dissect.target 3.20.dev48__tar.gz → 3.20.dev50__tar.gz

{dissect_target-3.20.dev48/dissect.target.egg-info → dissect_target-3.20.dev50}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.20.dev48
+Version: 3.20.dev50
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3
@@ -31,7 +31,7 @@ Requires-Dist: dissect.ntfs<4,>=3.4
 Requires-Dist: dissect.regf<4,>=3.3
 Requires-Dist: dissect.util<4,>=3
 Requires-Dist: dissect.volume<4,>=2
-Requires-Dist: flow.record~=3.16.0
+Requires-Dist: flow.record~=3.17.0
 Requires-Dist: structlog
 Provides-Extra: full
 Requires-Dist: asn1crypto; extra == "full"

{dissect_target-3.20.dev48 → dissect_target-3.20.dev50}/dissect/target/plugins/general/network.py

@@ -53,22 +53,22 @@ class NetworkPlugin(Plugin):
     @export
     def ips(self) -> list[IPAddress]:
         """Return IP addresses as list of :class:`IPAddress`."""
-        return list(self._get_record_type("ip"))
+        return list(set(self._get_record_type("ip")))
 
     @export
     def gateways(self) -> list[IPAddress]:
         """Return gateways as list of :class:`IPAddress`."""
-        return list(self._get_record_type("gateway"))
+        return list(set(self._get_record_type("gateway")))
 
     @export
     def macs(self) -> list[str]:
         """Return MAC addresses as list of :class:`str`."""
-        return list(self._get_record_type("mac"))
+        return list(set(self._get_record_type("mac")))
 
     @export
-    def dns(self) -> list[str]:
+    def dns(self) -> list[str | IPAddress]:
         """Return DNS addresses as list of :class:`str`."""
-        return list(self._get_record_type("dns"))
+        return list(set(self._get_record_type("dns")))
 
     @internal
     def with_ip(self, ip_addr: str) -> Iterator[InterfaceRecord]:

{dissect_target-3.20.dev48 → dissect_target-3.20.dev50}/dissect/target/plugins/os/unix/_os.py

@@ -4,7 +4,6 @@ import logging
 import re
 import uuid
 from pathlib import Path
-from struct import unpack
 from typing import Iterator
 
 from flow.record.fieldtypes import posix_path
@@ -19,6 +18,25 @@ from dissect.target.target import Target
 log = logging.getLogger(__name__)
 
 
+# https://en.wikipedia.org/wiki/Executable_and_Linkable_Format#ISA
+ARCH_MAP = {
+    0x00: "unknown",
+    0x02: "sparc",
+    0x03: "x86",
+    0x08: "mips",
+    0x14: "powerpc32",
+    0x15: "powerpc64",
+    0x16: "s390",  # and s390x
+    0x28: "aarch32",  # armv7
+    0x2A: "superh",
+    0x32: "ia-64",
+    0x3E: "x86_64",
+    0xB7: "aarch64",  # armv8
+    0xF3: "riscv64",
+    0xF7: "bpf",
+}
+
+
 class UnixPlugin(OSPlugin):
     def __init__(self, target: Target):
         super().__init__(target)
@@ -301,37 +319,30 @@ class UnixPlugin(OSPlugin):
                                 continue
         return os_release
 
