dissect.target 3.20.2.dev17__tar.gz → 3.20.2.dev19__tar.gz

{dissect_target-3.20.2.dev17/dissect.target.egg-info → dissect_target-3.20.2.dev19}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: dissect.target
-Version: 3.20.2.dev17
+Version: 3.20.2.dev19
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.2.dev17 → dissect_target-3.20.2.dev19}/dissect/target/plugins/os/windows/credential/credhist.py

@@ -125,7 +125,7 @@ class CredHistFile:
                 yield CredHistEntry(
                     version=entry.dwVersion,
                     guid=UUID(bytes_le=entry.guidLink),
-                    user_sid=read_sid(entry.pSid),
+                    user_sid=read_sid(entry.pSid) if entry.pSid else None,
                     hash_alg=HashAlgorithm.from_id(entry.algHash),
                     cipher_alg=cipher_alg,
                     sha1=None,

{dissect_target-3.20.2.dev17 → dissect_target-3.20.2.dev19}/dissect/target/plugins/os/windows/generic.py

@@ -611,11 +611,12 @@ class GenericPlugin(Plugin):
 
         try:
             key = self.target.registry.key("HKLM\\SECURITY\\Policy\\PolMachineAccountS")
+            raw_sid = key.value("(Default)").value
 
             yield ComputerSidRecord(
                 ts=key.timestamp,
                 sidtype="Domain",
-                sid=read_sid(key.value("(Default)").value),
+                sid=read_sid(raw_sid) if raw_sid else None,
                 _target=self.target,
             )
         except (RegistryError, struct.error):

dissect_target-3.20.2.dev19/dissect/target/plugins/os/windows/regf/cam.py

@@ -0,0 +1,118 @@
+from typing import Iterator
+
+from dissect.util.ts import wintimestamp
+from flow.record.fieldtypes import windows_path
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.descriptor_extensions import (
+    RegistryRecordDescriptorExtension,
+    UserRecordDescriptorExtension,
+)
+from dissect.target.helpers.record import create_extended_descriptor
+from dissect.target.helpers.regutil import RegistryKey, RegistryValueNotFoundError
+from dissect.target.plugin import Plugin, export
+from dissect.target.target import Target
+
+CamRecord = create_extended_descriptor([RegistryRecordDescriptorExtension, UserRecordDescriptorExtension])(
+    "windows/registry/cam",
+    [
+        ("datetime", "ts"),
+        ("string", "device"),
+        ("string", "app_name"),
+        ("path", "path"),
+        ("datetime", "last_started"),
+        ("datetime", "last_stopped"),
+        ("varint", "duration"),
+    ],
+)
+
+
+class CamPlugin(Plugin):
+    """Plugin that iterates various Capability Access Manager registry key locations."""
+
+    CONSENT_STORES = [
+        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore",
+        "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore",
+    ]
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self.app_regf_keys = self._find_apps()
+
+    def _find_apps(self) -> list[RegistryKey]:
+        apps = []
+        for store in self.target.registry.keys(self.CONSENT_STORES):
+            for key in store.subkeys():
+                apps.append(key)
+
+        return apps
+
+    def check_compatible(self) -> None:
+        if not self.app_regf_keys:
+            raise UnsupportedPluginError("No Capability Access Manager keys found")
+
+    def yield_apps(self) -> Iterator[RegistryKey]:
+        for app in self.app_regf_keys:
+            for key in app.subkeys():
+                if key.name == "NonPackaged":  # NonPackaged registry key has more apps, so yield those apps
+                    yield from key.subkeys()
+                else:
+                    yield key
+
+    @export(record=CamRecord)
+    def cam(self) -> Iterator[CamRecord]:
+        """Iterate Capability Access Manager key locations.
+
+        The Capability Access Manager keeps track of processes that access I/O devices, like the webcam or microphone.
+        Applications are divided into packaged and non-packaged applications meaning Microsoft or
+        non-Microsoft applications.
+
+        References:
+            - https://docs.velociraptor.app/exchange/artifacts/pages/windows.registry.capabilityaccessmanager/
+            - https://svch0st.medium.com/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072
+
+        Yields ``CamRecord`` with the following fields:
+
+        .. code-block:: text
+
+            hostname (string): The target hostname.
+            domain (string): The target domain.
+            ts (datetime): The modification timestamp of the registry key.
+            device (string): Name of the device privacy permission where asked for.
+            app_name (string): The name of the application.
+            path (path): The possible path to the application.
+            last_started (datetime): When the application last started using the device.
+            last_stopped (datetime): When the application last stopped using the device.
+            duration (datetime): How long the application used the device (seconds).
+        """
+
+        for key in self.yield_apps():
+            last_started = None
+            last_stopped = None
+            duration = None
+
+            try:
+                last_started = wintimestamp(key.value("LastUsedTimeStart").value)
+            except RegistryValueNotFoundError:
+                self.target.log.warning("No LastUsedTimeStart for application: %s", key.name)
+
+            try:
+                last_stopped = wintimestamp(key.value("LastUsedTimeStop").value)
+            except RegistryValueNotFoundError:
+                self.target.log.warning("No LastUsedTimeStop for application: %s", key.name)
+
+            if last_started and last_stopped:
+                duration = (last_stopped - last_started).seconds
+
+            yield CamRecord(
+                ts=key.ts,
+                device=key.path.split("\\")[-2],
+                app_name=key.name,
+                path=windows_path(key.name.replace("#", "\\")) if "#" in key.name else None,
+                last_started=last_started,
+                last_stopped=last_stopped,
+                duration=duration,
+                _target=self.target,
+                _key=key,
+                _user=self.target.registry.get_user(key),
+            )

