dissect.target 3.19.dev10__tar.gz → 3.19.dev12__tar.gz

{dissect_target-3.19.dev10/dissect.target.egg-info → dissect_target-3.19.dev12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev10
+Version: 3.19.dev12
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.19.dev10 → dissect_target-3.19.dev12}/dissect/target/plugins/apps/browser/chrome.py

@@ -25,6 +25,7 @@ class ChromePlugin(ChromiumMixin, BrowserPlugin):
     DIRS = [
         # Windows
         "AppData/Local/Google/Chrome/User Data/Default",
+        "AppData/Local/Google/Chrome/User Data/Snapshots/*/Default",
         "AppData/Local/Google/Chrome/continuousUpdates/User Data/Default",
         "Local Settings/Application Data/Google/Chrome/User Data/Default",
         # Linux

{dissect_target-3.19.dev10 → dissect_target-3.19.dev12}/dissect/target/plugins/apps/browser/chromium.py

@@ -79,11 +79,12 @@ class ChromiumMixin:
         users_dirs: list[tuple] = []
         for user_details in self.target.user_details.all_with_home():
             for d in hist_paths:
-                cur_dir: TargetPath = user_details.home_path.joinpath(d)
-                cur_dir = cur_dir.resolve()
-                if not cur_dir.exists() or (user_details, cur_dir) in users_dirs:
-                    continue
-                users_dirs.append((user_details, cur_dir))
+                home_dir: TargetPath = user_details.home_path
+                for cur_dir in home_dir.glob(d):
+                    cur_dir = cur_dir.resolve()
+                    if not cur_dir.exists() or (user_details.user, cur_dir) in users_dirs:
+                        continue
+                    users_dirs.append((user_details, cur_dir))
         return users_dirs
 
     def _iter_db(

{dissect_target-3.19.dev10 → dissect_target-3.19.dev12}/dissect/target/plugins/apps/browser/edge.py

@@ -28,6 +28,7 @@ class EdgePlugin(ChromiumMixin, BrowserPlugin):
         ".var/app/com.microsoft.Edge/config/microsoft-edge/Default",
         # Windows
         "AppData/Local/Microsoft/Edge/User Data/Default",
+        "AppData/Local/Microsoft/Edge/User Data/Snapshots/*/Default",
         # Macos
         "Library/Application Support/Microsoft Edge/Default",
     ]

{dissect_target-3.19.dev10 → dissect_target-3.19.dev12}/dissect/target/plugins/apps/ssh/openssh.py

@@ -7,7 +7,6 @@ from typing import Iterator
 from dissect.target import Target
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.fsutil import TargetPath
-from dissect.target.helpers.ssh import SSHPrivateKey
 from dissect.target.plugin import export
 from dissect.target.plugins.apps.ssh.ssh import (
     AuthorizedKeysRecord,
@@ -15,6 +14,7 @@ from dissect.target.plugins.apps.ssh.ssh import (
     PrivateKeyRecord,
     PublicKeyRecord,
     SSHPlugin,
+    SSHPrivateKey,
     calculate_fingerprints,
 )
 

{dissect_target-3.19.dev10/dissect/target/helpers → dissect_target-3.19.dev12/dissect/target/plugins/apps/ssh}/ssh.py

@@ -1,8 +1,13 @@
 import base64
 import binascii
+from hashlib import md5, sha1, sha256
 
 from dissect.cstruct import cstruct
 
+from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
+from dissect.target.helpers.record import create_extended_descriptor
+from dissect.target.plugin import NamespacePlugin
+
 rfc4716_def = """
 struct ssh_string {
     uint32 length;
@@ -45,6 +50,129 @@ PEM_MARKER_END_EC = b"-----END EC PRIVATE KEY-----"
 PEM_ENCRYPTED = b"ENCRYPTED"
 
