/sysvol/ProgramData/ssh", "/etc/ssh"]
 
@@ -136,7 +92,8 @@ class OpenSSHPlugin(Plugin):
 
                 for hostname in hostnames:
                     yield KnownHostRecord(
-                        hostname_pattern=hostname,
+                        host=hostname,
+                        port=None,
                         key_type=keytype,
                         public_key=public_key,
                         comment=comment,

{dissect.target-3.15.dev13 → dissect.target-3.15.dev14}/dissect/target/plugins/apps/ssh/opensshd.py

@@ -3,8 +3,9 @@ from typing import TYPE_CHECKING, Any, Callable, Iterator, Optional, Union
 from dissect.target import Target
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import DynamicDescriptor, TargetRecordDescriptor
-from dissect.target.plugin import Plugin, export
+from dissect.target.plugin import export
 from dissect.target.plugins.apps.ssh.openssh import find_sshd_directory
+from dissect.target.plugins.apps.ssh.ssh import SSHPlugin
 
 if TYPE_CHECKING:
     from dissect.target.plugins.general.config import ConfigurationTreePlugin
@@ -72,8 +73,8 @@ SSHD_MULTIPLE_DEFINITIONS_ALLOWED_FIELDS = (
 )
 
 
-class SSHServerPlugin(Plugin):
-    __namespace__ = "sshd"
+class SSHServerPlugin(SSHPlugin):
+    __namespace__ = "opensshd"
 
     def __init__(self, target: Target):
         super().__init__(target)