{dissect_target-3.20.2.dev17 → dissect_target-3.20.2.dev19/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: dissect.target
-Version: 3.20.2.dev17
+Version: 3.20.2.dev19
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.2.dev17 → dissect_target-3.20.2.dev19}/dissect.target.egg-info/SOURCES.txt

@@ -351,6 +351,7 @@ dissect/target/plugins/os/windows/regf/applications.py
 dissect/target/plugins/os/windows/regf/appxdebugkeys.py
 dissect/target/plugins/os/windows/regf/auditpol.py
 dissect/target/plugins/os/windows/regf/bam.py
+dissect/target/plugins/os/windows/regf/cam.py
 dissect/target/plugins/os/windows/regf/cit.py
 dissect/target/plugins/os/windows/regf/clsid.py
 dissect/target/plugins/os/windows/regf/firewall.py
@@ -647,6 +648,7 @@ tests/plugins/os/windows/log/test_schedlgu.py
 tests/plugins/os/windows/regf/__init__.py
 tests/plugins/os/windows/regf/test_applications.py
 tests/plugins/os/windows/regf/test_appxdebugkeys.py
+tests/plugins/os/windows/regf/test_cam.py
 tests/plugins/os/windows/regf/test_cit.py
 tests/plugins/os/windows/regf/test_clsid.py
 tests/plugins/os/windows/regf/test_muicache.py

dissect_target-3.20.2.dev19/tests/plugins/os/windows/regf/test_cam.py

@@ -0,0 +1,63 @@
+from dissect.util.ts import wintimestamp
+
+from dissect.target import Target
+from dissect.target.helpers.regutil import VirtualHive, VirtualKey, VirtualValue
+from dissect.target.plugins.os.windows.regf.cam import CamPlugin
+
+
+def test_cam(target_win_users: Target, hive_hku: VirtualHive, hive_hklm: VirtualHive) -> None:
+    hku_cam_key = VirtualKey(
+        hive_hku,
+        "Software\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\webcam",
+    )
+
+    hklm_cam_key = VirtualKey(
+        hive_hklm,
+        "Software\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\microphone",
+    )
+
+    microsoft_camera_key = VirtualKey(
+        hive_hku, f"{hive_hku}\\{hku_cam_key.path}\\Microsoft.WindowsCamera_8wekyb3d8bbwe"
+    )
+    microsoft_camera_key.add_value("LastUsedTimeStart", VirtualValue(hive_hku, "LastUsedTimeStart", 133784711366495858))
+    microsoft_camera_key.add_value("LastUsedTimeStop", VirtualValue(hive_hku, "LastUsedTimeStop", 133784711515887950))
+
+    firefox_key = VirtualKey(hive_hku, f"{hive_hku}\\{hku_cam_key.path}\\C:#Program Files#Mozilla Firefox#firefox.exe")
+    firefox_key.add_value("LastUsedTimeStart", VirtualValue(hive_hku, "LastUsedTimeStart", 133788466426086184))
+    firefox_key.add_value("LastUsedTimeStop", VirtualValue(hive_hku, "LastUsedTimeStop", 133788466774490036))
+
+    nonpackaged_key = VirtualKey(hive_hku, f"{hive_hku}\\{hku_cam_key.path}\\NonPackaged")
+    nonpackaged_key.add_subkey("C:#Program Files#Mozilla Firefox#firefox.exe", firefox_key)
+
+    python_key = VirtualKey(
+        hive_hklm, f"{hive_hklm}\\{hklm_cam_key.path}\\PythonSoftwareFoundation.Python.3.11_qbz5n2kfra8p0"
+    )
+    python_key.add_value("LastUsedTimeStart", VirtualValue(hive_hklm, "LastUsedTimeStart", 133788466426086163))
+    python_key.add_value("LastUsedTimeStop", VirtualValue(hive_hklm, "LastUsedTimeStop", 133788466774490044))
+
+    hku_cam_key.add_subkey(microsoft_camera_key.name, microsoft_camera_key)
+    hku_cam_key.add_subkey(nonpackaged_key.name, nonpackaged_key)
+    hklm_cam_key.add_subkey(python_key.name, python_key)
+
+    hive_hku.map_key(hku_cam_key.path, hku_cam_key)
+    hive_hklm.map_key(hklm_cam_key.path, hklm_cam_key)
+
+    target_win_users.add_plugin(CamPlugin)
+    results = list(target_win_users.cam())
+
+    assert len(results) == 3
+    assert results[0].device == "webcam"
+    assert results[0].app_name == "Microsoft.WindowsCamera_8wekyb3d8bbwe"
+    assert results[0].path is None
+    assert results[0].last_started == wintimestamp(133784711366495858)
+    assert results[0].last_stopped == wintimestamp(133784711515887950)
+    assert results[1].device == "webcam"
+    assert results[1].app_name == "C:#Program Files#Mozilla Firefox#firefox.exe"
+    assert results[1].path == "C:\\Program Files\\Mozilla Firefox\\firefox.exe"
+    assert results[1].last_started == wintimestamp(133788466426086184)
+    assert results[1].last_stopped == wintimestamp(133788466774490036)
+    assert results[2].device == "microphone"
+    assert results[2].app_name == "PythonSoftwareFoundation.Python.3.11_qbz5n2kfra8p0"
+    assert results[2].path is None
+    assert results[2].last_started == wintimestamp(133788466426086163)
+    assert results[2].last_stopped == wintimestamp(133788466774490044)