dissect.target 3.20.dev18__tar.gz → 3.20.dev20__tar.gz

{dissect_target-3.20.dev18/dissect.target.egg-info → dissect_target-3.20.dev20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.20.dev18
+Version: 3.20.dev20
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

dissect_target-3.20.dev20/dissect/target/plugins/apps/virtualization/vmware_workstation.py

@@ -0,0 +1,61 @@
+from typing import Iterator
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
+from dissect.target.helpers.fsutil import TargetPath
+from dissect.target.helpers.record import create_extended_descriptor
+from dissect.target.plugin import Plugin, alias, export
+from dissect.target.plugins.general.users import UserDetails
+from dissect.target.target import Target
+
+VmwareDragAndDropRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
+    "virtualization/vmware/clipboard",
+    [
+        ("datetime", "ts"),
+        ("path", "path"),
+    ],
+)
+
+VMWARE_DND_PATHS = [
+    # Windows
+    "AppData/Local/Temp/VmwareDND",
+    # Linux
+    ".cache/vmware/drag_and_drop",
+]
+
+
+class VmwareWorkstationPlugin(Plugin):
+    """VMware Workstation plugin."""
+
+    __namespace__ = "vmware"
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self.dnd_dirs = list(self.find_dnd_dirs())
+
+    def check_compatible(self) -> None:
+        if not self.dnd_dirs:
+            raise UnsupportedPluginError("No VMware Workstation DnD artifact(s) found")
+
+    def find_dnd_dirs(self) -> Iterator[tuple[UserDetails, TargetPath]]:
+        for user_details in self.target.user_details.all_with_home():
+            for dnd_path in VMWARE_DND_PATHS:
+                if (dnd_dir := user_details.home_path.joinpath(dnd_path)).exists():
+                    yield user_details, dnd_dir
+
+    @alias("draganddrop")
+    @export(record=VmwareDragAndDropRecord)
+    def clipboard(self) -> Iterator[VmwareDragAndDropRecord]:
+        """Yield cached VMware Workstation drag-and-drop file artifacts."""
+
+        for user_details, dnd_dir in self.dnd_dirs:
+            for file in dnd_dir.rglob("*/*"):
+                if file.is_dir():
+                    continue
+
+                yield VmwareDragAndDropRecord(
+                    ts=file.lstat().st_mtime,
+                    path=file,
+                    _user=user_details.user,
+                    _target=self.target,
+                )

{dissect_target-3.20.dev18 → dissect_target-3.20.dev20}/dissect/target/plugins/child/vmware_workstation.py

@@ -1,29 +1,44 @@
+from typing import Iterator
+
 from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.fsutil import TargetPath
 from dissect.target.helpers.record import ChildTargetRecord
 from dissect.target.plugin import ChildTargetPlugin
+from dissect.target.target import Target
+
+INVENTORY_PATHS = [
+    # Windows
+    "AppData/Roaming/VMware/inventory.vmls",
+    # Linux
+    ".vmware/inventory.vmls",
+]
+
+
+def find_vm_inventory(target: Target) -> Iterator[TargetPath]:
+    """Search for inventory.vmls files in user home folders.
 
+    Does not support older vmAutoStart.xml or vmInventory.xml formats."""
 
-def find_vm_inventory(target):
     for user_details in target.user_details.all_with_home():
-        inv_file = user_details.home_path.joinpath("AppData/Roaming/VMware/inventory.vmls")
-        if inv_file.exists():
-            yield inv_file
+        for inv_path in INVENTORY_PATHS:
+            if (inv_file := user_details.home_path.joinpath(inv_path)).exists():
+                yield inv_file
 
 
-class WorkstationChildTargetPlugin(ChildTargetPlugin):
+class VmwareWorkstationChildTargetPlugin(ChildTargetPlugin):
     """Child target plugin that yields from VMware Workstation VM inventory."""
 
     __type__ = "vmware_workstation"
 
-    def __init__(self, target):
+    def __init__(self, target: Target):
         super().__init__(target)
         self.inventories = list(find_vm_inventory(target))
 
     def check_compatible(self) -> None:
-        if not len(self.inventories):
+        if not self.inventories:
             raise UnsupportedPluginError("No VMWare inventories found")
 
-    def list_children(self):
+    def list_children(self) -> Iterator[ChildTargetRecord]:
         for inv in self.inventories:
             for line in inv.open("rt"):
                 line = line.strip()

{dissect_target-3.20.dev18 → dissect_target-3.20.dev20}/dissect/target/tools/shell.py

@@ -1410,29 +1410,38 @@ def build_pipe_stdout(pipe_parts: list[str]) -> Iterator[TextIO]:
         yield pipe_stdin
 
