dissect.target 3.16.dev30__tar.gz → 3.16.dev31__tar.gz

{dissect.target-3.16.dev30/dissect.target.egg-info → dissect.target-3.16.dev31}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.16.dev30
+Version: 3.16.dev31
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.16.dev30 → dissect.target-3.16.dev31}/dissect/target/plugins/os/unix/esxi/_os.py

@@ -4,6 +4,7 @@ import gzip
 import json
 import lzma
 import struct
+import subprocess
 from configparser import ConfigParser
 from configparser import Error as ConfigParserError
 from io import BytesIO
@@ -13,6 +14,8 @@ from defusedxml import ElementTree
 from dissect.hypervisor.util import vmtar
 from dissect.sql import sqlite3
 
+from dissect.target.helpers.fsutil import TargetPath
+
 try:
     from dissect.hypervisor.util.envelope import Envelope, KeyStore
 
@@ -217,23 +220,72 @@ def _mount_local(target: Target, local_layer: VirtualFilesystem):
         local_fs = tar.TarFilesystem(local_tgz.open())
     else:
         local_tgz_ve = target.fs.path("local.tgz.ve")
-        encryption_info = target.fs.path("encryption.info")
+        # In the case "encryption.info" does not exist, but ".#encryption.info" does
+        encryption_info = next(target.fs.path("/").glob("*encryption.info"), None)
         if not local_tgz_ve.exists() or not encryption_info.exists():
             raise ValueError("Unable to find valid configuration archive")
 
-        if HAS_ENVELOPE:
-            target.log.info("local.tgz is encrypted, attempting to decrypt")
-            envelope = Envelope(local_tgz_ve.open())
-            keystore = KeyStore.from_text(encryption_info.read_text("utf-8"))
-            local_tgz = BytesIO(envelope.decrypt(keystore.key, aad=b"ESXConfiguration"))
-            local_fs = tar.TarFilesystem(local_tgz)
-        else:
-            target.log.warning("local.tgz is encrypted but no crypto module available!")
+        local_fs = _create_local_fs(target, local_tgz_ve, encryption_info)
 
     if local_fs:
         local_layer.mount("/", local_fs)
 
 
+def _decrypt_envelope(local_tgz_ve: TargetPath, encryption_info: TargetPath) -> BinaryIO:
+    """Decrypt ``local.tgz.ve`` ourselves with hard-coded keys."""
+    envelope = Envelope(local_tgz_ve.open())
+    keystore = KeyStore.from_text(encryption_info.read_text("utf-8"))
+    local_tgz = BytesIO(envelope.decrypt(keystore.key, aad=b"ESXConfiguration"))
+    return local_tgz
+
+
+def _decrypt_crypto_util(local_tgz_ve: TargetPath) -> Optional[BytesIO]:
+    """Decrypt ``local.tgz.ve`` using ESXi ``crypto-util``.
+
+    We write to stdout, but this results in ``crypto-util`` exiting with a non-zero return code
+    and stderr containing an I/O error message. The file does get properly decrypted, so we return
+    ``None`` if there are no bytes in stdout which would indicate it actually failed.
+    """
+
+    result = subprocess.run(
+        ["crypto-util", "envelope", "extract", "--aad", "ESXConfiguration", f"/{local_tgz_ve.as_posix()}", "-"],
+        capture_output=True,
+    )
+
+    if len(result.stdout) == 0:
+        return None
+
+    return BytesIO(result.stdout)
+
+
+def _create_local_fs(
+    target: Target, local_tgz_ve: TargetPath, encryption_info: TargetPath
+) -> Optional[tar.TarFilesystem]:
+    local_tgz = None
+
+    if HAS_ENVELOPE:
+        try:
+            local_tgz = _decrypt_envelope(local_tgz_ve, encryption_info)
+        except NotImplementedError:
+            target.log.debug("Failed to decrypt %s, likely TPM encrypted", local_tgz_ve)
+    else:
+        target.log.debug("Skipping static decryption because of missing crypto module")
+
+    if not local_tgz and target.name == "local":
+        target.log.info(
+            "local.tgz is encrypted but static decryption failed, attempting dynamic decryption using crypto-util"
+        )
+        local_tgz = _decrypt_crypto_util(local_tgz_ve)
+
+        if local_tgz is None:
+            target.log.warning("Dynamic decryption of %s failed.", local_tgz_ve)
+    else:
+        target.log.warning("local.tgz is encrypted but static decryption failed and no dynamic decryption available!")
+
+    if local_tgz:
+        return tar.TarFilesystem(local_tgz)
+
+
 def _mount_filesystems(target: Target, sysvol: Filesystem, cfg: dict[str, str]):
     version = cfg["build"]
 