dissect.target-3.15.dev14/dissect/target/plugins/apps/ssh/putty.py

@@ -0,0 +1,236 @@
+import logging
+from datetime import datetime
+from pathlib import Path
+from typing import Iterator, Optional, Union
+
+from Crypto.PublicKey import ECC, RSA
+from flow.record.fieldtypes import posix_path, windows_path
+
+from dissect.target.exceptions import RegistryKeyNotFoundError, UnsupportedPluginError
+from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
+from dissect.target.helpers.fsutil import TargetPath, open_decompress
+from dissect.target.helpers.record import create_extended_descriptor
+from dissect.target.helpers.regutil import RegistryKey
+from dissect.target.plugin import export
+from dissect.target.plugins.apps.ssh.ssh import KnownHostRecord, SSHPlugin
+from dissect.target.plugins.general.users import UserDetails
+
+log = logging.getLogger(__name__)
+
+PuTTYUserRecordDescriptor = create_extended_descriptor([UserRecordDescriptorExtension])
+PuTTYSessionRecord = PuTTYUserRecordDescriptor(
+    "application/putty/saved_session",
+    [
+        ("datetime", "ts"),
+        ("string", "session_name"),
+        ("string", "protocol"),
+        ("string", "host"),
+        ("string", "user"),
+        ("varint", "port"),
+        ("string", "remote_command"),
+        ("string", "port_forward"),
+        ("string", "manual_ssh_host_keys"),
+        ("path", "path"),
+    ],
+)
+
+
+class PuTTYPlugin(SSHPlugin):
+    """Extract artifacts from the PuTTY client.
+
+    NOTE:
+        - Does not parse ``$HOME/.putty/randomseed`` (GNU/Linux)
+          and ``HKCU\\Software\\SimonTatham\\PuTTY\\RandSeedFile`` (Windows)
+
+    Resources:
+        - http://www.chiark.greenend.org.uk/~sgtatham/putty/0.78/puttydoc.txt
+        - http://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#faq-settings
+    """
+
+    __namespace__ = "putty"
+
+    def __init__(self, target):
+        super().__init__(target)
+
+        self.regf_installs, self.path_installs = self._detect_putty()
+
+    def _detect_putty(
+        self,
+    ) -> tuple[list[set[RegistryKey, Optional[UserDetails]]], list[set[TargetPath, Optional[UserDetails]]]]:
+        regf_installs, path_installs = [], []
+
+        if self.target.has_function("registry"):
+            for key in self.target.registry.keys("HKCU\\Software\\SimonTatham\\PuTTY"):
+                user_details = self.target.registry.get_user_details(key)
+                regf_installs.append((key, user_details))
+
+        for user_details in self.target.user_details.all_with_home():
+            if (putty_path := user_details.home_path.joinpath(".putty")).exists():
+                path_installs.append((putty_path, user_details))
+
+        return regf_installs, path_installs
+
+    def check_compatible(self) -> None:
+        if not any(self.regf_installs + self.path_installs):
+            raise UnsupportedPluginError("No PuTTY installations found")
+
+    @export(record=KnownHostRecord)
+    def known_hosts(self) -> Iterator[KnownHostRecord]:
+        """Parse PuTTY saved SshHostKeys."""
+
+        for putty_key, user_details in self.regf_installs:
+            yield from self._regf_known_hosts(putty_key, user_details)
+
+        for putty_path, user_details in self.path_installs:
+            yield from self._path_known_hosts(putty_path, user_details)
+
+    def _regf_known_hosts(self, putty_key: RegistryKey, user_details: UserDetails) -> Iterator[KnownHostRecord]:
+        """Parse PuTTY traces in Windows registry."""
+
+        try:
+            ssh_host_keys = putty_key.subkey("SshHostKeys")
+        except RegistryKeyNotFoundError:
+            return
+
+        for entry in ssh_host_keys.values():
+            key_type, host = entry.name.split("@")
+            port, host = host.split(":")
+
+            yield KnownHostRecord(
+                mtime_ts=ssh_host_keys.ts,
+                host=host,
+                port=port,
+                key_type=key_type,
+                public_key=construct_public_key(key_type, entry.value),
+                comment="",
+                marker=None,
+                path=windows_path(ssh_host_keys.path),
+                _target=self.target,
+                _user=user_details.user if user_details else None,
+            )
+
+    def _path_known_hosts(self, putty_path: TargetPath, user_details: UserDetails) -> Iterator[KnownHostRecord]:
+        """Parse PuTTY traces in ``.putty`` folders"""
+        ssh_host_keys_path = putty_path.joinpath("sshhostkeys")
+
+        if ssh_host_keys_path.exists():
+            ts = ssh_host_keys_path.stat().st_mtime
+
+            for line in open_decompress(ssh_host_keys_path, "rt"):
+                parts = line.split()
+                key_type, host = parts[0].split("@")
+                port, host = host.split(":")
+
+                yield KnownHostRecord(
+                    mtime_ts=ts,
+                    host=host,
+                    port=port,
+                    key_type=key_type,
+                    public_key=construct_public_key(key_type, parts[1]),
+                    comment="",
+                    marker=None,
+                    path=posix_path(ssh_host_keys_path),
+                    _target=self.target,
+                    _user=user_details.user if user_details else None,
+                )
+
+    @export(record=PuTTYSessionRecord)
+    def sessions(self) -> Iterator[PuTTYSessionRecord]:
+        """Parse PuTTY saved session configuration files."""
+
+        for putty_key, user_details in self.regf_installs:
+            yield from self._regf_sessions(putty_key, user_details)
+
+        for putty_path, user_details in self.path_installs:
+            yield from self._path_sessions(putty_path, user_details)
+
+    def _regf_sessions(self, putty_key: RegistryKey, user_details: UserDetails) -> Iterator[PuTTYSessionRecord]:
+        try:
+            sessions = putty_key.subkey("Sessions")
+        except RegistryKeyNotFoundError:
+            return
+
+        for session in sessions.subkeys():
+            cfg = {s.name: s.value for s in session.values()}
+            yield from self._build_session_record(
+                session.ts, session.name, windows_path(session.path), cfg, user_details
+            )
+
+    def _path_sessions(self, putty_path: TargetPath, user_details: UserDetails) -> Iterator[PuTTYSessionRecord]:
+        sessions_dir = putty_path.joinpath("sessions")
+        if sessions_dir.exists():
+            for session in sessions_dir.glob("*"):
+                if session.is_file():
+                    cfg = dict(map(str.strip, line.split("=", maxsplit=1)) for line in session.open("rt").readlines())
+                    yield from self._build_session_record(
+                        session.stat().st_mtime, session.name, session, cfg, user_details
+                    )
+
+    def _build_session_record(
+        self, ts: float, name: Union[float, datetime], source: Path, cfg: dict, user_details: UserDetails
+    ) -> PuTTYSessionRecord:
+        host, user = parse_host_user(cfg.get("HostName"), cfg.get("UserName"))
+
+        yield PuTTYSessionRecord(
+            ts=ts,
+            session_name=name,
+            protocol=cfg.get("Protocol"),
+            host=host,
+            user=user,
+            port=cfg.get("PortNumber"),
+            remote_command=cfg.get("RemoteCommand"),
+            port_forward=cfg.get("PortForwardings"),
+            manual_ssh_host_keys=cfg.get("SSHManualHostKeys"),
+            path=source,
+            _target=self.target,
+            _user=user_details.user if user_details else None,
+        )
+
+
+def parse_host_user(host: str, user: str) -> tuple[str, str]:
+    """Parse host and user from PuTTY hostname component."""
+    if "@" in host:
+        parsed_user, parsed_host = host.split("@")
+        user = user or parsed_user
+        host = parsed_host
+
+    return host, user
+
+
+def construct_public_key(key_type: str, iv: str) -> str:
+    """Returns OpenSSH format public key calculated from PuTTY SshHostKeys format.
+
+    PuTTY stores raw public key components instead of OpenSSH-formatted public keys
+    or fingerprints. With RSA public keys the exponent and modulus are stored.
+    With ECC keys the x and y prime coordinates are stored together with the curve type.
+
+    Currently supports ``ssh-ed25519``, ``ecdsa-sha2-nistp256`` and ``rsa2`` key types.
+
+    NOTE:
+        - Sha256 fingerprints of the reconstructed public keys are currently not generated.
+        - More key types could be supported in the future.
+
+    Resources:
+        - https://github.com/github/putty/blob/master/contrib/kh2reg.py
+        - https://pycryptodome.readthedocs.io/en/latest/src/public_key/rsa.html
+        - https://pycryptodome.readthedocs.io/en/latest/src/public_key/ecc.html
+        - https://github.com/mkorthof/reg2kh
+    """
+
+    if key_type == "ssh-ed25519":
+        x, y = iv.split(",")
+        key = ECC.construct(curve="ed25519", point_x=int(x, 16), point_y=int(y, 16))
+        return key.public_key().export_key(format="OpenSSH").split()[-1]
+
+    if key_type == "ecdsa-sha2-nistp256":
+        _, x, y = iv.split(",")
+        key = ECC.construct(curve="NIST P-256", point_x=int(x, 16), point_y=int(y, 16))
+        return key.public_key().export_key(format="OpenSSH").split()[-1]
+
+    if key_type == "rsa2":
+        exponent, modulus = iv.split(",")
+        key = RSA.construct((int(modulus, 16), int(exponent, 16)))
+        return key.public_key().export_key(format="OpenSSH").decode("utf-8").split()[-1]
+
+    log.warning("Could not reconstruct public key: type %s not implemented.", key_type)
+    return iv

