dissect.target 3.19.dev58__py3-none-any.whl → 3.20__py3-none-any.whl

Sign up to get free protection for your applications and to get access to all the features.
Files changed (180) hide show
  1. dissect/target/container.py +1 -1
  2. dissect/target/exceptions.py +6 -5
  3. dissect/target/filesystem.py +2 -2
  4. dissect/target/filesystems/btrfs.py +14 -5
  5. dissect/target/filesystems/config.py +5 -1
  6. dissect/target/filesystems/extfs.py +5 -4
  7. dissect/target/filesystems/fat.py +22 -16
  8. dissect/target/filesystems/ffs.py +11 -4
  9. dissect/target/filesystems/jffs.py +12 -7
  10. dissect/target/filesystems/ntfs.py +22 -6
  11. dissect/target/filesystems/overlay.py +14 -4
  12. dissect/target/filesystems/smb.py +3 -3
  13. dissect/target/filesystems/squashfs.py +4 -4
  14. dissect/target/filesystems/vmfs.py +4 -4
  15. dissect/target/filesystems/xfs.py +15 -8
  16. dissect/target/helpers/compat/path_common.py +5 -5
  17. dissect/target/helpers/configutil.py +128 -32
  18. dissect/target/helpers/cyber.py +2 -0
  19. dissect/target/helpers/data/windowsZones.xml +19 -23
  20. dissect/target/helpers/docs.py +1 -1
  21. dissect/target/helpers/keychain.py +2 -0
  22. dissect/target/helpers/mount.py +2 -1
  23. dissect/target/helpers/record.py +29 -2
  24. dissect/target/helpers/record_modifier.py +5 -1
  25. dissect/target/helpers/regutil.py +56 -26
  26. dissect/target/loader.py +1 -1
  27. dissect/target/loaders/mqtt.py +104 -9
  28. dissect/target/loaders/proxmox.py +68 -0
  29. dissect/target/loaders/vma.py +1 -1
  30. dissect/target/loaders/xva.py +1 -1
  31. dissect/target/plugin.py +24 -21
  32. dissect/target/plugins/apps/av/mcafee.py +2 -0
  33. dissect/target/plugins/apps/av/sophos.py +2 -0
  34. dissect/target/plugins/apps/av/trendmicro.py +2 -0
  35. dissect/target/plugins/apps/browser/chromium.py +27 -6
  36. dissect/target/plugins/apps/container/docker.py +48 -32
  37. dissect/target/plugins/apps/editor/__init__.py +0 -0
  38. dissect/target/plugins/apps/editor/editor.py +23 -0
  39. dissect/target/plugins/apps/{texteditor → editor}/windowsnotepad.py +40 -31
  40. dissect/target/plugins/apps/other/__init__.py +0 -0
  41. dissect/target/plugins/apps/other/env.py +56 -0
  42. dissect/target/plugins/apps/shell/powershell.py +6 -2
  43. dissect/target/plugins/apps/shell/wget.py +91 -0
  44. dissect/target/plugins/apps/ssh/openssh.py +2 -0
  45. dissect/target/plugins/apps/ssh/opensshd.py +2 -0
  46. dissect/target/plugins/apps/virtualization/__init__.py +0 -0
  47. dissect/target/plugins/apps/virtualization/vmware_workstation.py +61 -0
  48. dissect/target/plugins/apps/vpn/wireguard.py +9 -9
  49. dissect/target/plugins/apps/webhosting/cpanel.py +2 -0
  50. dissect/target/plugins/apps/webserver/caddy.py +2 -0
  51. dissect/target/plugins/apps/webserver/nginx.py +2 -0
  52. dissect/target/plugins/child/esxi.py +3 -1
  53. dissect/target/plugins/child/parallels.py +68 -0
  54. dissect/target/plugins/child/proxmox.py +23 -0
  55. dissect/target/plugins/child/virtuozzo.py +12 -8
  56. dissect/target/plugins/child/vmware_workstation.py +23 -8
  57. dissect/target/plugins/filesystem/acquire_hash.py +2 -1
  58. dissect/target/plugins/filesystem/icat.py +15 -11
  59. dissect/target/plugins/filesystem/ntfs/mft.py +10 -6
  60. dissect/target/plugins/filesystem/ntfs/mft_timeline.py +3 -1
  61. dissect/target/plugins/filesystem/ntfs/usnjrnl.py +2 -0
