dissect.target 3.20.1__py3-none-any.whl → 3.20.2.dev11__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- dissect/target/helpers/configutil.py +3 -3
- dissect/target/loaders/itunes.py +5 -3
- dissect/target/plugins/apps/browser/iexplore.py +7 -3
- dissect/target/plugins/general/plugins.py +1 -1
- dissect/target/plugins/os/unix/_os.py +1 -1
- dissect/target/plugins/os/unix/esxi/_os.py +34 -32
- dissect/target/plugins/os/unix/linux/fortios/_keys.py +7919 -1951
- dissect/target/plugins/os/unix/linux/fortios/_os.py +109 -22
- dissect/target/plugins/os/unix/linux/network_managers.py +1 -1
- dissect/target/plugins/os/unix/log/auth.py +6 -37
- dissect/target/plugins/os/unix/log/helpers.py +46 -0
- dissect/target/plugins/os/unix/log/messages.py +24 -15
- dissect/target/plugins/os/windows/activitiescache.py +32 -30
- dissect/target/plugins/os/windows/catroot.py +14 -5
- dissect/target/plugins/os/windows/lnk.py +13 -7
- dissect/target/plugins/os/windows/notifications.py +40 -38
- dissect/target/plugins/os/windows/regf/cit.py +20 -7
- dissect/target/tools/diff.py +990 -0
- {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/METADATA +2 -2
- {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/RECORD +25 -23
- {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/entry_points.txt +1 -0
- {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/COPYRIGHT +0 -0
- {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/LICENSE +0 -0
- {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/WHEEL +0 -0
- {dissect.target-3.20.1.dist-info → dissect.target-3.20.2.dev11.dist-info}/top_level.txt +0 -0
@@ -470,9 +470,9 @@ class Toml(ConfigurationParser):
|
|
470
470
|
class Env(ConfigurationParser):
|
471
471
|
"""Parses ``.env`` file contents according to Docker and bash specification.
|
472
472
|
|
473
|
-
Does not apply interpolation of substituted values,
|
474
|
-
|
475
|
-
|
473
|
+
Does not apply interpolation of substituted values, e.g. ``foo=${bar}`` and does not attempt to parse list or dict
|
474
|
+
strings. Does not support dynamic env files, e.g. ``foo=`bar```. Also does not support multi-line key/value
|
475
|
+
assignments (yet).
|
476
476
|
|
477
477
|
Resources:
|
478
478
|
- https://docs.docker.com/compose/environment-variables/variable-interpolation/#env-file-syntax
|
dissect/target/loaders/itunes.py
CHANGED
@@ -163,8 +163,10 @@ class ITunesBackup:
|
|
163
163
|
|
164
164
|
def files(self) -> Iterator[FileInfo]:
|
165
165
|
"""Iterate all the files in this backup."""
|
166
|
-
|
167
|
-
|
166
|
+
|
167
|
+
if table := self.manifest_db.table("Files"):
|
168
|
+
for row in table.rows():
|
169
|
+
yield FileInfo(self, row.fileID, row.domain, row.relativePath, row.flags, row.file)
|
168
170
|
|
169
171
|
|
170
172
|
class FileInfo:
|
@@ -288,7 +290,7 @@ def translate_file_path(domain: str, relative_path: str) -> str:
|
|
288
290
|
package_name = ""
|
289
291
|
|
290
292
|
domain_path = fsutil.join(DOMAIN_TRANSLATION.get(domain, domain), package_name)
|
291
|
-
return fsutil.join(domain_path, relative_path)
|
293
|
+
return fsutil.join(domain_path, relative_path).rstrip("/")
|
292
294
|
|
293
295
|
|
294
296
|
def parse_key_bag(buf: bytes) -> tuple[dict[str, bytes, int], dict[str, ClassKey]]:
|
@@ -36,14 +36,18 @@ class WebCache:
|
|
36
36
|
All ``ContainerId`` values for the requested container name.
|
37
37
|
"""
|
38
38
|
try:
|
39
|
-
|
39
|
+
table = self.db.table("Containers")
|
40
|
+
|
41
|
+
for container_record in table.records():
|
40
42
|
if record_name := container_record.get("Name"):
|
41
43
|
record_name = record_name.rstrip("\00").lower()
|
42
44
|
if record_name == name.lower():
|
43
45
|
container_id = container_record.get("ContainerId")
|
44
46
|
yield self.db.table(f"Container_{container_id}")
|
45
|
-
|
46
|
-
|
47
|
+
|
48
|
+
except KeyError as e:
|
49
|
+
self.target.log.warning("Exception while parsing EseDB Containers table")
|
50
|
+
self.target.log.debug("", exc_info=e)
|
47
51
|
|
48
52
|
def _iter_records(self, name: str) -> Iterator[record.Record]:
|
49
53
|
"""Yield records from a Webcache container.
