dissect.target 3.20.2.dev19__tar.gz → 3.20.2.dev21__tar.gz

{dissect_target-3.20.2.dev19/dissect.target.egg-info → dissect_target-3.20.2.dev21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: dissect.target
-Version: 3.20.2.dev19
+Version: 3.20.2.dev21
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.2.dev19 → dissect_target-3.20.2.dev21}/dissect/target/plugins/apps/vpn/wireguard.py

@@ -15,7 +15,7 @@ WireGuardInterfaceRecord = TargetRecordDescriptor(
         ("string", "name"),  # basename of .conf file if unset
         ("net.ipaddress", "address"),
         ("string", "private_key"),
-        ("string", "listen_port"),
+        ("varint", "listen_port"),
         ("string", "fw_mark"),
         ("string", "dns"),
         ("varint", "table"),

{dissect_target-3.20.2.dev19 → dissect_target-3.20.2.dev21}/dissect/target/plugins/os/unix/linux/sockets.py

@@ -16,9 +16,9 @@ NetSocketRecord = TargetRecordDescriptor(
         ("string", "protocol"),
         ("uint32", "rx_queue"),
         ("uint32", "tx_queue"),
-        ("string", "local_ip"),
+        ("net.ipaddress", "local_ip"),
         ("uint16", "local_port"),
-        ("string", "remote_ip"),
+        ("net.ipaddress", "remote_ip"),
         ("uint16", "remote_port"),
         ("string", "state"),
         ("string", "owner"),

{dissect_target-3.20.2.dev19 → dissect_target-3.20.2.dev21}/dissect/target/plugins/os/unix/log/journal.py

@@ -315,9 +315,18 @@ class JournalFile:
         offset = self.header.entry_array_offset
         while offset != 0:
             self.fh.seek(offset)
+            object_type = self.fh.read(1)[0]
 
-            if self.fh.read(1)[0] != c_journal.ObjectType.OBJECT_ENTRY_ARRAY:
-                raise ValueError(f"Expected OBJECT_ENTRY_ARRAY at offset {offset}")
+            if object_type == c_journal.ObjectType.OBJECT_UNUSED:
+                self.target.log.warning(
+                    "ObjectType OBJECT_UNUSED encountered for next OBJECT_ENTRY_ARRAY offset at 0x%X. "
+                    "This indicates allocated space in the journal file which is not used yet.",
+                    offset,
+                )
+                break
+
+            elif object_type != c_journal.ObjectType.OBJECT_ENTRY_ARRAY:
+                raise ValueError(f"Expected OBJECT_ENTRY_ARRAY or OBJECT_UNUSED at offset {offset}")
 
             if self.header.incompatible_flags & c_journal.IncompatibleFlag.HEADER_INCOMPATIBLE_COMPACT:
                 entry_array_object = c_journal.EntryArrayObject_Compact(self.fh)

{dissect_target-3.20.2.dev19 → dissect_target-3.20.2.dev21}/dissect/target/plugins/os/unix/shadow.py

@@ -1,3 +1,6 @@
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
 from typing import Iterator
 
 from dissect.target.exceptions import UnsupportedPluginError
@@ -13,12 +16,12 @@ UnixShadowRecord = TargetRecordDescriptor(
         ("string", "hash"),
         ("string", "algorithm"),
         ("string", "crypt_param"),
-        ("string", "last_change"),
-        ("varint", "min_age"),
-        ("varint", "max_age"),
+        ("datetime", "last_change"),
+        ("datetime", "min_age"),
+        ("datetime", "max_age"),
         ("varint", "warning_period"),
-        ("string", "inactivity_period"),
-        ("string", "expiration_date"),
+        ("varint", "inactivity_period"),
+        ("datetime", "expiration_date"),
         ("string", "unused_field"),
     ],
 )
@@ -39,6 +42,7 @@ class ShadowPlugin(Plugin):
 
         Resources:
             - https://manpages.ubuntu.com/manpages/oracular/en/man5/passwd.5.html
+            - https://linux.die.net/man/5/shadow
         """
 
         seen_hashes = set()
@@ -64,6 +68,40 @@ class ShadowPlugin(Plugin):
 
                     seen_hashes.add(current_hash)
 