 
+OpenSSHUserRecordDescriptor = create_extended_descriptor([UserRecordDescriptorExtension])
+
+COMMON_ELLEMENTS = [
+    ("string", "key_type"),
+    ("string", "comment"),
+    ("path", "path"),
+]
+
+AuthorizedKeysRecord = OpenSSHUserRecordDescriptor(
+    "application/openssh/authorized_keys",
+    [
+        *COMMON_ELLEMENTS,
+        ("string", "public_key"),
+        ("string", "options"),
+    ],
+)
+
+
+KnownHostRecord = OpenSSHUserRecordDescriptor(
+    "application/openssh/known_host",
+    [
+        ("datetime", "mtime_ts"),
+        *COMMON_ELLEMENTS,
+        ("string", "host"),
+        ("varint", "port"),
+        ("string", "public_key"),
+        ("string", "marker"),
+        ("digest", "fingerprint"),
+    ],
+)
+
+
+PrivateKeyRecord = OpenSSHUserRecordDescriptor(
+    "application/openssh/private_key",
+    [
+        ("datetime", "mtime_ts"),
+        *COMMON_ELLEMENTS,
+        ("string", "key_format"),
+        ("string", "public_key"),
+        ("boolean", "encrypted"),
+    ],
+)
+
+PublicKeyRecord = OpenSSHUserRecordDescriptor(
+    "application/openssh/public_key",
+    [
+        ("datetime", "mtime_ts"),
+        *COMMON_ELLEMENTS,
+        ("string", "public_key"),
+        ("digest", "fingerprint"),
+    ],
+)
+
+
+class SSHPlugin(NamespacePlugin):
+    __namespace__ = "ssh"
+
+
+def calculate_fingerprints(public_key_decoded: bytes, ssh_keygen_format: bool = False) -> tuple[str, str, str]:
+    """Calculate the MD5, SHA1 and SHA256 digest of the given decoded public key.
+
+    Adheres as much as possible to the output provided by ssh-keygen when ``ssh_keygen_format``
+    parameter is set to ``True``. When set to ``False`` (default) hexdigests are calculated
+    instead for ``sha1``and ``sha256``.
+
+    Resources:
+        - https://en.wikipedia.org/wiki/Public_key_fingerprint
+        - https://man7.org/linux/man-pages/man1/ssh-keygen.1.html
+        - ``ssh-keygen -l -E <alg> -f key.pub``
+    """
+    if not public_key_decoded:
+        raise ValueError("No decoded public key provided")
+
+    if not isinstance(public_key_decoded, bytes):
+        raise ValueError("Provided public key should be bytes")
+
+    if public_key_decoded[0:3] != b"\x00\x00\x00":
+        raise ValueError("Provided value does not look like a public key")
+
+    digest_md5 = md5(public_key_decoded).digest()
+    digest_sha1 = sha1(public_key_decoded).digest()
+    digest_sha256 = sha256(public_key_decoded).digest()
+
+    if ssh_keygen_format:
+        fingerprint_sha1 = base64.b64encode(digest_sha1).rstrip(b"=").decode()
+        fingerprint_sha256 = base64.b64encode(digest_sha256).rstrip(b"=").decode()
+    else:
+        fingerprint_sha1 = digest_sha1.hex()
+        fingerprint_sha256 = digest_sha256.hex()
+
+    return digest_md5.hex(), fingerprint_sha1, fingerprint_sha256
+
+
+def is_rfc4716(data: bytes) -> bool:
+    """Validate data is a valid looking SSH private key in the OpenSSH format."""
+    return data.startswith(RFC4716_MARKER_START) and data.endswith(RFC4716_MARKER_END)
+
+
+def decode_rfc4716(data: bytes) -> bytes:
+    """Base64 decode the private key data."""
+    encoded_key_data = data.removeprefix(RFC4716_MARKER_START).removesuffix(RFC4716_MARKER_END)
+    try:
+        return base64.b64decode(encoded_key_data)
+    except binascii.Error:
+        raise ValueError("Error decoding RFC4716 key data")
+
+
+def is_pkcs8(data: bytes) -> bool:
+    """Validate data is a valid looking PKCS8 SSH private key."""
+    return (data.startswith(PKCS8_MARKER_START) and data.endswith(PKCS8_MARKER_END)) or (
+        data.startswith(PKCS8_MARKER_START_ENCRYPTED) and data.endswith(PKCS8_MARKER_END_ENCRYPTED)
+    )
+
+
+def is_pem(data: bytes) -> bool:
+    """Validate data is a valid looking PEM SSH private key."""
+    return (
+        (data.startswith(PEM_MARKER_START_RSA) and data.endswith(PEM_MARKER_END_RSA))
+        or (data.startswith(PEM_MARKER_START_DSA) and data.endswith(PEM_MARKER_END_DSA))
+        or (data.startswith(PEM_MARKER_START_EC) and data.endswith(PEM_MARKER_END_EC))
+    )
+
+
 class SSHPrivateKey:
     """A class to parse (OpenSSH-supported) SSH private keys.
 