|
@@ -169,7 +169,7 @@ class PluginListPlugin(Plugin):
|
|
169
169
|
|
170
170
|
|
171
171
|
def generate_plugins_json(plugins: list[Plugin]) -> Iterator[dict]:
|
172
|
-
"""Generates JSON output of a list of :class:`Plugin
|
172
|
+
"""Generates JSON output of a list of :class:`Plugin`."""
|
173
173
|
|
174
174
|
for p in plugins:
|
175
175
|
func = getattr(p.class_object, p.method_name)
|
@@ -182,7 +182,7 @@ class UnixPlugin(OSPlugin):
|
|
182
182
|
paths (list): list of paths
|
183
183
|
"""
|
184
184
|
redhat_legacy_path = "/etc/sysconfig/network"
|
185
|
-
paths = paths or ["/etc/hostname", "/etc/HOSTNAME", redhat_legacy_path]
|
185
|
+
paths = paths or ["/etc/hostname", "/etc/HOSTNAME", "/proc/sys/kernel/hostname", redhat_legacy_path]
|
186
186
|
hostname_dict = {"hostname": None, "domain": None}
|
187
187
|
|
188
188
|
for path in paths:
|
@@ -472,37 +472,39 @@ def parse_config_store(fh: BinaryIO) -> dict[str, Any]:
|
|
472
472
|
db = sqlite3.SQLite3(fh)
|
473
473
|
|
474
474
|
store = {}
|
475
|
-
|
476
|
-
|
477
|
-
|
478
|
-
|
479
|
-
|
480
|
-
|
481
|
-
|
482
|
-
|
483
|
-
|
484
|
-
|
485
|
-
|
486
|
-
|
487
|
-
|
488
|
-
|
489
|
-
|
490
|
-
|
491
|
-
|
492
|
-
|
493
|
-
|
494
|
-
|
495
|
-
|
496
|
-
|
497
|
-
|
498
|
-
|
499
|
-
|
500
|
-
|
501
|
-
|
502
|
-
|
503
|
-
|
504
|
-
|
505
|
-
|
506
|
-
|
475
|
+
|
476
|
+
if table := db.table("Config"):
|
477
|
+
for row in table.rows():
|
478
|
+
component_name = row.Component
|
479
|
+
config_group_name = row.ConfigGroup
|
480
|
+
value_group_name = row.Name
|
481
|
+
identifier_name = row.Identifier
|
482
|
+
|
483
|
+
if component_name not in store:
|
484
|
+
store[component_name] = {}
|
485
|
+
component = store[component_name]
|
486
|
+
|
487
|
+
if config_group_name not in component:
|
488
|
+
component[config_group_name] = {}
|
489
|
+
config_group = component[config_group_name]
|
490
|
+
|
491
|
+
if value_group_name not in config_group:
|
492
|
+
config_group[value_group_name] = {}
|
493
|
+
value_group = config_group[value_group_name]
|
494
|
+
|
495
|
+
if identifier_name not in value_group:
|
496
|
+
value_group[identifier_name] = {}
|
497
|
+
identifier = value_group[identifier_name]
|
498
|
+
|
499
|
+
identifier["modified_time"] = row.ModifiedTime
|
500
|
+
identifier["creation_time"] = row.CreationTime
|
501
|
+
identifier["version"] = row.Version
|
502
|
+
identifier["success"] = row.Success
|
503
|
+
identifier["auto_conf_value"] = json.loads(row.AutoConfValue) if row.AutoConfValue else None
|
504
|
+
identifier["user_value"] = json.loads(row.UserValue) if row.UserValue else None
|
505
|
+
identifier["vital_value"] = json.loads(row.VitalValue) if row.VitalValue else None
|
506
|
+
identifier["cached_value"] = json.loads(row.CachedValue) if row.CachedValue else None
|
507
|
+
identifier["desired_value"] = json.loads(row.DesiredValue) if row.DesiredValue else None
|
508
|
+
identifier["revision"] = row.Revision
|
507
509
|
|
508
510
|
return store
|