 
-def open_shell(targets: list[str | pathlib.Path], python: bool, registry: bool) -> None:
+def open_shell(targets: list[str | pathlib.Path], python: bool, registry: bool, commands: list[str] | None) -> None:
     """Helper method for starting a regular, Python or registry shell for one or multiple targets."""
     targets = list(Target.open_all(targets))
 
     if python:
-        python_shell(targets)
+        python_shell(targets, commands=commands)
     else:
         cli_cls = RegistryCli if registry else TargetCli
-        target_shell(targets, cli_cls=cli_cls)
+        target_shell(targets, cli_cls=cli_cls, commands=commands)
 
 
-def target_shell(targets: list[Target], cli_cls: type[TargetCmd]) -> None:
+def target_shell(targets: list[Target], cli_cls: type[TargetCmd], commands: list[str] | None) -> None:
     """Helper method for starting a :class:`TargetCli` or :class:`TargetHubCli` for one or multiple targets."""
     if cli := create_cli(targets, cli_cls):
+        if commands is not None:
+            for command in commands:
+                cli.onecmd(command)
+            return
         run_cli(cli)
 
 
-def python_shell(targets: list[Target]) -> None:
+def python_shell(targets: list[Target], commands: list[str] | None) -> None:
     """Helper method for starting a (I)Python shell with multiple targets."""
     banner = "Loaded targets in 'targets' variable. First target is in 't'."
     ns = {"targets": targets, "t": targets[0]}
 
     try:
+        if commands is not None:
+            for command in commands:
+                eval(command, ns)
+            return
+
         import IPython
 
         IPython.embed(header=banner, user_ns=ns, colors="linux")
@@ -1512,7 +1521,7 @@ def main() -> None:
         default=None,
         help="select a specific loader (i.e. vmx, raw)",
     )
-
+    parser.add_argument("-c", "--commands", action="store", nargs="*", help="commands to execute")
     configure_generic_arguments(parser)
     args, rest = parser.parse_known_args()
     args.targets = args_to_uri(args.targets, args.loader, rest) if args.loader else args.targets
@@ -1537,7 +1546,7 @@ def main() -> None:
             )
 
     try:
-        open_shell(args.targets, args.python, args.registry)
+        open_shell(args.targets, args.python, args.registry, args.commands)
     except TargetError as e:
         log.error(e)
         log.debug("", exc_info=e)

{dissect_target-3.20.dev18 → dissect_target-3.20.dev20/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.20.dev18
+Version: 3.20.dev20
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.dev18 → dissect_target-3.20.dev20}/dissect.target.egg-info/SOURCES.txt

@@ -153,6 +153,8 @@ dissect/target/plugins/apps/ssh/ssh.py
 dissect/target/plugins/apps/texteditor/__init__.py
 dissect/target/plugins/apps/texteditor/texteditor.py
 dissect/target/plugins/apps/texteditor/windowsnotepad.py
+dissect/target/plugins/apps/virtualization/__init__.py
+dissect/target/plugins/apps/virtualization/vmware_workstation.py
 dissect/target/plugins/apps/vpn/__init__.py
 dissect/target/plugins/apps/vpn/openvpn.py
 dissect/target/plugins/apps/vpn/wireguard.py
@@ -477,6 +479,8 @@ tests/plugins/apps/ssh/test_opensshd.py
 tests/plugins/apps/ssh/test_putty.py
 tests/plugins/apps/texteditor/__init__.py
 tests/plugins/apps/texteditor/test_texteditor.py
+tests/plugins/apps/virtualization/__init__.py
+tests/plugins/apps/virtualization/test_vmware_workstation.py
 tests/plugins/apps/vpn/__init__.py
 tests/plugins/apps/vpn/test_openvpn.py
 tests/plugins/apps/vpn/test_wireguard.py
@@ -495,6 +499,7 @@ tests/plugins/child/test_hyperv.py
 tests/plugins/child/test_parallels.py
 tests/plugins/child/test_qemu.py
 tests/plugins/child/test_virtuozzo.py
+tests/plugins/child/test_vmware_workstation.py
 tests/plugins/child/test_wsl.py
 tests/plugins/filesystem/__init__.py
 tests/plugins/filesystem/test_acquire_handles.py

dissect_target-3.20.dev20/tests/plugins/apps/virtualization/test_vmware_workstation.py