dissect.target-3.15.dev14/dissect/target/plugins/apps/ssh/ssh.py

@@ -0,0 +1,58 @@
+from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
+from dissect.target.helpers.record import create_extended_descriptor
+from dissect.target.plugin import NamespacePlugin
+
+OpenSSHUserRecordDescriptor = create_extended_descriptor([UserRecordDescriptorExtension])
+
+COMMON_ELLEMENTS = [
+    ("string", "key_type"),
+    ("string", "comment"),
+    ("path", "path"),
+]
+
+AuthorizedKeysRecord = OpenSSHUserRecordDescriptor(
+    "application/openssh/authorized_keys",
+    [
+        *COMMON_ELLEMENTS,
+        ("string", "public_key"),
+        ("string", "options"),
+    ],
+)
+
+
+KnownHostRecord = OpenSSHUserRecordDescriptor(
+    "application/openssh/known_host",
+    [
+        ("datetime", "mtime_ts"),
+        *COMMON_ELLEMENTS,
+        ("string", "host"),
+        ("varint", "port"),
+        ("string", "public_key"),
+        ("string", "marker"),
+    ],
+)
+
+
+PrivateKeyRecord = OpenSSHUserRecordDescriptor(
+    "application/openssh/private_key",
+    [
+        ("datetime", "mtime_ts"),
+        *COMMON_ELLEMENTS,
+        ("string", "key_format"),
+        ("string", "public_key"),
+        ("boolean", "encrypted"),
+    ],
+)
+
+PublicKeyRecord = OpenSSHUserRecordDescriptor(
+    "application/openssh/public_key",
+    [
+        ("datetime", "mtime_ts"),
+        *COMMON_ELLEMENTS,
+        ("string", "public_key"),
+    ],
+)
+
+
+class SSHPlugin(NamespacePlugin):
+    __namespace__ = "ssh"