+                    # improve readability
+                    last_change = None
+                    min_age = None
+                    max_age = None
+                    expiration_date = None
+
+                    try:
+                        last_change = int(shent.get(2)) if shent.get(2) else None
+                    except ValueError as e:
+                        self.target.log.warning(
+                            "Unable to parse last_change shadow value in %s: %s ('%s')", shadow_file, e, shent.get(2)
+                        )
+
+                    try:
+                        min_age = int(shent.get(3)) if shent.get(3) else None
+                    except ValueError as e:
+                        self.target.log.warning(
+                            "Unable to parse last_change shadow value in %s: %s ('%s')", shadow_file, e, shent.get(3)
+                        )
+
+                    try:
+                        max_age = int(shent.get(4)) if shent.get(4) else None
+                    except ValueError as e:
+                        self.target.log.warning(
+                            "Unable to parse last_change shadow value in %s: %s ('%s')", shadow_file, e, shent.get(4)
+                        )
+
+                    try:
+                        expiration_date = int(shent.get(7)) if shent.get(7) else None
+                    except ValueError as e:
+                        self.target.log.warning(
+                            "Unable to parse last_change shadow value in %s: %s ('%s')", shadow_file, e, shent.get(7)
+                        )
+
                     yield UnixShadowRecord(
                         name=shent.get(0),
                         crypt=shent.get(1),
@@ -71,12 +109,12 @@ class ShadowPlugin(Plugin):
                         crypt_param=crypt.get("param"),
                         salt=crypt.get("salt"),
                         hash=crypt.get("hash"),
-                        last_change=shent.get(2),
-                        min_age=shent.get(3),
-                        max_age=shent.get(4),
-                        warning_period=shent.get(5),
-                        inactivity_period=shent.get(6),
-                        expiration_date=shent.get(7),
+                        last_change=epoch_days_to_datetime(last_change) if last_change else None,
+                        min_age=epoch_days_to_datetime(last_change + min_age) if last_change and min_age else None,
+                        max_age=epoch_days_to_datetime(last_change + max_age) if last_change and max_age else None,
+                        warning_period=shent.get(5) if shent.get(5) else None,
+                        inactivity_period=shent.get(6) if shent.get(6) else None,
+                        expiration_date=epoch_days_to_datetime(expiration_date) if expiration_date else None,
                         unused_field=shent.get(8),
                         _target=self.target,
                     )
@@ -128,3 +166,11 @@ def extract_crypt_details(shent: dict) -> dict:
         crypt["algo"] = algos[crypt["algo"]]
 
     return crypt
+
+
+def epoch_days_to_datetime(days: int) -> datetime:
+    """Convert a number representing the days since 1 January 1970 to a datetime object."""
+    if not isinstance(days, int):
+        raise ValueError("days argument should be an integer")
+
+    return datetime(1970, 1, 1, 0, 0, tzinfo=timezone.utc) + timedelta(days)

{dissect_target-3.20.2.dev19 → dissect_target-3.20.2.dev21}/dissect/target/plugins/os/windows/generic.py

@@ -60,7 +60,7 @@ NdisRecord = UserRegistryRecordDescriptor(
     "filesystem/registry/ndis",
     [
         ("datetime", "ts"),
-        ("string", "network"),
+        ("string", "network_name"),
         ("string", "name"),
         ("string", "pnpinstanceid"),
     ],
@@ -113,7 +113,7 @@ WinSockNamespaceProviderRecord = UserRegistryRecordDescriptor(
         ("path", "librarypath"),
         ("string", "displaystring"),
         ("bytes", "providerid"),
-        ("string", "enabled"),
+        ("boolean", "enabled"),
         ("string", "version"),
     ],
 )
@@ -408,7 +408,7 @@ class GenericPlugin(Plugin):
 
                     yield NdisRecord(
                         ts=network.ts,
-                        network=sub.name,
+                        network_name=sub.name,
                         name=name,
                         pnpinstanceid=pnpinstanceid,
                         _target=self.target,

{dissect_target-3.20.2.dev19 → dissect_target-3.20.2.dev21}/dissect/target/plugins/os/windows/log/amcache.py