@@ -145,33 +273,3 @@ class SSHPrivateKey:
         # This is not a valid SSH key type, but we currently do not detect the specific ecdsa variant.
         else:
             self.key_type = "ecdsa"
-
-
-def is_rfc4716(data: bytes) -> bool:
-    """Validate data is a valid looking SSH private key in the OpenSSH format."""
-    return data.startswith(RFC4716_MARKER_START) and data.endswith(RFC4716_MARKER_END)
-
-
-def decode_rfc4716(data: bytes) -> bytes:
-    """Base64 decode the private key data."""
-    encoded_key_data = data.removeprefix(RFC4716_MARKER_START).removesuffix(RFC4716_MARKER_END)
-    try:
-        return base64.b64decode(encoded_key_data)
-    except binascii.Error:
-        raise ValueError("Error decoding RFC4716 key data")
-
-
-def is_pkcs8(data: bytes) -> bool:
-    """Validate data is a valid looking PKCS8 SSH private key."""
-    return (data.startswith(PKCS8_MARKER_START) and data.endswith(PKCS8_MARKER_END)) or (
-        data.startswith(PKCS8_MARKER_START_ENCRYPTED) and data.endswith(PKCS8_MARKER_END_ENCRYPTED)
-    )
-
-
-def is_pem(data: bytes) -> bool:
-    """Validate data is a valid looking PEM SSH private key."""
-    return (
-        (data.startswith(PEM_MARKER_START_RSA) and data.endswith(PEM_MARKER_END_RSA))
-        or (data.startswith(PEM_MARKER_START_DSA) and data.endswith(PEM_MARKER_END_DSA))
-        or (data.startswith(PEM_MARKER_START_EC) and data.endswith(PEM_MARKER_END_EC))
-    )

{dissect_target-3.19.dev10 → dissect_target-3.19.dev12/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev10
+Version: 3.19.dev12
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.19.dev10 → dissect_target-3.19.dev12}/dissect.target.egg-info/SOURCES.txt

@@ -77,7 +77,6 @@ dissect/target/helpers/record.py
 dissect/target/helpers/record_modifier.py
 dissect/target/helpers/regutil.py
 dissect/target/helpers/shell_folder_ids.py
-dissect/target/helpers/ssh.py
 dissect/target/helpers/targetd.py
 dissect/target/helpers/utils.py
 dissect/target/helpers/compat/__init__.py

{dissect_target-3.19.dev10 → dissect_target-3.19.dev12}/tests/plugins/apps/browser/test_chrome.py

@@ -32,9 +32,21 @@ def target_chrome_unix(target_unix_users: Target, fs_unix: VirtualFilesystem) ->
     yield target_unix_users
 
 
+@pytest.fixture
+def target_chrome_win_snapshot(target_win_users: Target, fs_win: VirtualFilesystem) -> Iterator[Target]:
+    fs_win.map_dir(
+        "Users\\John\\AppData\\Local\\Google\\Chrome\\User Data\\Snapshots\\116.0.5038.150\\Default",
+        absolute_path("_data/plugins/apps/browser/chrome/"),
+    )
+
+    target_win_users.add_plugin(ChromePlugin)
+
+    yield target_win_users
+
+
 @pytest.mark.parametrize(
     "target_platform",
-    ["target_chrome_win", "target_chrome_unix"],
+    ["target_chrome_win", "target_chrome_unix", "target_chrome_win_snapshot"],
 )
 def test_chrome_history(target_platform: Target, request: pytest.FixtureRequest) -> None:
     target_platform = request.getfixturevalue(target_platform)
@@ -54,7 +66,7 @@ def test_chrome_history(target_platform: Target, request: pytest.FixtureRequest)
 
 @pytest.mark.parametrize(
     "target_platform",
-    ["target_chrome_win", "target_chrome_unix"],
+    ["target_chrome_win", "target_chrome_unix", "target_chrome_win_snapshot"],
 )
 def test_chrome_downloads(target_platform: Target, request: pytest.FixtureRequest) -> None:
     target_platform = request.getfixturevalue(target_platform)
@@ -71,7 +83,7 @@ def test_chrome_downloads(target_platform: Target, request: pytest.FixtureReques
 