{dissect.target-3.15.dev13 → dissect.target-3.15.dev14}/dissect/target/plugins/os/windows/registry.py

@@ -329,7 +329,7 @@ class RegistryPlugin(Plugin):
     @internal
     def get_user_details(self, key: RegistryKey) -> UserDetails:
         """Return user details for the user who owns a registry hive that contains the provided key"""
-        if not key.hive or not key.hive.filepath:
+        if not key.hive or not getattr(key.hive, "filepath", None):
             return
 
         return self._hives_to_users.get(key.hive)

{dissect.target-3.15.dev13 → dissect.target-3.15.dev14/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.15.dev13
+Version: 3.15.dev14
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.15.dev13 → dissect.target-3.15.dev14}/dissect.target.egg-info/SOURCES.txt

@@ -131,6 +131,8 @@ dissect/target/plugins/apps/shell/powershell.py
 dissect/target/plugins/apps/ssh/__init__.py
 dissect/target/plugins/apps/ssh/openssh.py
 dissect/target/plugins/apps/ssh/opensshd.py
+dissect/target/plugins/apps/ssh/putty.py
+dissect/target/plugins/apps/ssh/ssh.py
 dissect/target/plugins/apps/vpn/__init__.py
 dissect/target/plugins/apps/vpn/openvpn.py
 dissect/target/plugins/apps/vpn/wireguard.py
@@ -398,6 +400,7 @@ tests/plugins/apps/shell/test_powershell.py
 tests/plugins/apps/ssh/__init__.py
 tests/plugins/apps/ssh/test_openssh.py
 tests/plugins/apps/ssh/test_opensshd.py
+tests/plugins/apps/ssh/test_putty.py
 tests/plugins/apps/vpn/__init__.py
 tests/plugins/apps/vpn/test_openvpn.py
 tests/plugins/apps/vpn/test_wireguard.py

{dissect.target-3.15.dev13 → dissect.target-3.15.dev14}/tests/plugins/apps/ssh/test_openssh.py

@@ -65,7 +65,7 @@ class Alternatives:
         return self.separator.join([mapping.get(target_dir), *file_name.split("/")])
 
 
-def test_authorized_keys_plugin(target_and_filesystem: tuple[Target, VirtualFilesystem]):
+def test_authorized_keys_plugin(target_and_filesystem: tuple[Target, VirtualFilesystem]) -> None:
     target, fs = target_and_filesystem
     authorized_keys_data = """
     ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINz6oq+IweAoQFMzQ0aJLYXJFkLn3tXMbVZ550wvUKOw
@@ -114,7 +114,7 @@ def test_authorized_keys_plugin(target_and_filesystem: tuple[Target, VirtualFile
     assert results[4].comment == "with a comment"
 
 
-def test_known_hosts_plugin(target_and_filesystem):
+def test_known_hosts_plugin(target_and_filesystem: tuple[Target, VirtualFilesystem]) -> None:
     target, fs = target_and_filesystem
 
     known_hosts_data = """
@@ -137,41 +137,42 @@ def test_known_hosts_plugin(target_and_filesystem):
 
     target.add_plugin(OpenSSHPlugin)
 
-    results = list(target.ssh.known_hosts())
+    results = list(target.openssh.known_hosts())
     assert len(results) == 6
 
-    assert results[0].hostname_pattern == "cvs.example.net"
+    assert results[0].host == "cvs.example.net"
     assert results[0].key_type == "ssh-rsa"
     assert results[0].comment == "comment with spaces"
     assert results[0].marker is None
 
-    assert results[1].hostname_pattern == "192.0.2.10"
+    assert results[1].host == "192.0.2.10"
     assert results[1].key_type == "ssh-rsa"
     assert results[1].comment == "comment with spaces"
     assert results[1].marker is None
 
-    assert results[2].hostname_pattern == "|1|JfKTdBh7rNbXkVAQCRp4OQoPfmI=|USECr3SWf1JUPsms5AqfD5QfxkM="
+    assert results[2].host == "|1|JfKTdBh7rNbXkVAQCRp4OQoPfmI=|USECr3SWf1JUPsms5AqfD5QfxkM="
     assert results[2].key_type == "ssh-rsa"
     assert results[2].comment == ""
     assert results[2].marker is None
 
