dissect.target 3.20.1__py3-none-any.whl → 3.20.2.dev11__py3-none-any.whl
Sign up to get free protection for your applications and to get access to all the features.
- dissect/target/helpers/configutil.py +3 -3
- dissect/target/loaders/itunes.py +5 -3
- dissect/target/plugins/apps/browser/iexplore.py +7 -3
- dissect/target/plugins/general/plugins.py +1 -1
- dissect/target/plugins/os/unix/_os.py +1 -1
- dissect/target/plugins/os/unix/esxi/_os.py +34 -32
- dissect/target/plugins/os/unix/linux/fortios/_keys.py +7919 -1951
- dissect/target/plugins/os/unix/linux/fortios/_os.py +109 -22
- dissect/target/plugins/os/unix/linux/network_managers.py +1 -1
- dissect/target/plugins/os/unix/log/auth.py +6 -37
- dissect/target/plugins/os/unix/log/helpers.py +46 -0
- dissect/target/plugins/os/unix/log/messages.py +24 -15
- dissect/target/plugins/os/windows/activitiescache.py +32 -30
- dissect/target/plugins/os/windows/catroot.py +14 -5
- dissect/target/plugins/os/windows/lnk.py +13 -7
- dissect/target/plugins/os/windows/notifications.py +40 -38
- dissect/target/plugins/os/windows/regf/cit.py +20 -7
- dissect/target/tools/diff.py +990 -0
- {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/METADATA +2 -2
- {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/RECORD +25 -23
- {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/entry_points.txt +1 -0
- {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/COPYRIGHT +0 -0
- {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/LICENSE +0 -0
- {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/WHEEL +0 -0
- {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/top_level.txt +0 -0
@@ -470,9 +470,9 @@ class Toml(ConfigurationParser):
|
|
470
470
|
class Env(ConfigurationParser):
|
471
471
|
"""Parses ``.env`` file contents according to Docker and bash specification.
|
472
472
|
|
473
|
-
Does not apply interpolation of substituted values,
|
474
|
-
|
475
|
-
|
473
|
+
Does not apply interpolation of substituted values, e.g. ``foo=${bar}`` and does not attempt to parse list or dict
|
474
|
+
strings. Does not support dynamic env files, e.g. ``foo=`bar```. Also does not support multi-line key/value
|
475
|
+
assignments (yet).
|
476
476
|
|
477
477
|
Resources:
|
478
478
|
- https://docs.docker.com/compose/environment-variables/variable-interpolation/#env-file-syntax
|
dissect/target/loaders/itunes.py
CHANGED
@@ -163,8 +163,10 @@ class ITunesBackup:
|
|
163
163
|
|
164
164
|
def files(self) -> Iterator[FileInfo]:
|
165
165
|
"""Iterate all the files in this backup."""
|
166
|
-
|
167
|
-
|
166
|
+
|
167
|
+
if table := self.manifest_db.table("Files"):
|
168
|
+
for row in table.rows():
|
169
|
+
yield FileInfo(self, row.fileID, row.domain, row.relativePath, row.flags, row.file)
|
168
170
|
|
169
171
|
|
170
172
|
class FileInfo:
|
@@ -288,7 +290,7 @@ def translate_file_path(domain: str, relative_path: str) -> str:
|
|
288
290
|
package_name = ""
|
289
291
|
|
290
292
|
domain_path = fsutil.join(DOMAIN_TRANSLATION.get(domain, domain), package_name)
|
291
|
-
return fsutil.join(domain_path, relative_path)
|
293
|
+
return fsutil.join(domain_path, relative_path).rstrip("/")
|
292
294
|
|
293
295
|
|
294
296
|
def parse_key_bag(buf: bytes) -> tuple[dict[str, bytes, int], dict[str, ClassKey]]:
|
@@ -36,14 +36,18 @@ class WebCache:
|
|
36
36
|
All ``ContainerId`` values for the requested container name.
|
37
37
|
"""
|
38
38
|
try:
|
39
|
-
|
39
|
+
table = self.db.table("Containers")
|
40
|
+
|
41
|
+
for container_record in table.records():
|
40
42
|
if record_name := container_record.get("Name"):
|
41
43
|
record_name = record_name.rstrip("\00").lower()
|
42
44
|
if record_name == name.lower():
|
43
45
|
container_id = container_record.get("ContainerId")
|
44
46
|
yield self.db.table(f"Container_{container_id}")
|
45
|
-
|
46
|
-
|
47
|
+
|
48
|
+
except KeyError as e:
|
49
|
+
self.target.log.warning("Exception while parsing EseDB Containers table")
|
50
|
+
self.target.log.debug("", exc_info=e)
|
47
51
|
|
48
52
|
def _iter_records(self, name: str) -> Iterator[record.Record]:
|
49
53
|
"""Yield records from a Webcache container.