{dissect.target-3.16.dev30 → dissect.target-3.16.dev31/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.16.dev30
+Version: 3.16.dev31
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.16.dev30 → dissect.target-3.16.dev31}/dissect.target.egg-info/SOURCES.txt

@@ -485,6 +485,8 @@ tests/plugins/os/unix/bsd/citrix/test_history.py
 tests/plugins/os/unix/bsd/osx/__init__.py
 tests/plugins/os/unix/bsd/osx/test__os.py
 tests/plugins/os/unix/bsd/osx/test_user.py
+tests/plugins/os/unix/esxi/__init__.py
+tests/plugins/os/unix/esxi/test__os.py
 tests/plugins/os/unix/linux/__init__.py
 tests/plugins/os/unix/linux/test_cmdline.py
 tests/plugins/os/unix/linux/test_environ.py

dissect.target-3.16.dev31/tests/plugins/os/unix/esxi/test__os.py

@@ -0,0 +1,60 @@
+from unittest.mock import patch
+
+from dissect.target import Target
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugins.os.unix.esxi._os import (
+    _create_local_fs,
+    _decrypt_crypto_util,
+)
+
+
+def test__create_tar_fs_no_envelope(target_linux: Target, fs_unix: VirtualFilesystem) -> None:
+    with (
+        patch("dissect.target.plugins.os.unix.esxi._os.HAS_ENVELOPE", False),
+        patch("dissect.target.plugins.os.unix.esxi._os.tar") as mocked_tar,
+        patch("dissect.target.plugins.os.unix.esxi._os._decrypt_crypto_util") as decrypt_func,
+    ):
+        target_linux._name = "local"
+        _create_local_fs(target_linux, fs_unix.path("local.tgz.ve"), fs_unix.path("encryption.info"))
+
+        decrypt_func.assert_called()
+        mocked_tar.TarFilesystem.assert_called()
+
+
+def test__create_tar_fs_envelope(target_linux: Target, fs_unix: VirtualFilesystem) -> None:
+    with (
+        patch("dissect.target.plugins.os.unix.esxi._os.HAS_ENVELOPE", True),
+        patch("dissect.target.plugins.os.unix.esxi._os.tar") as mocked_tar,
+        patch("dissect.target.plugins.os.unix.esxi._os._decrypt_envelope") as decrypt_func,
+    ):
+        _create_local_fs(target_linux, fs_unix.path("local.tgz.ve"), fs_unix.path("encryption.info"))
+
+        decrypt_func.assert_called()
+        mocked_tar.TarFilesystem.assert_called()
+
+
+def test__create_tar_fs_failed_envelope(target_linux: Target, fs_unix: VirtualFilesystem) -> None:
+    with (
+        patch("dissect.target.plugins.os.unix.esxi._os.HAS_ENVELOPE", True),
+        patch("dissect.target.plugins.os.unix.esxi._os.tar") as mocked_tar,
+        patch("dissect.target.plugins.os.unix.esxi._os._decrypt_envelope", side_effect=[NotImplementedError]),
+        patch("dissect.target.plugins.os.unix.esxi._os._decrypt_crypto_util") as decrypt_func,
+    ):
+        target_linux._name = "local"
+        _create_local_fs(target_linux, fs_unix.path("local.tgz.ve"), fs_unix.path("encryption.info"))
+
+        decrypt_func.assert_called()
+        mocked_tar.TarFilesystem.assert_called()
+
+
+def test__decrypt_crypto_not_local(target_linux: Target, fs_unix: VirtualFilesystem) -> None:
+    target_linux._name = "not_local"
+    with patch("dissect.target.plugins.os.unix.esxi._os.HAS_ENVELOPE", False):
+        assert _create_local_fs(target_linux, fs_unix.path(""), fs_unix.path("")) is None
+
+
+def test__decrypt_crypto_local(fs_unix: VirtualFilesystem) -> None:
+    with patch("dissect.target.plugins.os.unix.esxi._os.subprocess.run") as mocked_run:
+        mocked_run.return_value.stdout = b"data"
+
+        assert _decrypt_crypto_util(fs_unix.path("data")).read() == b"data"