@@ -42,7 +42,7 @@ COMMON_ELEMENTS = [
     ("string", "pe_image"),
     ("string", "pe_subsystem"),
     ("string", "crc_checksum"),
-    ("string", "filesize"),
+    ("filesize", "filesize"),
     ("wstring", "longname"),
     ("string", "msi"),
 ]
@@ -91,7 +91,7 @@ def create_record(
         binary_type=install_properties.get("binarytype"),
         bin_product_version=install_properties.get("binproductversion"),
         bin_file_version=install_properties.get("binfileversion"),
-        filesize=install_properties.get("filesize"),
+        filesize=int(install_properties.get("filesize", "0"), 16),
         pe_image=install_properties.get("peimagetype"),
         product_version=install_properties.get("productversion"),
         crc_checksum=install_properties.get("crcchecksum"),

{dissect_target-3.20.2.dev19 → dissect_target-3.20.2.dev21}/dissect/target/plugins/os/windows/sru.py

@@ -176,8 +176,8 @@ VfuRecord = TargetRecordDescriptor(
         ("path", "app"),
         ("string", "user"),
         ("varint", "flags"),
-        ("varint", "start_time"),
-        ("varint", "end_time"),
+        ("datetime", "start_time"),
+        ("datetime", "end_time"),
         ("bytes", "usage"),
     ],
 )

{dissect_target-3.20.2.dev19 → dissect_target-3.20.2.dev21/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: dissect.target
-Version: 3.20.2.dev19
+Version: 3.20.2.dev21
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.2.dev19 → dissect_target-3.20.2.dev21}/dissect.target.egg-info/SOURCES.txt

@@ -611,7 +611,6 @@ tests/plugins/os/unix/log/test_utmp.py
 tests/plugins/os/windows/__init__.py
 tests/plugins/os/windows/test__os.py
 tests/plugins/os/windows/test_adpolicy.py
-tests/plugins/os/windows/test_amcache.py
 tests/plugins/os/windows/test_catroot.py
 tests/plugins/os/windows/test_clfs.py
 tests/plugins/os/windows/test_datetime.py
@@ -640,6 +639,7 @@ tests/plugins/os/windows/credential/__init__.py
 tests/plugins/os/windows/credential/test_credhist.py
 tests/plugins/os/windows/credential/test_lsa.py
 tests/plugins/os/windows/credential/test_sam.py
+tests/plugins/os/windows/log/test_amcache.py
 tests/plugins/os/windows/log/test_etl.py
 tests/plugins/os/windows/log/test_evt.py
 tests/plugins/os/windows/log/test_evtx.py

{dissect_target-3.20.2.dev19 → dissect_target-3.20.2.dev21}/tests/plugins/apps/vpn/test_wireguard.py

@@ -15,7 +15,7 @@ def test_wireguard_plugin_global_log(target_unix_users, fs_unix):
     assert record.name == "wg0"
     assert str(record.address) == "10.13.37.1"
     assert record.private_key == "UHJpdmF0ZUtleQ=="
-    assert record.listen_port == "12345"
+    assert record.listen_port == 12345
     assert record.source == "etc/wireguard/wg0.conf"
     assert record.dns is None
 