-    def _get_architecture(self, os: str = "unix", path: str = "/bin/ls") -> str | None:
-        arch_strings = {
-            0x00: "Unknown",
-            0x02: "SPARC",
-            0x03: "x86",
-            0x08: "MIPS",
-            0x14: "PowerPC",
-            0x16: "S390",
-            0x28: "ARM",
-            0x2A: "SuperH",
-            0x32: "IA-64",
-            0x3E: "x86_64",
-            0xB7: "AArch64",
-            0xF3: "RISC-V",
-        }
-
-        for fs in self.target.filesystems:
-            if fs.exists(path):
-                fh = fs.open(path)
-                fh.seek(4)
-                # ELF - e_ident[EI_CLASS]
-                bits = unpack("B", fh.read(1))[0]
-                fh.seek(18)
-                # ELF - e_machine
-                arch = unpack("H", fh.read(2))[0]
-                arch = arch_strings.get(arch)
-
-                if bits == 1:  # 32 bit system
-                    return f"{arch}_32-{os}"
-                else:
-                    return f"{arch}-{os}"
+    def _get_architecture(self, os: str = "unix", path: Path | str = "/bin/ls") -> str | None:
+        """Determine architecture by reading an ELF header of a binary on the target.
+
+        Resources:
+            - https://en.wikipedia.org/wiki/Executable_and_Linkable_Format#ISA
+        """
+
+        if not isinstance(path, TargetPath):
+            for fs in [self.target.fs, *self.target.filesystems]:
+                if (path := fs.path(path)).exists():
+                    break
+
+        if not path.exists():
+            return
+
+        fh = path.open("rb")
+        fh.seek(4)  # ELF - e_ident[EI_CLASS]
+        bits = fh.read(1)[0]
+
+        fh.seek(18)  # ELF - e_machine
+        e_machine = int.from_bytes(fh.read(2), "little")
+        arch = ARCH_MAP.get(e_machine, "unknown")
+
+        return f"{arch}_32-{os}" if bits == 1 and not arch[-2:] == "32" else f"{arch}-{os}"
 
 
 def parse_fstab(

{dissect_target-3.20.dev48 → dissect_target-3.20.dev50}/dissect/target/plugins/os/unix/bsd/osx/_os.py

@@ -41,10 +41,7 @@ class MacPlugin(BsdPlugin):
 
     @export(property=True)
     def ips(self) -> Optional[list[str]]:
-        ips = set()
-        for ip in self.target.network.ips():
-            ips.add(str(ip))
-        return list(ips)
+        return list(set(map(str, self.target.network.ips())))
 
     @export(property=True)
     def version(self) -> Optional[str]:

{dissect_target-3.20.dev48 → dissect_target-3.20.dev50}/dissect/target/plugins/os/unix/linux/_os.py

@@ -34,17 +34,15 @@ class LinuxPlugin(UnixPlugin, LinuxNetworkManager):
     @export(property=True)
     def ips(self) -> list[str]:
         """Returns a list of static IP addresses and DHCP lease IP addresses found on the host system."""
-        ips = []
+        ips = set()
 
         for ip_set in self.network_manager.get_config_value("ips"):
-            for ip in ip_set:
-                ips.append(ip)
+            ips.update(ip_set)
 
         for ip in parse_unix_dhcp_log_messages(self.target, iter_all=False):
-            if ip not in ips:
-                ips.append(ip)
+            ips.add(ip)
 
-        return ips
+        return list(ips)
 
     @export(property=True)
     def dns(self) -> list[str]:

{dissect_target-3.20.dev48 → dissect_target-3.20.dev50}/dissect/target/plugins/os/unix/linux/fortios/_os.py

@@ -6,7 +6,7 @@ from base64 import b64decode
 from datetime import datetime
 from io import BytesIO
 from tarfile import ReadError
-from typing import BinaryIO, Iterator, Optional, TextIO, Union
+from typing import BinaryIO, Iterator, TextIO
 
 from dissect.util import cpio
 from dissect.util.compression import xz
@@ -73,10 +73,11 @@ class FortiOSPlugin(LinuxPlugin):
         return config
 
     @classmethod
-    def detect(cls, target: Target) -> Optional[Filesystem]:
+    def detect(cls, target: Target) -> Filesystem | None:
         for fs in target.filesystems:
-            # Tested on FortiGate and FortiAnalyzer, other Fortinet devices may look different.
-            if fs.exists("/rootfs.gz") and (fs.exists("/.fgtsum") or fs.exists("/.fmg_sign") or fs.exists("/flatkc")):
+            # Tested on FortiGate, FortiAnalyzer and FortiManager.
+            # Other Fortinet devices may look different.
+            if fs.exists("/rootfs.gz") and (any(map(fs.exists, (".fgtsum", ".fmg_sign", "flatkc", "system.conf")))):
                 return fs
 
     @classmethod
@@ -212,7 +213,7 @@ class FortiOSPlugin(LinuxPlugin):
         return "FortiOS Unknown"
 
     @export(record=FortiOSUserRecord)
-    def users(self) -> Iterator[Union[FortiOSUserRecord, UnixUserRecord]]:
+    def users(self) -> Iterator[FortiOSUserRecord | UnixUserRecord]:
         """Return local users of the FortiOS system."""
 