  62. dissect/target/plugins/filesystem/ntfs/utils.py +3 -1
  63. dissect/target/plugins/filesystem/unix/suid.py +4 -1
  64. dissect/target/plugins/filesystem/walkfs.py +2 -0
  65. dissect/target/plugins/general/example.py +2 -2
  66. dissect/target/plugins/general/loaders.py +18 -5
  67. dissect/target/plugins/general/network.py +20 -5
  68. dissect/target/plugins/general/osinfo.py +1 -0
  69. dissect/target/plugins/general/plugins.py +53 -10
  70. dissect/target/plugins/os/unix/_os.py +70 -44
  71. dissect/target/plugins/os/unix/applications.py +78 -0
  72. dissect/target/plugins/os/unix/bsd/citrix/history.py +2 -0
  73. dissect/target/plugins/os/unix/bsd/osx/_os.py +4 -21
  74. dissect/target/plugins/os/unix/bsd/osx/network.py +92 -0
  75. dissect/target/plugins/os/unix/bsd/osx/user.py +4 -0
  76. dissect/target/plugins/os/unix/cronjobs.py +8 -4
  77. dissect/target/plugins/os/unix/etc/etc.py +4 -0
  78. dissect/target/plugins/os/unix/generic.py +2 -0
  79. dissect/target/plugins/os/unix/history.py +27 -25
  80. dissect/target/plugins/os/unix/linux/_os.py +8 -10
  81. dissect/target/plugins/os/unix/linux/cmdline.py +2 -0
  82. dissect/target/plugins/os/unix/linux/debian/apt.py +4 -1
  83. dissect/target/plugins/os/unix/linux/debian/dpkg.py +3 -3
  84. dissect/target/plugins/os/unix/linux/debian/proxmox/__init__.py +0 -0
  85. dissect/target/plugins/os/unix/linux/debian/proxmox/_os.py +141 -0
  86. dissect/target/plugins/os/unix/linux/debian/proxmox/vm.py +29 -0
  87. dissect/target/plugins/os/unix/linux/debian/snap.py +79 -0
  88. dissect/target/plugins/os/unix/linux/environ.py +2 -0
  89. dissect/target/plugins/os/unix/linux/fortios/_os.py +74 -63
  90. dissect/target/plugins/os/unix/linux/fortios/generic.py +2 -0
  91. dissect/target/plugins/os/unix/linux/fortios/locale.py +2 -0
  92. dissect/target/plugins/os/unix/linux/modules.py +2 -0
  93. dissect/target/plugins/os/unix/linux/netstat.py +2 -0
  94. dissect/target/{helpers → plugins/os/unix/linux}/network_managers.py +11 -9
  95. dissect/target/plugins/os/unix/linux/processes.py +2 -0
  96. dissect/target/plugins/os/unix/linux/redhat/yum.py +4 -1
  97. dissect/target/plugins/os/unix/linux/services.py +5 -3
  98. dissect/target/plugins/os/unix/linux/sockets.py +2 -0
  99. dissect/target/plugins/os/unix/linux/suse/zypper.py +4 -1
  100. dissect/target/plugins/os/unix/locale.py +2 -0
  101. dissect/target/plugins/os/unix/locate/gnulocate.py +4 -2
  102. dissect/target/plugins/os/unix/locate/mlocate.py +2 -0
  103. dissect/target/plugins/os/unix/locate/plocate.py +3 -1
  104. dissect/target/plugins/os/unix/log/atop.py +2 -0
  105. dissect/target/plugins/os/unix/log/audit.py +3 -1
  106. dissect/target/plugins/os/unix/log/auth.py +351 -38
  107. dissect/target/plugins/os/unix/log/journal.py +123 -101
  108. dissect/target/plugins/os/unix/log/lastlog.py +5 -3
  109. dissect/target/plugins/os/unix/log/messages.py +51 -27
  110. dissect/target/plugins/os/unix/log/utmp.py +52 -71
  111. dissect/target/plugins/os/unix/packagemanager.py +5 -38
  112. dissect/target/plugins/os/unix/shadow.py +3 -1
  113. dissect/target/plugins/os/unix/trash.py +132 -0
  114. dissect/target/plugins/os/windows/_os.py +22 -41
  115. dissect/target/plugins/os/windows/activitiescache.py +9 -4
  116. dissect/target/plugins/os/windows/adpolicy.py +2 -1
  117. dissect/target/plugins/os/windows/amcache.py +16 -13
