dissect.target 3.16.dev37__tar.gz → 3.16.dev39__tar.gz

{dissect.target-3.16.dev37/dissect.target.egg-info → dissect.target-3.16.dev39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.16.dev37
+Version: 3.16.dev39
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.16.dev37 → dissect.target-3.16.dev39}/dissect/target/loaders/velociraptor.py

@@ -19,12 +19,6 @@ WINDOWS_ACCESSORS = ["mft", "ntfs", "lazy_ntfs", "ntfs_vss", "auto"]
 
 
 def find_fs_directories(path: Path) -> tuple[Optional[OperatingSystem], Optional[list[Path]]]:
-    # As of Velociraptor version 0.7.0 the structure of the Velociraptor Offline Collector varies by operating system.
-    # Generic.Collectors.File (Unix) uses the accessors file and auto.
-    # Generic.Collectors.File (Windows) and Windows.KapeFiles.Targets (Windows) uses the accessors
-    # mft, ntfs, lazy_ntfs, ntfs_vss and auto. The loader only supports a collection where a single accessor is used.
-    # For Windows usage of the ntfs_vss accessor can be forced by configuring VSSAnalysisAge to be greater than 0.
-
     fs_root = path.joinpath(FILESYSTEMS_ROOT)
 
     # Unix
@@ -43,6 +37,9 @@ def find_fs_directories(path: Path) -> tuple[Optional[OperatingSystem], Optional
         if accessor_root.exists():
             # If the accessor directory exists, assume all the subdirectories are volumes
             for volume in accessor_root.iterdir():
+                if not volume.is_dir():
+                    continue
+
                 # https://github.com/Velocidex/velociraptor/blob/87368e7cc678144592a1614bb3bbd0a0f900ded9/accessors/ntfs/vss.go#L82
                 if "HarddiskVolumeShadowCopy" in volume.name:
                     vss_volumes.add(volume)
@@ -60,6 +57,17 @@ def find_fs_directories(path: Path) -> tuple[Optional[OperatingSystem], Optional
 class VelociraptorLoader(DirLoader):
     """Load Rapid7 Velociraptor forensic image files.
 
+    As of Velociraptor version 0.7.0 the structure of the Velociraptor Offline Collector varies by operating system.
+    Generic.Collectors.File (Unix) uses the accessors file and auto. The loader supports the following configuration::
+
+        {"Generic.Collectors.File":{"Root":"/","collectionSpec":"Glob\\netc/**\\nvar/log/**"}}
+
+    Generic.Collectors.File (Windows) and Windows.KapeFiles.Targets (Windows) uses the accessors mft, ntfs, lazy_ntfs,
+    ntfs_vss and auto. The loader only supports a collection where a single accessor is used, which can be forced by
+    using the following configuration::
+
+        {"Windows.KapeFiles.Targets":{"VSSAnalysisAge":"1000","_SANS_Triage":"Y"}}
+
     References:
         - https://www.rapid7.com/products/velociraptor/
         - https://docs.velociraptor.app/

{dissect.target-3.16.dev37 → dissect.target-3.16.dev39}/dissect/target/plugins/apps/vpn/wireguard.py

@@ -1,7 +1,7 @@
 import re
 from collections import OrderedDict
 from configparser import ConfigParser
-from os.path import basename
+from functools import partial
 from pathlib import Path
 from typing import Iterator, Union
 
@@ -34,7 +34,7 @@ WireGuardPeerRecord = TargetRecordDescriptor(
         ("string", "name"),
         ("string", "public_key"),
         ("string", "pre_shared_key"),
-        ("net.ipnetwork", "allowed_ips"),
+        ("net.ipnetwork[]", "allowed_ips"),
         ("string", "endpoint"),
         ("varint", "persistent_keep_alive"),
         ("string", "source"),
@@ -102,37 +102,42 @@ class WireGuardPlugin(Plugin):
 
             config = _parse_config(config_buf)
 