         # Possible unix-like users
@@ -224,7 +225,7 @@ class FortiOSPlugin(LinuxPlugin):
                 yield FortiOSUserRecord(
                     name=username,
                     password=":".join(entry.get("password", [])),
-                    groups=[entry["accprofile"][0]],
+                    groups=list(entry.get("accprofile", [])),
                     home="/root",
                     _target=self.target,
                 )
@@ -233,69 +234,72 @@ class FortiOSPlugin(LinuxPlugin):
             self.target.log.debug("", exc_info=e)
 
         # FortiManager administrative users
-        try:
-            for username, entry in self._config["global-config"]["system"]["admin"]["user"].items():
-                yield FortiOSUserRecord(
-                    name=username,
-                    password=":".join(entry.get("password", [])),
-                    groups=[entry["profileid"][0]],
-                    home="/root",
-                    _target=self.target,
-                )
-        except KeyError as e:
-            self.target.log.warning("Exception while parsing FortiManager admin users")
-            self.target.log.debug("", exc_info=e)
-
-        # Local users
-        try:
-            local_groups = local_groups_to_users(self._config["root-config"]["user"]["group"])
-            for username, entry in self._config["root-config"]["user"].get("local", {}).items():
-                try:
-                    password = decrypt_password(entry["passwd"][-1])
-                except (ValueError, RuntimeError):
-                    password = ":".join(entry.get("passwd", []))
-
-                yield FortiOSUserRecord(
-                    name=username,
-                    password=password,
-                    groups=local_groups.get(username, []),
-                    home=None,
-                    _target=self.target,
-                )
-        except KeyError as e:
-            self.target.log.warning("Exception while parsing FortiOS local users")
-            self.target.log.debug("", exc_info=e)
-
-        # Temporary guest users
-        try:
-            for _, entry in self._config["root-config"]["user"]["group"].get("guestgroup", {}).get("guest", {}).items():
-                try:
-                    password = decrypt_password(entry.get("password")[-1])
-                except (ValueError, RuntimeError):
-                    password = ":".join(entry.get("password"))
-
-                yield FortiOSUserRecord(
-                    name=entry["user-id"][0],
-                    password=password,
-                    groups=["guestgroup"],
-                    home=None,
-                    _target=self.target,
-                )
-        except KeyError as e:
-            self.target.log.warning("Exception while parsing FortiOS temporary guest users")
-            self.target.log.debug("", exc_info=e)
+        if self._config.get("global-config", {}).get("system", {}).get("admin", {}).get("user"):
+            try:
+                for username, entry in self._config["global-config"]["system"]["admin"]["user"].items():
+                    yield FortiOSUserRecord(
+                        name=username,
+                        password=":".join(entry.get("password", [])),
+                        groups=list(entry.get("profileid", [])),
+                        home="/root",
+                        _target=self.target,
+                    )
+            except KeyError as e:
+                self.target.log.warning("Exception while parsing FortiManager admin users")
+                self.target.log.debug("", exc_info=e)
+
+        if self._config.get("root-config"):
+            # Local users
+            try:
+                local_groups = local_groups_to_users(self._config["root-config"]["user"]["group"])
+                for username, entry in self._config["root-config"]["user"].get("local", {}).items():
+                    try:
+                        password = decrypt_password(entry["passwd"][-1])
+                    except (ValueError, RuntimeError):
+                        password = ":".join(entry.get("passwd", []))
+
+                    yield FortiOSUserRecord(
+                        name=username,
+                        password=password,
+                        groups=local_groups.get(username, []),
+                        home=None,
+                        _target=self.target,
+                    )
+            except KeyError as e:
+                self.target.log.warning("Exception while parsing FortiOS local users")
+                self.target.log.debug("", exc_info=e)
+
+            # Temporary guest users
+            try:
+                for _, entry in (
+                    self._config["root-config"]["user"]["group"].get("guestgroup", {}).get("guest", {}).items()
+                ):
+                    try:
+                        password = decrypt_password(entry.get("password")[-1])
+                    except (ValueError, RuntimeError):
+                        password = ":".join(entry.get("password"))
+
+                    yield FortiOSUserRecord(
+                        name=entry["user-id"][0],
+                        password=password,
+                        groups=["guestgroup"],
+                        home=None,
+                        _target=self.target,
+                    )
+            except KeyError as e:
+                self.target.log.warning("Exception while parsing FortiOS temporary guest users")
+                self.target.log.debug("", exc_info=e)
 