  118. dissect/target/plugins/os/windows/defender.py +4 -3
  119. dissect/target/plugins/os/windows/dpapi/keyprovider/credhist.py +3 -0
  120. dissect/target/plugins/os/windows/dpapi/keyprovider/empty.py +3 -0
  121. dissect/target/plugins/os/windows/dpapi/keyprovider/keychain.py +3 -0
  122. dissect/target/plugins/os/windows/dpapi/keyprovider/lsa.py +3 -0
  123. dissect/target/plugins/os/windows/env.py +1 -2
  124. dissect/target/plugins/os/windows/exchange/exchange.py +6 -4
  125. dissect/target/plugins/os/windows/generic.py +68 -19
  126. dissect/target/plugins/os/windows/lnk.py +2 -0
  127. dissect/target/plugins/os/windows/locale.py +9 -3
  128. dissect/target/plugins/os/windows/log/etl.py +5 -4
  129. dissect/target/plugins/os/windows/log/evt.py +12 -8
  130. dissect/target/plugins/os/windows/log/evtx.py +9 -7
  131. dissect/target/plugins/os/windows/log/mssql.py +103 -0
  132. dissect/target/plugins/os/windows/log/pfro.py +2 -1
  133. dissect/target/plugins/os/windows/network.py +380 -0
  134. dissect/target/plugins/os/windows/notifications.py +6 -4
  135. dissect/target/plugins/os/windows/prefetch.py +7 -2
  136. dissect/target/plugins/os/windows/regf/7zip.py +9 -1
  137. dissect/target/plugins/os/windows/regf/applications.py +62 -0
  138. dissect/target/plugins/os/windows/regf/auditpol.py +2 -1
  139. dissect/target/plugins/os/windows/regf/bam.py +3 -1
  140. dissect/target/plugins/os/windows/regf/cit.py +14 -12
  141. dissect/target/plugins/os/windows/regf/clsid.py +6 -3
  142. dissect/target/plugins/os/windows/regf/firewall.py +2 -1
  143. dissect/target/plugins/os/windows/regf/mru.py +9 -8
  144. dissect/target/plugins/os/windows/regf/nethist.py +6 -3
  145. dissect/target/plugins/os/windows/regf/recentfilecache.py +3 -1
  146. dissect/target/plugins/os/windows/regf/regf.py +5 -1
  147. dissect/target/plugins/os/windows/regf/shellbags.py +351 -345
  148. dissect/target/plugins/os/windows/regf/shimcache.py +1 -1
  149. dissect/target/plugins/os/windows/regf/usb.py +2 -1
  150. dissect/target/plugins/os/windows/regf/userassist.py +2 -1
  151. dissect/target/plugins/os/windows/registry.py +11 -0
  152. dissect/target/plugins/os/windows/services.py +3 -2
  153. dissect/target/plugins/os/windows/startupinfo.py +7 -2
  154. dissect/target/plugins/os/windows/syscache.py +5 -2
  155. dissect/target/plugins/os/windows/tasks.py +1 -1
  156. dissect/target/plugins/os/windows/thumbcache.py +11 -5
  157. dissect/target/plugins/os/windows/ual.py +12 -9
  158. dissect/target/plugins/os/windows/wer.py +21 -6
  159. dissect/target/plugins/os/windows/wua_history.py +0 -1
  160. dissect/target/target.py +13 -8
  161. dissect/target/tools/dump/utils.py +4 -0
  162. dissect/target/tools/fsutils.py +1 -1
  163. dissect/target/tools/info.py +1 -1
  164. dissect/target/tools/mount.py +15 -5
  165. dissect/target/tools/query.py +15 -9
  166. dissect/target/tools/shell.py +98 -9
  167. dissect/target/tools/utils.py +7 -7
  168. dissect/target/volume.py +4 -4
  169. {dissect.target-3.19.dev58.dist-info → dissect.target-3.20.dist-info}/METADATA +6 -2
  170. {dissect.target-3.19.dev58.dist-info → dissect.target-3.20.dist-info}/RECORD +176 -160
  171. {dissect.target-3.19.dev58.dist-info → dissect.target-3.20.dist-info}/WHEEL +1 -1
  172. dissect/target/helpers/targetd.py +0 -58
  173. dissect/target/loaders/targetd.py +0 -223