-    assert results[3].hostname_pattern == "*"
+    assert results[3].host == "*"
     assert results[3].key_type == "ssh-rsa"
     assert results[3].comment == ""
     assert results[3].marker == "@revoked"
 
-    assert results[4].hostname_pattern == "*.mydomain.org"
+    assert results[4].host == "*.mydomain.org"
     assert results[4].key_type == "ssh-rsa"
     assert results[4].comment == ""
     assert results[4].marker == "@cert-authority"
 
-    assert results[5].hostname_pattern == "*.mydomain.com"
+    assert results[5].host == "*.mydomain.com"
     assert results[5].key_type == "ssh-rsa"
     assert results[5].comment == ""
     assert results[5].marker == "@cert-authority"
+    assert results[5].username == target_system.user_name
 
 
-def test_private_keys_plugin_rfc4716_ed25519(target_and_filesystem):
+def test_private_keys_plugin_rfc4716_ed25519(target_and_filesystem: tuple[Target, VirtualFilesystem]) -> None:
     target, fs = target_and_filesystem
     private_key_data = """
     -----BEGIN OPENSSH PRIVATE KEY-----
@@ -199,7 +200,7 @@ def test_private_keys_plugin_rfc4716_ed25519(target_and_filesystem):
 
     target.add_plugin(OpenSSHPlugin)
 
-    results = list(target.ssh.private_keys())
+    results = list(target.openssh.private_keys())
     assert len(results) == 1
 
     private_key = results[0]
@@ -208,12 +209,12 @@ def test_private_keys_plugin_rfc4716_ed25519(target_and_filesystem):
     assert private_key.comment == "long comment here"
     assert private_key.public_key == public_key_data
     assert not private_key.encrypted
-    assert str(private_key.path) == target_system.filesystem_path("ssh_host_ed25519_key", TargetDir.SSHD).replace(
-        target_system.label, "\\sysvol\\"
-    )
+    assert str(private_key.path).replace("\\", "/") == target_system.filesystem_path(
+        "ssh_host_ed25519_key", TargetDir.SSHD
+    ).replace(target_system.label, "\\sysvol\\").replace("\\", "/")
 
 
-def test_private_keys_plugin_rfc4716_rsa_encrypted(target_and_filesystem):
+def test_private_keys_plugin_rfc4716_rsa_encrypted(target_and_filesystem: tuple[Target, VirtualFilesystem]) -> None:
     target, fs = target_and_filesystem
     # Generated using password "password".
     private_key_data = """
@@ -274,7 +275,7 @@ def test_private_keys_plugin_rfc4716_rsa_encrypted(target_and_filesystem):
 
     target.add_plugin(OpenSSHPlugin)
 
-    results = list(target.ssh.private_keys())
+    results = list(target.openssh.private_keys())
     private_key = results[0]
 
     assert len(results) == 1
@@ -283,10 +284,12 @@ def test_private_keys_plugin_rfc4716_rsa_encrypted(target_and_filesystem):
     assert private_key.public_key == public_key_data
     assert private_key.comment == ""
     assert private_key.encrypted
-    assert str(private_key.path) == target_system.filesystem_path(".ssh/id_rsa", TargetDir.HOME)
+    assert str(private_key.path).replace("\\", "/") == target_system.filesystem_path(
+        ".ssh/id_rsa", TargetDir.HOME
+    ).replace("\\", "/")
 
 
-def test_private_keys_plugin_pem_ecdsa(target_and_filesystem):
+def test_private_keys_plugin_pem_ecdsa(target_and_filesystem: tuple[Target, VirtualFilesystem]) -> None:
     target, fs = target_and_filesystem
     private_key_data = """
     -----BEGIN EC PRIVATE KEY-----
@@ -304,7 +307,7 @@ def test_private_keys_plugin_pem_ecdsa(target_and_filesystem):
 
     target.add_plugin(OpenSSHPlugin)
 
-    results = list(target.ssh.private_keys())
+    results = list(target.openssh.private_keys())
     private_key = results[0]
 
     assert len(results) == 1
@@ -312,10 +315,12 @@ def test_private_keys_plugin_pem_ecdsa(target_and_filesystem):
     assert private_key.key_type == "ecdsa"
     assert private_key.username == target_system.user_name
     assert not private_key.encrypted
-    assert str(private_key.path) == target_system.filesystem_path(".ssh/id_ecdsa", TargetDir.HOME)
+    assert str(private_key.path).replace("\\", "/") == target_system.filesystem_path(
+        ".ssh/id_ecdsa", TargetDir.HOME
+    ).replace("\\", "/")
 
