dissect.target 3.18.dev15__tar.gz → 3.19.dev1__tar.gz

{dissect_target-3.18.dev15/dissect.target.egg-info → dissect_target-3.19.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.18.dev15
+Version: 3.19.dev1
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.18.dev15 → dissect_target-3.19.dev1}/dissect/target/loaders/mqtt.py

@@ -10,6 +10,7 @@ import time
 import urllib
 from dataclasses import dataclass
 from functools import lru_cache
+from getpass import getpass
 from pathlib import Path
 from struct import pack, unpack_from
 from threading import Thread
@@ -270,19 +271,25 @@ class Broker:
     case = None
     bytes_received = 0
     monitor = False
+    username = None
+    password = None
 
     diskinfo = {}
     index = {}
     topo = {}
     factor = 1
 
-    def __init__(self, broker: Broker, port: str, key: str, crt: str, ca: str, case: str, **kwargs):
+    def __init__(
+        self, broker: Broker, port: str, key: str, crt: str, ca: str, case: str, username: str, password: str, **kwargs
+    ):
         self.broker_host = broker
         self.broker_port = int(port)
         self.private_key_file = key
         self.certificate_file = crt
         self.cacert_file = ca
         self.case = case
+        self.username = username
+        self.password = password
         self.command = kwargs.get("command", None)
 
     def clear_cache(self) -> None:
@@ -393,6 +400,7 @@ class Broker:
             tls_version=ssl.PROTOCOL_TLS,
             ciphers=None,
         )
+        self.mqtt_client.username_pw_set(self.username, self.password)
         self.mqtt_client.tls_insecure_set(True)  # merely having the correct cert is ok
         self.mqtt_client.on_connect = self._on_connect
         self.mqtt_client.on_message = self._on_message
@@ -411,6 +419,8 @@ class Broker:
 @arg("--mqtt-ca", dest="ca", help="certificate authority file")
 @arg("--mqtt-command", dest="command", help="direct command to client(s)")
 @arg("--mqtt-diag", action="store_true", dest="diag", help="show MQTT diagnostic information")
+@arg("--mqtt-username", dest="username", help="Username for connection")
+@arg("--mqtt-password", action="store_true", dest="password", help="Ask for password before connecting")
 class MQTTLoader(Loader):
     """Load remote targets through a broker."""
 
@@ -435,7 +445,10 @@ class MQTTLoader(Loader):
         if cls.broker is None:
             if (uri := kwargs.get("parsed_path")) is None:
                 raise LoaderError("No URI connection details have been passed.")
+
             options = dict(urllib.parse.parse_qsl(uri.query, keep_blank_values=True))
+            if options.get("password"):
+                options["password"] = getpass()
             cls.broker = Broker(**options)
             cls.broker.connect()
             num_peers = int(options.get("peers", 1))

{dissect_target-3.18.dev15 → dissect_target-3.19.dev1}/dissect/target/plugins/os/windows/regf/shellbags.py

@@ -907,17 +907,20 @@ class EXTENSION_BLOCK_BEEF0004(EXTENSION_BLOCK):  # noqa
             self.file_reference = c_bag.uint64(fh)
             c_bag.uint64(fh)
         if version >= 3:
-            long_len = c_bag.uint16(fh)
+            # Start of strings
+            localized_name_offset = c_bag.uint16(fh)
         if version >= 9:
             c_bag.uint32(fh)
         if version >= 8:
             c_bag.uint32(fh)
         if version >= 3:
             self.long_name = c_bag.wchar[None](fh)
-        if 3 <= version < 7 and long_len > 0:
-            self.localized_name = c_bag.char[long_len](fh)
-        if version >= 7 and long_len > 0:
-            self.localized_name = c_bag.wchar[long_len](fh)
+
+        if 3 <= version < 7 and localized_name_offset > 0:
+            self.localized_name = c_bag.char[None](fh)
+
+        if version >= 7 and localized_name_offset > 0:
+            self.localized_name = c_bag.wchar[None](fh)
 
 
 class EXTENSION_BLOCK_BEEF0005(EXTENSION_BLOCK):  # noqa

{dissect_target-3.18.dev15 → dissect_target-3.19.dev1/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.18.dev15
+Version: 3.19.dev1
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.18.dev15 → dissect_target-3.19.dev1}/dissect.target.egg-info/SOURCES.txt