  174. dissect/target/plugins/apps/texteditor/texteditor.py +0 -13
  175. dissect/target/plugins/os/unix/etc.py +0 -9
  176. /dissect/target/plugins/apps/{texteditor → database}/__init__.py +0 -0
  177. {dissect.target-3.19.dev58.dist-info → dissect.target-3.20.dist-info}/COPYRIGHT +0 -0
  178. {dissect.target-3.19.dev58.dist-info → dissect.target-3.20.dist-info}/LICENSE +0 -0
  179. {dissect.target-3.19.dev58.dist-info → dissect.target-3.20.dist-info}/entry_points.txt +0 -0
  180. {dissect.target-3.19.dev58.dist-info → dissect.target-3.20.dist-info}/top_level.txt +0 -0
@@ -1,58 +0,0 @@
1
- from __future__ import annotations
2
-
3
- import functools
4
- from typing import Any, Callable, Optional, Union
5
-
6
- from dissect.util.stream import AlignedStream
7
-
8
- from dissect.target.exceptions import FatalError
9
- from dissect.target.loader import Loader
10
-
11
-
12
- class TargetdStream(AlignedStream):
13
- def _read(self, offset: int, length: int) -> bytes:
14
- return b""
15
-
16
-
17
- # Marker interface to indicate this loader loads targets from remote machines
18
- class ProxyLoader(Loader):
19
- pass
20
-
21
-
22
- class TargetdInvalidStateError(FatalError):
23
- pass
24
-
25
-
26
- class CommandProxy:
27
- def __init__(self, loader: Loader, func: Callable, namespace: Optional[str] = None):
28
- self._loader = loader
29
- self._func = func
30
- self._namespace = namespace or func
31
-
32
- def __getattr__(self, func: Union[Callable, str]) -> CommandProxy:
33
- if func == "func":
34
- return self._func.func
35
- self._func = func
36
- return self
37
-
38
- def command(self) -> Callable:
39
- namespace = None if self._func == self._namespace else self._namespace
40
- return self._get(namespace, self._func)
41
-
42
- def _get(self, namespace: Optional[str], plugin_func: Callable) -> Callable:
43
- if namespace:
44
- func = functools.update_wrapper(
45
- functools.partial(self._loader.plugin_bridge, plugin_func=self._func, namespace=self._namespace),
46
- self._loader.plugin_bridge,
47
- )
48
- else:
49
- func = functools.update_wrapper(
50
- functools.partial(self._loader.plugin_bridge, plugin_func=plugin_func), self._loader.plugin_bridge
51
- )
52
- return func
53
-
54
- def __call__(self, *args, **kwargs) -> Any:
55
- return self.command()(*args, **kwargs)
56
-
57
- def __repr__(self) -> str:
58
- return str(self._get(None, "get")(**{"property_name": self._func}))
@@ -1,223 +0,0 @@
1
- from __future__ import annotations
2
-
3
- import functools
4
- import ssl
5
- import time
6
- import urllib
7
- from pathlib import Path
8
- from platform import os
9
- from typing import Any, Callable, Optional, Union
10
-
11
- from dissect.target.containers.raw import RawContainer
12
- from dissect.target.exceptions import LoaderError
13
-
14
- # to avoid loading issues during automatic loader detection
15
- from dissect.target.helpers.targetd import (
16
- CommandProxy,
17
- ProxyLoader,
18
- TargetdInvalidStateError,
19
- TargetdStream,
20
- )
21
- from dissect.target.loader import Loader
22
- from dissect.target.plugin import Plugin, export
23
- from dissect.target.target import Target
24
-
25
- TARGETD_AVAILABLE = False
26
- try:
27
- from flow import remoting
28
- from targetd.clients import Client
29
-
30
- TARGETD_AVAILABLE = True
31
- except Exception:
32
- pass
33
-
34
-
35
- class TargetdLoader(ProxyLoader):
36
- """Load remote targets through a broker."""