-            for section in config.sections():
+            # Set up an iterator to go through all the sections and pre-set the fallback
+            config_iterator = ((section, partial(config.get, section, fallback=None)) for section in config.sections())
+
+            for section, config_dict in config_iterator:
                 if "Interface" in section:
-                    if address := config.get(section, "Address", fallback=None):
+                    if address := config_dict("Address"):
                         address = address.split("/")[0]
-                    name = basename(config_path)
-                    name = self.TUNNEL_NAME_RE.sub("", name)
+
                     yield WireGuardInterfaceRecord(
-                        name=name,
+                        name=config_path.stem,
                         address=address,
-                        listen_port=config.get(section, "ListenPort", fallback=None),
-                        private_key=config.get(section, "PrivateKey", fallback=None),
-                        fw_mark=config.get(section, "FwMark", fallback=None),
-                        dns=config.get(section, "DNS", fallback=None),
-                        table=config.get(section, "Table", fallback=None),
-                        mtu=config.get(section, "MTU", fallback=None),
-                        preup=config.get(section, "PreUp", fallback=None),
-                        postup=config.get(section, "PostUp", fallback=None),
-                        predown=config.get(section, "PreDown", fallback=None),
-                        postdown=config.get(section, "PostDown", fallback=None),
+                        listen_port=config_dict("ListenPort"),
+                        private_key=config_dict("PrivateKey"),
+                        fw_mark=config_dict("FwMark"),
+                        dns=config_dict("DNS"),
+                        table=config_dict("Table"),
+                        mtu=config_dict("MTU"),
+                        preup=config_dict("PreUp"),
+                        postup=config_dict("PostUp"),
+                        predown=config_dict("PreDown"),
+                        postdown=config_dict("PostDown"),
                         source=config_path,
                         _target=self.target,
                     )
 
                 if "Peer" in section:
+                    if allowed_ips := config_dict("AllowedIPs"):
+                        allowed_ips = [value.strip() for value in allowed_ips.split(",")]
+
                     yield WireGuardPeerRecord(
-                        name=config.get(section, "Name", fallback=None),
-                        public_key=config.get(section, "PublicKey", fallback=None),
-                        pre_shared_key=config.get(section, "PreSharedKey", fallback=None),
-                        allowed_ips=config.get(section, "AllowedIPs", fallback=None),
-                        endpoint=config.get(section, "Endpoint", fallback=None),
-                        persistent_keep_alive=config.get(section, "PersistentKeepAlive", fallback=None),
+                        name=config_dict("Name"),
+                        public_key=config_dict("PublicKey"),
+                        pre_shared_key=config_dict("PreSharedKey"),
+                        allowed_ips=allowed_ips,
+                        endpoint=config_dict("Endpoint"),
+                        persistent_keep_alive=config_dict("PersistentKeepAlive"),
                         source=config_path,
                         _target=self.target,
                     )
@@ -148,6 +153,8 @@ def _parse_config(content: str) -> ConfigParser:
     """
 
     cp = ConfigParser(defaults=None, dict_type=MultiDict, strict=False)
+    # Set to use str so it doesn't do any lower operation on the keys.
+    cp.optionxform = str
     cp.read_string(content)
     return cp
 
@@ -158,7 +165,7 @@ class MultiDict(OrderedDict):
         super().__init__(*args, **kwargs)
 
     def __setitem__(self, key, val):
-        if isinstance(val, dict) and (key == "Peer" or key == "Interface"):
+        if isinstance(val, dict) and (key in ["Peer", "Interface"]):
             self._unique += 1
             key += str(self._unique)
         super().__setitem__(key, val)

{dissect.target-3.16.dev37 → dissect.target-3.16.dev39/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.16.dev37
+Version: 3.16.dev39
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.16.dev37 → dissect.target-3.16.dev39}/tests/plugins/apps/vpn/test_wireguard.py

@@ -22,6 +22,13 @@ def test_wireguard_plugin_global_log(target_unix_users, fs_unix):
     # Peer
     record = records[1]
     assert record.name is None
-    assert str(record.allowed_ips) == "10.13.37.2/32"
+    assert [str(addr) for addr in record.allowed_ips] == ["10.13.37.2/32", "::/0"]
     assert record.public_key == "UHVibGljS2V5MQ=="
     assert record.source == "etc/wireguard/wg0.conf"
+
+    # Peer
+    record = records[2]
+    assert record.name is None
+    assert [str(addr) for addr in record.allowed_ips] == ["10.13.37.3/32", "::/0"]
+    assert record.public_key == "UHVibGljS2V5Mg=="
+    assert record.source == "etc/wireguard/wg0.conf"