dissect_target-3.20.2.dev21/tests/plugins/os/unix/log/test_journal.py

@@ -0,0 +1,65 @@
+import logging
+
+import pytest
+from flow.record.fieldtypes import datetime as dt
+
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugins.os.unix.log.journal import JournalPlugin
+from dissect.target.target import Target
+from tests._utils import absolute_path
+
+
+def test_journal_plugin(target_unix: Target, fs_unix: VirtualFilesystem) -> None:
+    """test linux systemd journal file parsing."""
+
+    data_file = absolute_path("_data/plugins/os/unix/log/journal/journal")
+    fs_unix.map_file("var/log/journal/1337/user-1000.journal", data_file)
+    target_unix.add_plugin(JournalPlugin)
+
+    results = list(target_unix.journal())
+    assert len(results) == 2
+
+    record = results[0]
+    assert record.ts == dt("2023-05-19T16:22:38.841870+00:00")
+    assert record.message == (
+        "Window manager warning: last_user_time (928062) is greater than comparison timestamp (928031).  "
+        "This most likely represents a buggy client sending inaccurate timestamps in messages such as "
+        "_NET_ACTIVE_WINDOW.  Trying to work around..."
+    )
+    assert record.syslog_facility == "3"
+    assert record.syslog_identifier == "gnome-shell"
+    assert record.pid == 2096
+    assert record.transport == "stdout"
+    assert record.source == "/var/log/journal/1337/user-1000.journal"
+
+
+def test_journal_plugin_benchmark(target_unix: Target, fs_unix: VirtualFilesystem) -> None:
+    """test if we can parse some large journal files. this demonstrates how slow the journal plugin is."""
+
+    system_journal = absolute_path("_data/plugins/os/unix/log/journal/system.journal")
+    user_journal = absolute_path("_data/plugins/os/unix/log/journal/user-1000.journal")
+
+    fs_unix.map_file("/var/log/journal/deadbeef/system.journal", system_journal)
+    fs_unix.map_file("/var/log/journal/deadbeef/user-1000.journal", user_journal)
+    target_unix.add_plugin(JournalPlugin)
+
+    results = list(target_unix.journal())
+    assert len(results) == 252 + 17986
+
+
+def test_journal_plugin_unused_object(
+    caplog: pytest.LogCaptureFixture, target_unix: Target, fs_unix: VirtualFilesystem
+) -> None:
+    """test if we can handle OBJECT_UNUSED in journal files correctly."""
+
+    # unused.journal is a modified copy of system.journal at offset 0x393260.
+    # the next_entry_array_offset was set from 0x00 to 0x3C1337.
+    data_file = absolute_path("_data/plugins/os/unix/log/journal/unused.journal")
+    fs_unix.map_file("/var/log/journal/deadbeef/system.journal", data_file)
+    target_unix.add_plugin(JournalPlugin)
+
+    with caplog.at_level(logging.WARNING):
+        results = list(target_unix.journal())
+
+    assert "ObjectType OBJECT_UNUSED encountered for next OBJECT_ENTRY_ARRAY offset at 0x3C1337" in caplog.text
+    assert len(results) == 252