37
-
38
- instance = None
39
-
40
- def __init__(self, path: Union[Path, str], **kwargs):
41
- super().__init__(path)
42
- self._plugin_func = None
43
- self.client = None
44
- self.output = None
45
- self.peers = 1
46
- self.cacert = None
47
- self.adapter = "Flow.Remoting"
48
- self.host = "localhost"
49
- self.port = 1883
50
- self.chunking = True
51
- self.local_link = "unix:///tmp/targetd" if os.name == "posix" else "pipe:///tmp/targetd"
52
- # @todo Add these options to loader help (when available)
53
- self.configurables = [
54
- ["cacert", Path, "SSL: cacert file"],
55
- ["host", str, "IP-address of targetd broker"],
56
- ["port", int, "Port for connecting to targetd broker"],
57
- ["local_link", str, "Domain socket or named pipe"],
58
- ["adapter", str, "Adapter to use"],
59
- ["peers", int, "Minimum number of hosts to wait for before executing query"],
60
- ["chunking", int, "Chunk mode"],
61
- ]
62
- uri = kwargs.get("parsed_path")
63
- if uri is None:
64
- raise LoaderError("No URI connection details have been passed.")
65
- self.uri = uri.path
66
- self.options = dict(urllib.parse.parse_qsl(uri.query, keep_blank_values=True))
67
-
68
- def _process_options(self, target: Target) -> None:
69
- for configurable_details in self.configurables:
70
- configurable, value_type, description = configurable_details
71
- configuration = self.options.get(configurable)
72
- if not configuration:
73
- default_value = getattr(self, configurable)
74
- target.log.warning("%s not configured, using: %s=%s", description, configurable, default_value)
75
- else:
76
- setattr(self, configurable, value_type(configuration))
77
-
78
- @export(output="record", cache=False)
79
- def plugin_bridge(self, *args, **kwargs) -> list[Any]:
80
- """Command Execution Bridge Plugin for Targetd.
81
-
82
- This is a generic plugin interceptor that becomes active only if using
83
- the targetd loader. This plugin acts as a bridge to connect to the Targetd broker
84
- and will translate the requested plugin-operation into Targetd-commands using the selected
85
- adapter (i.e. Flow.Remoting).
86
- """
87
-
88
- if not TARGETD_AVAILABLE:
89
- raise ImportError("This loader requires the targetd package to be installed.")
90
-
91
- self.output = None
92
- self.has_output = False
93
-
94
- plugin_func = kwargs.pop("plugin_func", None)
95
-
96
- if self.client is None:
97
- ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
98
- ssl_context.check_hostname = False
99
- if self.cacert and not self.cacert.exists():
100
- raise LoaderError(f"file not found: {self.cacert}")
101
- if self.cacert:
102
- ssl_context.load_verify_locations(self.cacert)
103
- else:
104
- ssl_context.load_default_certs(purpose=ssl.Purpose.SERVER_AUTH)
105
- self.client = Client(self.host, self.port, ssl_context, [self.uri], self.local_link, "targetd")
106
- self.client.module_fullname = "dissect.target.loaders"
107
- self.client.module_fromlist = ["command_runner"]
108
- self.client.command = plugin_func
109
- try:
110
- self.client.start(*args, **kwargs)
111
- except Exception:
112
- # If something happens that prevents targetd from properly closing/resetting the
113
- # connection, this exception is thrown during the next connection and the connection
114
- # is closed properly after all so that the next time the loader will be able to
115
- # use a new connection with a new session.
116
- self.client.close()
117
- raise TargetdInvalidStateError("Targetd connection is in invalid state, retry.")