@@ -0,0 +1,38 @@
+from datetime import datetime, timezone
+
+import pytest
+
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugins.apps.virtualization.vmware_workstation import (
+    VmwareWorkstationPlugin,
+)
+from dissect.target.target import Target
+from tests._utils import absolute_path
+
+
+@pytest.mark.parametrize(
+    "target,fs,dnd_path",
+    [
+        ("target_win_users", "fs_win", "Users\\John\\AppData\\Local\\Temp\\VmwareDND"),
+        ("target_unix_users", "fs_unix", "/home/user/.cache/vmware/drag_and_drop"),
+    ],
+)
+def test_vmware_workstation_clipboard_dnd(
+    target: Target, fs: VirtualFilesystem, dnd_path: str, request: pytest.FixtureRequest
+) -> None:
+    """test if we correctly detect drag and drop artifacts on Windows and Unix targets"""
+
+    target = request.getfixturevalue(target)
+    fs = request.getfixturevalue(fs)
+    fs.map_dir_from_tar(dnd_path, absolute_path("_data/plugins/apps/virtualization/vmware_workstation/dnd.tar"))
+    target.add_plugin(VmwareWorkstationPlugin)
+    results = sorted(list(target.vmware.clipboard()), key=lambda r: r.path)
+    dnd_path = dnd_path.replace("\\", "/")
+
+    assert len(results) == 3
+    assert [str(r.path).replace("C:\\", "").replace("\\", "/") for r in results] == [
+        f"{dnd_path}/8lkBf1/wachter.jpg",
+        f"{dnd_path}/iUpQHG/credentials.txt",
+        f"{dnd_path}/x1G9fJ/example.txt",
+    ]
+    assert results[0].ts == datetime(2024, 9, 18, 11, 16, 44, tzinfo=timezone.utc)

dissect_target-3.20.dev20/tests/plugins/child/test_vmware_workstation.py

@@ -0,0 +1,35 @@
+import pytest
+
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugins.child.vmware_workstation import (
+    VmwareWorkstationChildTargetPlugin,
+)
+from dissect.target.target import Target
+from tests._utils import absolute_path
+
+
+@pytest.mark.parametrize(
+    "target,fs,inventory_path",
+    [
+        ("target_win_users", "fs_win", "Users\\John\\AppData\\Roaming\\VMware\\inventory.vmls"),
+        ("target_unix_users", "fs_unix", "/home/user/.vmware/inventory.vmls"),
+    ],
+)
+def test_child_vmware_workstation(
+    target: Target, fs: VirtualFilesystem, inventory_path: str, request: pytest.FixtureRequest
+) -> None:
+    """test if we detect VMware Workstation children from inventory files correctly on Windows and Unix targets"""
+
+    target = request.getfixturevalue(target)
+    fs = request.getfixturevalue(fs)
+
+    fs.map_file(inventory_path, absolute_path("_data/plugins/child/vmware_workstation/inventory.vmls"))
+    target.add_plugin(VmwareWorkstationChildTargetPlugin)
+    children = list(target.list_children())
+
+    assert len(children) == 3
+    assert [c.path for c in children] == [
+        "/path/to/first/vm/vm.vmx",
+        "/path/to/second/vm/vm.vmx",
+        "/path/to/third/vm/vm.vmx",
+    ]

{dissect_target-3.20.dev18 → dissect_target-3.20.dev20}/tests/tools/test_shell.py

@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 import argparse
 import pathlib
 import platform
@@ -252,10 +254,10 @@ def test_target_cli_save(
 
 
 def run_target_shell(
-    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture, target_path: str, stdin: str
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture, argv: str | list, stdin: str
 ) -> tuple[bytes, bytes]:
     with monkeypatch.context() as m:
-        m.setattr("sys.argv", ["target-shell", target_path])
+        m.setattr("sys.argv", ["target-shell"] + (argv if isinstance(argv, list) else [argv])),
         m.setattr("sys.stdin", StringIO(stdin))
         m.setenv("NO_COLOR", "1")
         target_shell()
@@ -302,6 +304,13 @@ def test_shell_cmd_alias(monkeypatch: pytest.MonkeyPatch, capsys: pytest.Capture
     assert ls_la_out == ll_out
 
 
+def test_shell_cli_command(monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture) -> None:
+    target_path = absolute_path("_data/tools/info/image.tar")
+    dir_out, _ = run_target_shell(monkeypatch, capsys, target_path, "dir")
+    ls_out, _ = run_target_shell(monkeypatch, capsys, [target_path, "-c", "dir"], "")
+    assert dir_out == "ubuntu:/$ " + ls_out + "ubuntu:/$ \n"
+
+
 def test_shell_cmd_alias_runtime(monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture) -> None:
     """test if alias commands call their parent attribute correctly."""
     target_path = absolute_path("_data/tools/info/image.tar")