|
@@ -169,7 +169,7 @@ class PluginListPlugin(Plugin):
|
|
169
169
|
|
170
170
|
|
171
171
|
def generate_plugins_json(plugins: list[Plugin]) -> Iterator[dict]:
|
172
|
-
"""Generates JSON output of a list of :class:`Plugin
|
172
|
+
"""Generates JSON output of a list of :class:`Plugin`."""
|
173
173
|
|
174
174
|
for p in plugins:
|
175
175
|
func = getattr(p.class_object, p.method_name)
|
@@ -182,7 +182,7 @@ class UnixPlugin(OSPlugin):
|
|
182
182
|
paths (list): list of paths
|
183
183
|
"""
|
184
184
|
redhat_legacy_path = "/etc/sysconfig/network"
|
185
|
-
paths = paths or ["/etc/hostname", "/etc/HOSTNAME", redhat_legacy_path]
|
185
|
+
paths = paths or ["/etc/hostname", "/etc/HOSTNAME", "/proc/sys/kernel/hostname", redhat_legacy_path]
|
186
186
|
hostname_dict = {"hostname": None, "domain": None}
|
187
187
|
|
188
188
|
for path in paths:
|
@@ -472,37 +472,39 @@ def parse_config_store(fh: BinaryIO) -> dict[str, Any]:
|
|
472
472
|
db = sqlite3.SQLite3(fh)
|
473
473
|
|
474
474
|
store = {}
|
475
|
-
|
476
|
-
|
477
|
-
|
478
|
-
|
479
|
-
|
480
|
-
|
481
|
-
|
482
|
-
|
483
|
-
|
484
|
-
|
485
|
-
|
486
|
-
|
487
|
-
|
488
|
-
|
489
|
-
|
490
|
-
|
491
|
-
|
492
|
-
|
493
|
-
|
494
|
-
|
495
|
-
|
496
|
-
|
497
|
-
|
498
|
-
|
499
|
-
|
500
|
-
|
501
|
-
|
502
|
-
|
503
|
-
|
504
|
-
|
505
|
-
|
506
|
-
|
475
|
+
|
476
|
+
if table := db.table("Config"):
|
477
|
+
for row in table.rows():
|
478
|
+
component_name = row.Component
|
479
|
+
config_group_name = row.ConfigGroup
|
480
|
+
value_group_name = row.Name
|
481
|
+
identifier_name = row.Identifier
|
482
|
+
|
483
|
+
if component_name not in store:
|
484
|
+
store[component_name] = {}
|
485
|
+
component = store[component_name]
|
486
|
+
|
487
|
+
if config_group_name not in component:
|
488
|
+
component[config_group_name] = {}
|
489
|
+
config_group = component[config_group_name]
|
490
|
+
|
491
|
+
if value_group_name not in config_group:
|
492
|
+
config_group[value_group_name] = {}
|
493
|
+
value_group = config_group[value_group_name]
|
494
|
+
|
495
|
+
if identifier_name not in value_group:
|
496
|
+
value_group[identifier_name] = {}
|
497
|
+
identifier = value_group[identifier_name]
|
498
|
+
|
499
|
+
identifier["modified_time"] = row.ModifiedTime
|
500
|
+
identifier["creation_time"] = row.CreationTime
|
501
|
+
identifier["version"] = row.Version
|
502
|
+
identifier["success"] = row.Success
|
503
|
+
identifier["auto_conf_value"] = json.loads(row.AutoConfValue) if row.AutoConfValue else None
|
504
|
+
identifier["user_value"] = json.loads(row.UserValue) if row.UserValue else None
|
505
|
+
identifier["vital_value"] = json.loads(row.VitalValue) if row.VitalValue else None
|
506
|
+
identifier["cached_value"] = json.loads(row.CachedValue) if row.CachedValue else None
|
507
|
+
identifier["desired_value"] = json.loads(row.DesiredValue) if row.DesiredValue else None
|
508
|
+
identifier["revision"] = row.Revision
|
507
509
|
|
508
510
|
return store
|