118
- else:
119
- self.client.command = plugin_func
120
- self.client.exec_command(*args, **kwargs)
121
-
122
- while not self.has_output:
123
- time.sleep(1)
124
- return self.output
125
-
126
- def _get_command(self, func: str, namespace: str = None) -> tuple[Loader, functools.partial]:
127
- return (self, CommandProxy(self, func, namespace=namespace))
128
-
129
- def each(self, func: Callable, target: Optional[Target] = None) -> Any:
130
- """Allows you to attach a scriptlet (function) to each of the remote hosts.
131
- The results of the function are accumulated using +=. Exceptions are
132
- catched and logged as warnings.
133
-
134
- Usage:
135
-
136
- def my_function(remote_target):
137
- ...do something interesting...
138
-
139
- targets = Target.open( targetd://... )
140
- targets.each(my_function)
141
-
142
- """
143
- result = None
144
- if not self.client:
145
- target.init()
146
- for peer in self.client.peers:
147
- target.select(peer)
148
- try:
149
- if result is None:
150
- result = func(target)
151
- else:
152
- result += func(target)
153
- except Exception as failure:
154
- target.log.warning("Exception while applying function to target: %s: %s", peer, failure)
155
- return result
156
-
157
- def _add_plugin(self, plugin: Plugin):
158
- plugin.check_compatibe = lambda: True
159
-
160
- def map(self, target: Target) -> None:
161
- if TargetdLoader.instance:
162
- raise Exception("You can only initiated 1 targetd control connection per session.")
163
- self._process_options(target)
164
- target.disks.add(RawContainer(TargetdStream()))
165
- target.get_function = self._get_command
166
- target.add_plugin = self._add_plugin
167
- target.each = functools.update_wrapper(functools.partial(self.each, target=target), self.each)
168
- TargetdLoader.instance = self
169
-
170
- @staticmethod
171
- def detect(path: Path) -> bool:
172
- # You can only activate this loader by URI-scheme "targetd://"
173
- return False
174
-
175
- def __del__(self) -> None:
176
- if self.client:
177
- self.client.close()
178
-
179
-
180
- if TARGETD_AVAILABLE:
181
- # Loader has to provide the control script for targetd in this case
182
- def command_runner(link: str, targetd: Client, *args, **kwargs) -> None:
183
- caller = TargetdLoader.instance
184
- if not targetd.rpcs:
185
- targetd.easy_connect_remoting(remoting, link, caller.peers)
186
-
187
- obj = targetd.rpcs
188
- if namespace := kwargs.get("namespace", None):
189
- obj = getattr(obj, namespace)
190
-
191
- caller.has_output = True
192
- if targetd.command == "init":
193
- caller.output = True
194
- return
195
-
196
- if targetd.command == "select":
197
- targetd.rpcs.select(*args)
198
- caller.output = True
199
- return
200
-
201
- if targetd.command == "deselect":
202
- targetd.rpcs.deselect()
203
- caller.output = True
204
- return
205
-
206
- func = getattr(obj, targetd.command)
207
-
208
- result = func(*args, **kwargs)
209
- if result is not None:
210
- if targetd.command == "get":
211
- result = list(result)[0]
212
- elif caller.chunking:
213
- data = []
214
- gen = func()
215
- targetd.reset()
216
- while True:
217
- try:
218
- data.append(next(gen))
219
- except Exception:
220
- break
221
- result = data
222
- caller.output = result
223
- targetd.reset()
@@ -1,13 +0,0 @@
1
- from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
2
- from dissect.target.helpers.record import create_extended_descriptor
3
- from dissect.target.plugin import NamespacePlugin
4
-
5
- GENERIC_TAB_CONTENTS_RECORD_FIELDS = [("string", "content"), ("path", "path"), ("string", "deleted_content")]
6
-
7
- TexteditorTabContentRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
8
- "texteditor/tab", GENERIC_TAB_CONTENTS_RECORD_FIELDS
9
- )
10
-
11
-
12
- class TexteditorPlugin(NamespacePlugin):
13
- __namespace__ = "texteditor"
@@ -1,9 +0,0 @@
1
- from dissect.target import Target
2
- from dissect.target.plugins.general.config import ConfigurationTreePlugin
3
-
4
-
5
- class EtcTree(ConfigurationTreePlugin):
6
- __namespace__ = "etc"
7
-
8
- def __init__(self, target: Target):
9
- super().__init__(target, "/etc")