 
-def test_private_keys_plugin_pkcs8_dsa(target_and_filesystem):
+def test_private_keys_plugin_pkcs8_dsa(target_and_filesystem: tuple[Target, VirtualFilesystem]) -> None:
     target, fs = target_and_filesystem
     private_key_data = """
     -----BEGIN PRIVATE KEY-----
@@ -337,17 +342,19 @@ def test_private_keys_plugin_pkcs8_dsa(target_and_filesystem):
 
     target.add_plugin(OpenSSHPlugin)
 
-    results = list(target.ssh.private_keys())
+    results = list(target.openssh.private_keys())
     private_key = results[0]
 
     assert len(results) == 1
     assert private_key.key_format == "PKCS8"
     assert private_key.username == target_system.user_name
     assert not private_key.encrypted
-    assert str(private_key.path) == target_system.filesystem_path(".ssh/id_dsa", TargetDir.HOME)
+    assert str(private_key.path).replace("\\", "/") == target_system.filesystem_path(
+        ".ssh/id_dsa", TargetDir.HOME
+    ).replace("\\", "/")
 
 
-def test_public_keys_plugin(target_and_filesystem):
+def test_public_keys_plugin(target_and_filesystem: tuple[Target, VirtualFilesystem]) -> None:
     target, fs = target_and_filesystem
     user_public_key_data = (
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINz6oq+IweAoQFMzQ0aJLYXJFkLn3tXMbVZ550wvUKOw long comment here"
@@ -376,7 +383,7 @@ def test_public_keys_plugin(target_and_filesystem):
 
     target.add_plugin(OpenSSHPlugin)
 
-    results = list(target.ssh.public_keys())
+    results = list(target.openssh.public_keys())
 
     assert len(results) == 2
 
@@ -386,11 +393,13 @@ def test_public_keys_plugin(target_and_filesystem):
     assert user_public_key.key_type == user_public_key_data.split(" ", 2)[0]
     assert user_public_key.public_key == user_public_key_data.split(" ", 2)[1]
     assert user_public_key.comment == user_public_key_data.split(" ", 2)[2]
-    assert str(user_public_key.path) == target_system.filesystem_path(".ssh/id_ed25519.pub", TargetDir.HOME)
+    assert str(user_public_key.path).replace("\\", "/") == target_system.filesystem_path(
+        ".ssh/id_ed25519.pub", TargetDir.HOME
+    ).replace("\\", "/")
 
     assert host_public_key.key_type == host_public_key_data.split(" ", 2)[0]
     assert host_public_key.public_key == host_public_key_data.split(" ", 2)[1]
     assert host_public_key.comment == host_public_key_data.split(" ", 2)[2]
-    assert str(host_public_key.path) == target_system.filesystem_path("ssh_host_rsa_key.pub", TargetDir.SSHD).replace(
-        target_system.label, "\\sysvol\\"
-    )
+    assert str(host_public_key.path).replace("\\", "/") == target_system.filesystem_path(
+        "ssh_host_rsa_key.pub", TargetDir.SSHD
+    ).replace(target_system.label, "\\sysvol\\").replace("\\", "/")

{dissect.target-3.15.dev13 → dissect.target-3.15.dev14}/tests/plugins/apps/ssh/test_opensshd.py

@@ -13,7 +13,7 @@ def test_sshd_config_plugin(target_unix_users: Target, fs_unix: VirtualFilesyste
     fs_unix.map_file(str(plugin.sshd_config_path), config_file)
 
     target_unix_users.add_plugin(SSHServerPlugin)
-    results = list(target_unix_users.sshd.config())
+    results = list(target_unix_users.opensshd.config())
 
     assert len(results) == 1
     result = results[0]
@@ -43,7 +43,7 @@ def test_sshd_config_plugin_multiple_definitions(target_unix_users: Target, fs_u
     )
 
     target_unix_users.add_plugin(SSHServerPlugin)
-    results = list(target_unix_users.sshd.config())
+    results = list(target_unix_users.opensshd.config())
 
     assert len(results) == 1
     result = results[0]