dissect_target-3.20.2.dev21/tests/plugins/os/unix/test_shadow.py

@@ -0,0 +1,118 @@
+from datetime import datetime, timezone
+from io import BytesIO
+from pathlib import Path
+from textwrap import dedent
+
+import pytest
+
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugins.os.unix.shadow import ShadowPlugin
+from dissect.target.target import Target
+from tests._utils import absolute_path
+
+
+def test_unix_shadow(target_unix_users: Target, fs_unix: VirtualFilesystem) -> None:
+    shadow_file = absolute_path("_data/plugins/os/unix/shadow/shadow")
+    fs_unix.map_file("/etc/shadow", shadow_file)
+    target_unix_users.add_plugin(ShadowPlugin)
+
+    results = list(target_unix_users.passwords())
+    assert len(results) == 1
+    assert results[0].name == "test"
+    assert (
+        results[0].crypt
+        == "$6$oLHns1qc.C3DoQ8c$temOg6X.UF5Ly3gM03cGnBLib30mv8J49dUI.w9.EHTnO4R467zyKbfBnmTa5IIvDr5mRXFoJVBGKF6QuFDpo1"
+    )  # noqa E501
+    assert results[0].salt == "oLHns1qc.C3DoQ8c"
+    assert (
+        results[0].hash == "temOg6X.UF5Ly3gM03cGnBLib30mv8J49dUI.w9.EHTnO4R467zyKbfBnmTa5IIvDr5mRXFoJVBGKF6QuFDpo1"
+    )  # noqa E501
+    assert results[0].algorithm == "sha512"
+    assert results[0].crypt_param is None
+    assert results[0].last_change == datetime(2021, 12, 2, 0, 0, 0, tzinfo=timezone.utc)  # 18963
+    assert results[0].min_age is None
+    assert results[0].max_age == datetime(2295, 9, 16, 0, 0, 0, tzinfo=timezone.utc)  # 99999
+    assert results[0].warning_period == 7
+    assert results[0].inactivity_period is None
+    assert results[0].expiration_date is None
+    assert results[0].unused_field == ""
+
+
+def test_unix_shadow_backup_file(target_unix_users: Target, fs_unix: VirtualFilesystem) -> None:
+    """test if both the shadow file and shadow backup file are read and returns unique hash+user combinations"""
+    shadow_file = absolute_path("_data/plugins/os/unix/shadow/shadow")
+    fs_unix.map_file("/etc/shadow", shadow_file)
+
+    first_entry = Path(shadow_file).open("rb").read()
+    other_entry = first_entry.replace(b"test", b"other-user")
+    duplicate_entry = first_entry
+    fs_unix.map_file_fh("/etc/shadow-", BytesIO(first_entry + other_entry + duplicate_entry))
+
+    results = list(target_unix_users.passwords())
+    assert len(results) == 2
+    assert results[0].name == "test"
+    assert results[1].name == "other-user"
+    assert results[0].hash == results[1].hash
+
+
+def test_unix_shadow_invalid_shent(
+    caplog: pytest.LogCaptureFixture, target_unix_users: Target, fs_unix: VirtualFilesystem
+) -> None:
+    """test if we can parse invalid day values in shents."""
+
+    shadow_invalid = """
+    no_last_change:$6$salt$hash1::0:99999:7::123456:
+    no_max_age:$6$salt$hash2:18963:0::7:::
+    only_last_change:$6$salt$hash3:18963::::::
+    no_int_fields:$6$salt$hash4:string::::::
+    daemon:*:18474:0:99999:7:::
+    bin:*:18474:0:99999:7:::
+    nobody:*:18474:0:99999:7:::
+    regular:$6$salt$hash5:1337:0:99999:7::123456:
+    """
+    fs_unix.map_file_fh("/etc/shadow", BytesIO(dedent(shadow_invalid).encode()))
+
+    results = list(target_unix_users.passwords())
+    assert len(results) == 5
+
+    assert [r.name for r in results] == [
+        "no_last_change",
+        "no_max_age",
+        "only_last_change",
+        "no_int_fields",
+        "regular",
+    ]
+
+    assert results[0].name == "no_last_change"
+    assert results[0].last_change is None
+    assert results[0].min_age is None
+    assert results[0].max_age is None
+    assert results[0].warning_period == 7
+    assert results[0].inactivity_period is None
+    assert results[0].expiration_date == datetime(2308, 1, 6, tzinfo=timezone.utc)
+
+    assert results[1].name == "no_max_age"
+    assert results[1].last_change == datetime(2021, 12, 2, tzinfo=timezone.utc)
+    assert results[1].max_age is None
+
+    assert results[2].name == "only_last_change"
+    assert results[2].last_change == datetime(2021, 12, 2, tzinfo=timezone.utc)
+
+    assert results[3].name == "no_int_fields"
+    assert results[3].last_change is None
+    assert (
+        "Unable to parse last_change shadow value in /etc/shadow: invalid literal for int() with base 10: 'string' ('string')"  # noqa:E501
+        in caplog.text
+    )
+
+    # make sure we parsed the last entry even though the other entries are 'broken'
+    assert results[-1].name == "regular"
+    assert results[-1].salt == "salt"
+    assert results[-1].hash == "hash5"
+    assert results[-1].algorithm == "sha512"
+    assert results[-1].last_change == datetime(1973, 8, 30, tzinfo=timezone.utc)
+    assert results[-1].min_age is None
+    assert results[-1].max_age == datetime(2247, 6, 14, tzinfo=timezone.utc)
+    assert results[-1].warning_period == 7
+    assert results[-1].inactivity_period is None
+    assert results[-1].expiration_date == datetime(2308, 1, 6, tzinfo=timezone.utc)

{dissect_target-3.20.2.dev19/tests/plugins/os/windows → dissect_target-3.20.2.dev21/tests/plugins/os/windows/log}/test_amcache.py