 @pytest.mark.parametrize(
     "target_platform",
-    ["target_chrome_win", "target_chrome_unix"],
+    ["target_chrome_win", "target_chrome_unix", "target_chrome_win_snapshot"],
 )
 def test_chrome_extensions(target_platform: Target, request: pytest.FixtureRequest) -> None:
     target_platform = request.getfixturevalue(target_platform)
@@ -204,3 +216,39 @@ def test_windows_chrome_cookies_dpapi(target_win_users_dpapi: Target, fs_win: Vi
         "GPS": "1",
         "PREF": "tz=Europe.Berlin",
     }
+
+
+def test_chrome_windows_snapshots(target_win_users: Target, fs_win: VirtualFilesystem) -> None:
+    base_dir = "Users\\John\\AppData\\Local\\Google\\Chrome\\User Data\\Default"
+    snapshot_dirs = [
+        "Users\\John\\AppData\\Local\\Google\\Chrome\\User Data\\Snapshots\\116.0.5038.150\\Default",
+        "Users\\John\\AppData\\Local\\Google\\Chrome\\User Data\\Snapshots\\119.0.7845.119\\Default",
+    ]
+    profile_dirs = [base_dir] + snapshot_dirs
+
+    for dir in profile_dirs:
+        fs_win.map_dir(
+            dir,
+            absolute_path("_data/plugins/apps/browser/chrome/"),
+        )
+
+    target_win_users.add_plugin(ChromePlugin)
+
+    records_list = [
+        list(target_win_users.chrome.history()),
+        list(target_win_users.chrome.extensions()),
+        list(target_win_users.chrome.downloads()),
+    ]
+
+    # Loop over the different types of records and verify we have the same amount of records in each profile directory.
+    for records in records_list:
+        assert set(["chrome"]) == set(record.browser for record in records)
+
+        base_path_records = [r for r in records if str(r.source.parent).endswith(base_dir)]
+
+        for snapshot_dir in snapshot_dirs:
+            # Retrieve records that are in the snapshot's directory.
+            snapshot_records = [r for r in records if str(r.source.parent).endswith(snapshot_dir)]
+
+            # We map the same files in each of the snapshot directories.
+            assert len(base_path_records) == len(snapshot_records)

{dissect_target-3.19.dev10 → dissect_target-3.19.dev12}/tests/plugins/apps/browser/test_edge.py

@@ -31,9 +31,21 @@ def target_edge_unix(target_unix_users, fs_unix):
     yield target_unix_users
 
 
+@pytest.fixture
+def target_edge_win_snapshot(target_win_users: Target, fs_win: VirtualFilesystem) -> Iterator[Target]:
+    fs_win.map_dir(
+        "Users\\John\\AppData\\Local\\Microsoft\\Edge\\User Data\\Snapshots\\116.0.5038.150\\Default",
+        absolute_path("_data/plugins/apps/browser/edge/"),
+    )
+
+    target_win_users.add_plugin(EdgePlugin)
+
+    yield target_win_users
+
+
 @pytest.mark.parametrize(
     "target_platform",
-    ["target_edge_win", "target_edge_unix"],
+    ["target_edge_win", "target_edge_unix", "target_edge_win_snapshot"],
 )
 def test_edge_history(target_platform: Target, request: pytest.FixtureRequest) -> None:
     target_platform = request.getfixturevalue(target_platform)
@@ -50,7 +62,7 @@ def test_edge_history(target_platform: Target, request: pytest.FixtureRequest) -
 
 @pytest.mark.parametrize(
     "target_platform",
-    ["target_edge_win", "target_edge_unix"],
+    ["target_edge_win", "target_edge_unix", "target_edge_win_snapshot"],
 )
 def test_edge_downloads(target_platform: Target, request: pytest.FixtureRequest) -> None:
     target_platform = request.getfixturevalue(target_platform)
@@ -67,7 +79,7 @@ def test_edge_downloads(target_platform: Target, request: pytest.FixtureRequest)
 
 @pytest.mark.parametrize(
     "target_platform",
-    ["target_edge_win", "target_edge_unix"],
+    ["target_edge_win", "target_edge_unix", "target_edge_win_snapshot"],
 )
 def test_edge_extensions(target_platform: Target, request: pytest.FixtureRequest) -> None:
     target_platform = request.getfixturevalue(target_platform)
@@ -129,3 +141,39 @@ def test_unix_edge_passwords_gnome_plugin(target_edge_unix: Target, fs_unix: Vir
     assert records[0].decrypted_username == "username"
     assert records[0].decrypted_password is None
     assert records[0].url == "https://test.com/"
+
+
+def test_edge_windows_snapshots(target_win_users: Target, fs_win: VirtualFilesystem) -> None:
+    base_dir = "Users\\John\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default"
+    snapshot_dirs = [
+        "Users\\John\\AppData\\Local\\Microsoft\\Edge\\User Data\\Snapshots\\116.0.5038.150\\Default",
+        "Users\\John\\AppData\\Local\\Microsoft\\Edge\\User Data\\Snapshots\\119.0.7845.119\\Default",
+    ]
+    profile_dirs = [base_dir] + snapshot_dirs
+
+    for dir in profile_dirs:
+        fs_win.map_dir(
+            dir,
+            absolute_path("_data/plugins/apps/browser/edge/"),
+        )
+
+    target_win_users.add_plugin(EdgePlugin)
+
+    records_list = [
+        list(target_win_users.edge.history()),
+        list(target_win_users.edge.extensions()),
+        list(target_win_users.edge.downloads()),
+    ]
+
+    # Loop over the different types of records and verify we have the same amount of records in each profile directory.
+    for records in records_list:
+        assert set(["edge"]) == set(record.browser for record in records)
+
+        base_path_records = [r for r in records if str(r.source.parent).endswith(base_dir)]
+
+        for snapshot_dir in snapshot_dirs:
+            # Retrieve records that are in the snapshot's directory.
+            snapshot_records = [r for r in records if str(r.source.parent).endswith(snapshot_dir)]
+
+            # We map the same files in each of the snapshot directories.
+            assert len(base_path_records) == len(snapshot_records)