@@ -574,6 +574,7 @@ tests/plugins/os/windows/regf/test_appxdebugkeys.py
 tests/plugins/os/windows/regf/test_cit.py
 tests/plugins/os/windows/regf/test_clsid.py
 tests/plugins/os/windows/regf/test_muicache.py
+tests/plugins/os/windows/regf/test_shellbags.py
 tests/plugins/os/windows/regf/test_trusteddocs.py
 tests/plugins/os/windows/regf/test_userassist.py
 tests/tools/__init__.py

{dissect_target-3.18.dev15 → dissect_target-3.19.dev1}/tests/loaders/test_mqtt.py

@@ -114,7 +114,7 @@ def test_remote_loader_stream(
 ) -> None:
     from dissect.target.loaders.mqtt import Broker
 
-    broker = Broker("0.0.0.0", "1884", "key", "crt", "ca", "case1")
+    broker = Broker("0.0.0.0", "1884", "key", "crt", "ca", "case1", "user", "pass")
     broker.connect()
     broker.mqtt_client.fill_disks(disks)
     broker.mqtt_client.hostnames = hosts

dissect_target-3.19.dev1/tests/plugins/os/windows/regf/test_shellbags.py

@@ -0,0 +1,48 @@
+from __future__ import annotations
+
+import datetime
+
+import pytest
+
+from dissect.target.plugins.os.windows.regf.shellbags import parse_shell_item_list
+
+
+@pytest.mark.parametrize(
+    "shellbag, name, modification_time, localized_name",
+    [
+        (
+            (
+                b"X\x001\x00\x00\x00\x00\x00WX\xc1I\x11\x00MENUST~1\x00\x00@\x00\x03\x00\x04\x00\xef\xbeWXZBWXZB\x14"
+                b"\x00*\x00M\x00e\x00n\x00u\x00 \x00S\x00t\x00a\x00r\x00t\x00\x00\x00@shell32.dll,-21786\x00\x18\x00"
+                b"\x00\x00"
+            ),
+            "Menu Start",
+            datetime.datetime(2024, 2, 23, 9, 14, 2),
+            b"@shell32.dll,-21786",
+        ),
+        (
+            (
+                b"x\x001\x00\x00\x00\x00\x00\x17W\x0bk\x11\x00Users\x00d\x00\t\x00\x04\x00\xef\xbe\xa7T,*\x91X\xe6R."
+                b"\x00\x00\x00\n\x08\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00:\x00\x00\x00\x00\x00A"
+                b"\x06\x85\x00U\x00s\x00e\x00r\x00s\x00\x00\x00@\x00s\x00h\x00e\x00l\x00l\x003\x002\x00.\x00d\x00l"
+                b"\x00l\x00,\x00-\x002\x001\x008\x001\x003\x00\x00\x00\x14\x00\x00\x00"
+            ),
+            "Users",
+            datetime.datetime(2023, 8, 23, 13, 24, 22),
+            "@shell32.dll,-21813",
+        ),
+    ],
+    ids=["char", "wchar"],
+)
+def test_parse_shell_item_list(
+    shellbag: bytes, name: str, modification_time: datetime.datetime, localized_name: str | bytes
+) -> None:
+    bag = next(parse_shell_item_list(shellbag))
+
+    assert bag.name == name
+    assert bag.modification_time == modification_time
+
+    extension = bag.extensions[0]
+
+    assert extension.long_name == name
+    assert extension.localized_name == localized_name