@@ -159,3 +159,4 @@ def test_amcache_install_entry(target_win: Target):
         assert str(entry.create) == create
         assert str(entry.path) == r"C:\Users\JohnCena"
         assert str(entry.longname) == r"7z2201-x64.exe"
+        assert entry.filesize == 1575742

dissect_target-3.20.2.dev19/tests/plugins/os/unix/log/test_journal.py

@@ -1,30 +0,0 @@
-from flow.record.fieldtypes import datetime as dt
-
-from dissect.target.filesystem import VirtualFilesystem
-from dissect.target.plugins.os.unix.log.journal import JournalPlugin
-from dissect.target.target import Target
-from tests._utils import absolute_path
-
-
-def test_journal_plugin(target_unix: Target, fs_unix: VirtualFilesystem) -> None:
-    """test linux systemd journal file parsing."""
-
-    data_file = absolute_path("_data/plugins/os/unix/log/journal/journal")
-    fs_unix.map_file("var/log/journal/1337/user-1000.journal", data_file)
-    target_unix.add_plugin(JournalPlugin)
-
-    results = list(target_unix.journal())
-    assert len(results) == 2
-
-    record = results[0]
-    assert record.ts == dt("2023-05-19T16:22:38.841870+00:00")
-    assert record.message == (
-        "Window manager warning: last_user_time (928062) is greater than comparison timestamp (928031).  "
-        "This most likely represents a buggy client sending inaccurate timestamps in messages such as "
-        "_NET_ACTIVE_WINDOW.  Trying to work around..."
-    )
-    assert record.syslog_facility == "3"
-    assert record.syslog_identifier == "gnome-shell"
-    assert record.pid == 2096
-    assert record.transport == "stdout"
-    assert record.source == "/var/log/journal/1337/user-1000.journal"

dissect_target-3.20.2.dev19/tests/plugins/os/unix/test_shadow.py

@@ -1,51 +0,0 @@
-from io import BytesIO
-from pathlib import Path
-
-from dissect.target.filesystem import VirtualFilesystem
-from dissect.target.plugins.os.unix.shadow import ShadowPlugin
-from dissect.target.target import Target
-from tests._utils import absolute_path
-
-
-def test_unix_shadow(target_unix_users: Target, fs_unix: VirtualFilesystem) -> None:
-    shadow_file = absolute_path("_data/plugins/os/unix/shadow/shadow")
-    fs_unix.map_file("/etc/shadow", shadow_file)
-    target_unix_users.add_plugin(ShadowPlugin)
-
-    results = list(target_unix_users.passwords())
-    assert len(results) == 1
-    assert results[0].name == "test"
-    assert (
-        results[0].crypt
-        == "$6$oLHns1qc.C3DoQ8c$temOg6X.UF5Ly3gM03cGnBLib30mv8J49dUI.w9.EHTnO4R467zyKbfBnmTa5IIvDr5mRXFoJVBGKF6QuFDpo1"
-    )  # noqa E501
-    assert results[0].salt == "oLHns1qc.C3DoQ8c"
-    assert (
-        results[0].hash == "temOg6X.UF5Ly3gM03cGnBLib30mv8J49dUI.w9.EHTnO4R467zyKbfBnmTa5IIvDr5mRXFoJVBGKF6QuFDpo1"
-    )  # noqa E501
-    assert results[0].algorithm == "sha512"
-    assert results[0].crypt_param is None
-    assert results[0].last_change == "18963"
-    assert results[0].min_age == 0
-    assert results[0].max_age == 99999
-    assert results[0].warning_period == 7
-    assert results[0].inactivity_period == ""
-    assert results[0].expiration_date == ""
-    assert results[0].unused_field == ""
-
-
-def test_unix_shadow_backup_file(target_unix_users: Target, fs_unix: VirtualFilesystem) -> None:
-    """test if both the shadow file and shadow backup file are read and returns unique hash+user combinations"""
-    shadow_file = absolute_path("_data/plugins/os/unix/shadow/shadow")
-    fs_unix.map_file("/etc/shadow", shadow_file)
-
-    first_entry = Path(shadow_file).open("rb").read()
-    other_entry = first_entry.replace(b"test", b"other-user")
-    duplicate_entry = first_entry
-    fs_unix.map_file_fh("/etc/shadow-", BytesIO(first_entry + other_entry + duplicate_entry))
-
-    results = list(target_unix_users.passwords())
-    assert len(results) == 2
-    assert results[0].name == "test"
-    assert results[1].name == "other-user"
-    assert results[0].hash == results[1].hash