dissect_target-3.19.dev10/dissect/target/plugins/apps/ssh/ssh.py

@@ -1,98 +0,0 @@
-import base64
-from hashlib import md5, sha1, sha256
-
-from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
-from dissect.target.helpers.record import create_extended_descriptor
-from dissect.target.plugin import NamespacePlugin
-
-OpenSSHUserRecordDescriptor = create_extended_descriptor([UserRecordDescriptorExtension])
-
-COMMON_ELLEMENTS = [
-    ("string", "key_type"),
-    ("string", "comment"),
-    ("path", "path"),
-]
-
-AuthorizedKeysRecord = OpenSSHUserRecordDescriptor(
-    "application/openssh/authorized_keys",
-    [
-        *COMMON_ELLEMENTS,
-        ("string", "public_key"),
-        ("string", "options"),
-    ],
-)
-
-
-KnownHostRecord = OpenSSHUserRecordDescriptor(
-    "application/openssh/known_host",
-    [
-        ("datetime", "mtime_ts"),
-        *COMMON_ELLEMENTS,
-        ("string", "host"),
-        ("varint", "port"),
-        ("string", "public_key"),
-        ("string", "marker"),
-        ("digest", "fingerprint"),
-    ],
-)
-
-
-PrivateKeyRecord = OpenSSHUserRecordDescriptor(
-    "application/openssh/private_key",
-    [
-        ("datetime", "mtime_ts"),
-        *COMMON_ELLEMENTS,
-        ("string", "key_format"),
-        ("string", "public_key"),
-        ("boolean", "encrypted"),
-    ],
-)
-
-PublicKeyRecord = OpenSSHUserRecordDescriptor(
-    "application/openssh/public_key",
-    [
-        ("datetime", "mtime_ts"),
-        *COMMON_ELLEMENTS,
-        ("string", "public_key"),
-        ("digest", "fingerprint"),
-    ],
-)
-
-
-class SSHPlugin(NamespacePlugin):
-    __namespace__ = "ssh"
-
-
-def calculate_fingerprints(public_key_decoded: bytes, ssh_keygen_format: bool = False) -> tuple[str, str, str]:
-    """Calculate the MD5, SHA1 and SHA256 digest of the given decoded public key.
-
-    Adheres as much as possible to the output provided by ssh-keygen when ``ssh_keygen_format``
-    parameter is set to ``True``. When set to ``False`` (default) hexdigests are calculated
-    instead for ``sha1``and ``sha256``.
-
-    Resources:
-        - https://en.wikipedia.org/wiki/Public_key_fingerprint
-        - https://man7.org/linux/man-pages/man1/ssh-keygen.1.html
-        - ``ssh-keygen -l -E <alg> -f key.pub``
-    """
-    if not public_key_decoded:
-        raise ValueError("No decoded public key provided")
-
-    if not isinstance(public_key_decoded, bytes):
-        raise ValueError("Provided public key should be bytes")
-
-    if public_key_decoded[0:3] != b"\x00\x00\x00":
-        raise ValueError("Provided value does not look like a public key")
-
-    digest_md5 = md5(public_key_decoded).digest()
-    digest_sha1 = sha1(public_key_decoded).digest()
-    digest_sha256 = sha256(public_key_decoded).digest()
-
-    if ssh_keygen_format:
-        fingerprint_sha1 = base64.b64encode(digest_sha1).rstrip(b"=").decode()
-        fingerprint_sha256 = base64.b64encode(digest_sha256).rstrip(b"=").decode()
-    else:
-        fingerprint_sha1 = digest_sha1.hex()
-        fingerprint_sha256 = digest_sha256.hex()
-
-    return digest_md5.hex(), fingerprint_sha1, fingerprint_sha256