     @export(property=True)
     def os(self) -> str:
         return OperatingSystem.FORTIOS.value
 
     @export(property=True)
-    def architecture(self) -> Optional[str]:
+    def architecture(self) -> str | None:
         """Return architecture FortiOS runs on."""
-        paths = ["/lib/libav.so", "/bin/ctr"]
-        for path in paths:
-            if self.target.fs.path(path).exists():
-                return self._get_architecture(path=path)
+        for path in ["/lib/libav.so", "/bin/ctr", "/bin/grep"]:
+            if (bin := self.target.fs.path(path)).exists():
+                return self._get_architecture(path=bin)
 
 
 class ConfigNode(dict):
@@ -528,7 +532,7 @@ def decrypt_rootfs(fh: BinaryIO, key: bytes, iv: bytes) -> BinaryIO:
     return BytesIO(result)
 
 
-def _kdf_7_4_x(key_data: Union[str, bytes]) -> tuple[bytes, bytes]:
+def _kdf_7_4_x(key_data: str | bytes) -> tuple[bytes, bytes]:
     """Derive 32 byte key and 16 byte IV from 32 byte seed.
 
     As the IV needs to be 16 bytes, we return the first 16 bytes of the sha256 hash.
@@ -542,7 +546,7 @@ def _kdf_7_4_x(key_data: Union[str, bytes]) -> tuple[bytes, bytes]:
     return key, iv
 
 
-def get_kernel_hash(sysvol: Filesystem) -> Optional[str]:
+def get_kernel_hash(sysvol: Filesystem) -> str | None:
     """Return the SHA256 hash of the (compressed) kernel."""
     kernel_files = ["flatkc", "vmlinuz", "vmlinux"]
     for k in kernel_files:

{dissect_target-3.20.dev48 → dissect_target-3.20.dev50}/dissect/target/plugins/os/windows/_os.py

@@ -12,6 +12,14 @@ from dissect.target.helpers.record import WindowsUserRecord
 from dissect.target.plugin import OperatingSystem, OSPlugin, export
 from dissect.target.target import Target
 
+ARCH_MAP = {
+    "x86": 32,
+    "IA64": 64,
+    "ARM64": 64,
+    "EM64T": 64,
+    "AMD64": 64,
+}
+
 
 class WindowsPlugin(OSPlugin):
     CURRENT_VERSION_KEY = "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion"
@@ -101,7 +109,7 @@ class WindowsPlugin(OSPlugin):
 
     @export(property=True)
     def ips(self) -> list[str]:
-        return self.target.network.ips()
+        return list(set(map(str, self.target.network.ips())))
 
     def _get_version_reg_value(self, value_name: str) -> Any:
         try:
@@ -265,19 +273,11 @@ class WindowsPlugin(OSPlugin):
             Dict: arch: architecture, bitness: bits
         """
 
-        arch_strings = {
-            "x86": 32,
-            "IA64": 64,
-            "ARM64": 64,
-            "EM64T": 64,
-            "AMD64": 64,
-        }
-
         key = "HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment"
 
         try:
             arch = self.target.registry.key(key).value("PROCESSOR_ARCHITECTURE").value
-            bits = arch_strings.get(arch)
+            bits = ARCH_MAP.get(arch)
 
             # return {"arch": arch, "bitness": bits}
             if bits == 64: