dissect.target 3.20.2.dev18__tar.gz → 3.20.2.dev20__tar.gz

{dissect_target-3.20.2.dev18/dissect.target.egg-info → dissect_target-3.20.2.dev20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: dissect.target
-Version: 3.20.2.dev18
+Version: 3.20.2.dev20
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.2.dev18 → dissect_target-3.20.2.dev20}/dissect/target/plugins/os/unix/log/journal.py

@@ -315,9 +315,18 @@ class JournalFile:
         offset = self.header.entry_array_offset
         while offset != 0:
             self.fh.seek(offset)
+            object_type = self.fh.read(1)[0]
 
-            if self.fh.read(1)[0] != c_journal.ObjectType.OBJECT_ENTRY_ARRAY:
-                raise ValueError(f"Expected OBJECT_ENTRY_ARRAY at offset {offset}")
+            if object_type == c_journal.ObjectType.OBJECT_UNUSED:
+                self.target.log.warning(
+                    "ObjectType OBJECT_UNUSED encountered for next OBJECT_ENTRY_ARRAY offset at 0x%X. "
+                    "This indicates allocated space in the journal file which is not used yet.",
+                    offset,
+                )
+                break
+
+            elif object_type != c_journal.ObjectType.OBJECT_ENTRY_ARRAY:
+                raise ValueError(f"Expected OBJECT_ENTRY_ARRAY or OBJECT_UNUSED at offset {offset}")
 
             if self.header.incompatible_flags & c_journal.IncompatibleFlag.HEADER_INCOMPATIBLE_COMPACT:
                 entry_array_object = c_journal.EntryArrayObject_Compact(self.fh)

dissect_target-3.20.2.dev20/dissect/target/plugins/os/windows/regf/cam.py

@@ -0,0 +1,118 @@
+from typing import Iterator
+
+from dissect.util.ts import wintimestamp
+from flow.record.fieldtypes import windows_path
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.descriptor_extensions import (
+    RegistryRecordDescriptorExtension,
+    UserRecordDescriptorExtension,
+)
+from dissect.target.helpers.record import create_extended_descriptor
+from dissect.target.helpers.regutil import RegistryKey, RegistryValueNotFoundError
+from dissect.target.plugin import Plugin, export
+from dissect.target.target import Target
+
+CamRecord = create_extended_descriptor([RegistryRecordDescriptorExtension, UserRecordDescriptorExtension])(
+    "windows/registry/cam",
+    [
+        ("datetime", "ts"),
+        ("string", "device"),
+        ("string", "app_name"),
+        ("path", "path"),
+        ("datetime", "last_started"),
+        ("datetime", "last_stopped"),
+        ("varint", "duration"),
+    ],
+)
+
+
+class CamPlugin(Plugin):
+    """Plugin that iterates various Capability Access Manager registry key locations."""
+
+    CONSENT_STORES = [
+        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore",
+        "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore",
+    ]
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self.app_regf_keys = self._find_apps()
+
+    def _find_apps(self) -> list[RegistryKey]:
+        apps = []
+        for store in self.target.registry.keys(self.CONSENT_STORES):
+            for key in store.subkeys():
+                apps.append(key)
+
+        return apps
+
+    def check_compatible(self) -> None:
+        if not self.app_regf_keys:
+            raise UnsupportedPluginError("No Capability Access Manager keys found")
+
+    def yield_apps(self) -> Iterator[RegistryKey]:
+        for app in self.app_regf_keys:
+            for key in app.subkeys():
+                if key.name == "NonPackaged":  # NonPackaged registry key has more apps, so yield those apps
+                    yield from key.subkeys()
+                else:
+                    yield key
+
+    @export(record=CamRecord)
+    def cam(self) -> Iterator[CamRecord]:
+        """Iterate Capability Access Manager key locations.
+
+        The Capability Access Manager keeps track of processes that access I/O devices, like the webcam or microphone.
+        Applications are divided into packaged and non-packaged applications meaning Microsoft or
+        non-Microsoft applications.
+
+        References:
+            - https://docs.velociraptor.app/exchange/artifacts/pages/windows.registry.capabilityaccessmanager/
+            - https://svch0st.medium.com/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072
+
+        Yields ``CamRecord`` with the following fields:
+
+        .. code-block:: text
+
+            hostname (string): The target hostname.
+            domain (string): The target domain.
+            ts (datetime): The modification timestamp of the registry key.
+            device (string): Name of the device privacy permission where asked for.
+            app_name (string): The name of the application.
+            path (path): The possible path to the application.
+            last_started (datetime): When the application last started using the device.
+            last_stopped (datetime): When the application last stopped using the device.
+            duration (datetime): How long the application used the device (seconds).
+        """
+
+        for key in self.yield_apps():
+            last_started = None
+            last_stopped = None
+            duration = None
+
+            try:
+                last_started = wintimestamp(key.value("LastUsedTimeStart").value)
+            except RegistryValueNotFoundError:
+                self.target.log.warning("No LastUsedTimeStart for application: %s", key.name)
+
+            try:
+                last_stopped = wintimestamp(key.value("LastUsedTimeStop").value)
+            except RegistryValueNotFoundError:
+                self.target.log.warning("No LastUsedTimeStop for application: %s", key.name)
+
+            if last_started and last_stopped:
+                duration = (last_stopped - last_started).seconds
+
+            yield CamRecord(
+                ts=key.ts,
+                device=key.path.split("\\")[-2],
+                app_name=key.name,
+                path=windows_path(key.name.replace("#", "\\")) if "#" in key.name else None,
+                last_started=last_started,
+                last_stopped=last_stopped,
+                duration=duration,
+                _target=self.target,
+                _key=key,
+                _user=self.target.registry.get_user(key),
+            )

{dissect_target-3.20.2.dev18 → dissect_target-3.20.2.dev20/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: dissect.target
-Version: 3.20.2.dev18
+Version: 3.20.2.dev20
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.2.dev18 → dissect_target-3.20.2.dev20}/dissect.target.egg-info/SOURCES.txt

@@ -351,6 +351,7 @@ dissect/target/plugins/os/windows/regf/applications.py
 dissect/target/plugins/os/windows/regf/appxdebugkeys.py
 dissect/target/plugins/os/windows/regf/auditpol.py
 dissect/target/plugins/os/windows/regf/bam.py
+dissect/target/plugins/os/windows/regf/cam.py
 dissect/target/plugins/os/windows/regf/cit.py
 dissect/target/plugins/os/windows/regf/clsid.py
 dissect/target/plugins/os/windows/regf/firewall.py
@@ -647,6 +648,7 @@ tests/plugins/os/windows/log/test_schedlgu.py
 tests/plugins/os/windows/regf/__init__.py
 tests/plugins/os/windows/regf/test_applications.py
 tests/plugins/os/windows/regf/test_appxdebugkeys.py
+tests/plugins/os/windows/regf/test_cam.py
 tests/plugins/os/windows/regf/test_cit.py
 tests/plugins/os/windows/regf/test_clsid.py
 tests/plugins/os/windows/regf/test_muicache.py

dissect_target-3.20.2.dev20/tests/plugins/os/unix/log/test_journal.py

@@ -0,0 +1,65 @@
+import logging
+
+import pytest
+from flow.record.fieldtypes import datetime as dt
+
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugins.os.unix.log.journal import JournalPlugin
+from dissect.target.target import Target
+from tests._utils import absolute_path
+
+
+def test_journal_plugin(target_unix: Target, fs_unix: VirtualFilesystem) -> None:
+    """test linux systemd journal file parsing."""
+
+    data_file = absolute_path("_data/plugins/os/unix/log/journal/journal")
+    fs_unix.map_file("var/log/journal/1337/user-1000.journal", data_file)
+    target_unix.add_plugin(JournalPlugin)
+
+    results = list(target_unix.journal())
+    assert len(results) == 2
+
+    record = results[0]
+    assert record.ts == dt("2023-05-19T16:22:38.841870+00:00")
+    assert record.message == (
+        "Window manager warning: last_user_time (928062) is greater than comparison timestamp (928031).  "
+        "This most likely represents a buggy client sending inaccurate timestamps in messages such as "
+        "_NET_ACTIVE_WINDOW.  Trying to work around..."
+    )
+    assert record.syslog_facility == "3"
+    assert record.syslog_identifier == "gnome-shell"
+    assert record.pid == 2096
+    assert record.transport == "stdout"
+    assert record.source == "/var/log/journal/1337/user-1000.journal"
+
+
+def test_journal_plugin_benchmark(target_unix: Target, fs_unix: VirtualFilesystem) -> None:
+    """test if we can parse some large journal files. this demonstrates how slow the journal plugin is."""
+
+    system_journal = absolute_path("_data/plugins/os/unix/log/journal/system.journal")
+    user_journal = absolute_path("_data/plugins/os/unix/log/journal/user-1000.journal")
+
+    fs_unix.map_file("/var/log/journal/deadbeef/system.journal", system_journal)
+    fs_unix.map_file("/var/log/journal/deadbeef/user-1000.journal", user_journal)
+    target_unix.add_plugin(JournalPlugin)
+
+    results = list(target_unix.journal())
+    assert len(results) == 252 + 17986
+
+
+def test_journal_plugin_unused_object(
+    caplog: pytest.LogCaptureFixture, target_unix: Target, fs_unix: VirtualFilesystem
+) -> None:
+    """test if we can handle OBJECT_UNUSED in journal files correctly."""
+
+    # unused.journal is a modified copy of system.journal at offset 0x393260.
+    # the next_entry_array_offset was set from 0x00 to 0x3C1337.
+    data_file = absolute_path("_data/plugins/os/unix/log/journal/unused.journal")
+    fs_unix.map_file("/var/log/journal/deadbeef/system.journal", data_file)
+    target_unix.add_plugin(JournalPlugin)
+
+    with caplog.at_level(logging.WARNING):
+        results = list(target_unix.journal())
+
+    assert "ObjectType OBJECT_UNUSED encountered for next OBJECT_ENTRY_ARRAY offset at 0x3C1337" in caplog.text
+    assert len(results) == 252

dissect_target-3.20.2.dev20/tests/plugins/os/windows/regf/test_cam.py

@@ -0,0 +1,63 @@
+from dissect.util.ts import wintimestamp
+
+from dissect.target import Target
+from dissect.target.helpers.regutil import VirtualHive, VirtualKey, VirtualValue
+from dissect.target.plugins.os.windows.regf.cam import CamPlugin
+
+
+def test_cam(target_win_users: Target, hive_hku: VirtualHive, hive_hklm: VirtualHive) -> None:
+    hku_cam_key = VirtualKey(
+        hive_hku,
+        "Software\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\webcam",
+    )
+
+    hklm_cam_key = VirtualKey(
+        hive_hklm,
+        "Software\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\microphone",
+    )
+
+    microsoft_camera_key = VirtualKey(
+        hive_hku, f"{hive_hku}\\{hku_cam_key.path}\\Microsoft.WindowsCamera_8wekyb3d8bbwe"
+    )
+    microsoft_camera_key.add_value("LastUsedTimeStart", VirtualValue(hive_hku, "LastUsedTimeStart", 133784711366495858))
+    microsoft_camera_key.add_value("LastUsedTimeStop", VirtualValue(hive_hku, "LastUsedTimeStop", 133784711515887950))
+
+    firefox_key = VirtualKey(hive_hku, f"{hive_hku}\\{hku_cam_key.path}\\C:#Program Files#Mozilla Firefox#firefox.exe")
+    firefox_key.add_value("LastUsedTimeStart", VirtualValue(hive_hku, "LastUsedTimeStart", 133788466426086184))
+    firefox_key.add_value("LastUsedTimeStop", VirtualValue(hive_hku, "LastUsedTimeStop", 133788466774490036))
+
+    nonpackaged_key = VirtualKey(hive_hku, f"{hive_hku}\\{hku_cam_key.path}\\NonPackaged")
+    nonpackaged_key.add_subkey("C:#Program Files#Mozilla Firefox#firefox.exe", firefox_key)
+
+    python_key = VirtualKey(
+        hive_hklm, f"{hive_hklm}\\{hklm_cam_key.path}\\PythonSoftwareFoundation.Python.3.11_qbz5n2kfra8p0"
+    )
+    python_key.add_value("LastUsedTimeStart", VirtualValue(hive_hklm, "LastUsedTimeStart", 133788466426086163))
+    python_key.add_value("LastUsedTimeStop", VirtualValue(hive_hklm, "LastUsedTimeStop", 133788466774490044))
+
+    hku_cam_key.add_subkey(microsoft_camera_key.name, microsoft_camera_key)
+    hku_cam_key.add_subkey(nonpackaged_key.name, nonpackaged_key)
+    hklm_cam_key.add_subkey(python_key.name, python_key)
+
+    hive_hku.map_key(hku_cam_key.path, hku_cam_key)
+    hive_hklm.map_key(hklm_cam_key.path, hklm_cam_key)
+
+    target_win_users.add_plugin(CamPlugin)
+    results = list(target_win_users.cam())
+
+    assert len(results) == 3
+    assert results[0].device == "webcam"
+    assert results[0].app_name == "Microsoft.WindowsCamera_8wekyb3d8bbwe"
+    assert results[0].path is None
+    assert results[0].last_started == wintimestamp(133784711366495858)
+    assert results[0].last_stopped == wintimestamp(133784711515887950)
+    assert results[1].device == "webcam"
+    assert results[1].app_name == "C:#Program Files#Mozilla Firefox#firefox.exe"
+    assert results[1].path == "C:\\Program Files\\Mozilla Firefox\\firefox.exe"
+    assert results[1].last_started == wintimestamp(133788466426086184)
+    assert results[1].last_stopped == wintimestamp(133788466774490036)
+    assert results[2].device == "microphone"
+    assert results[2].app_name == "PythonSoftwareFoundation.Python.3.11_qbz5n2kfra8p0"
+    assert results[2].path is None
+    assert results[2].last_started == wintimestamp(133788466426086163)
+    assert results[2].last_stopped == wintimestamp(133788466774490044)

dissect_target-3.20.2.dev18/tests/plugins/os/unix/log/test_journal.py

@@ -1,30 +0,0 @@
-from flow.record.fieldtypes import datetime as dt
-
-from dissect.target.filesystem import VirtualFilesystem
-from dissect.target.plugins.os.unix.log.journal import JournalPlugin
-from dissect.target.target import Target
-from tests._utils import absolute_path
-
-
-def test_journal_plugin(target_unix: Target, fs_unix: VirtualFilesystem) -> None:
-    """test linux systemd journal file parsing."""
-
-    data_file = absolute_path("_data/plugins/os/unix/log/journal/journal")
-    fs_unix.map_file("var/log/journal/1337/user-1000.journal", data_file)
-    target_unix.add_plugin(JournalPlugin)
-
-    results = list(target_unix.journal())
-    assert len(results) == 2
-
-    record = results[0]
-    assert record.ts == dt("2023-05-19T16:22:38.841870+00:00")
-    assert record.message == (
-        "Window manager warning: last_user_time (928062) is greater than comparison timestamp (928031).  "
-        "This most likely represents a buggy client sending inaccurate timestamps in messages such as "
-        "_NET_ACTIVE_WINDOW.  Trying to work around..."
-    )
-    assert record.syslog_facility == "3"
-    assert record.syslog_identifier == "gnome-shell"
-    assert record.pid == 2096
-    assert record.transport == "stdout"
-    assert record.source == "/var/log/journal/1337/user-1000.journal"