dissect.target 3.20.dev60__tar.gz → 3.20.dev61__tar.gz

{dissect_target-3.20.dev60/dissect.target.egg-info → dissect_target-3.20.dev61}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.20.dev60
+Version: 3.20.dev61
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

dissect_target-3.20.dev61/dissect/target/plugins/os/windows/log/mssql.py

@@ -0,0 +1,103 @@
+import re
+from datetime import datetime, timezone
+from typing import Iterator
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.fsutil import TargetPath
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, export
+from dissect.target.target import Target
+
+MssqlErrorlogRecord = TargetRecordDescriptor(
+    "microsoft/sql/errorlog",
+    [
+        ("datetime", "ts"),
+        ("string", "instance"),
+        ("string", "process"),
+        ("string", "message"),
+        ("path", "path"),
+    ],
+)
+
+RE_TIMESTAMP_PATTERN = re.compile(r"^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{2}")
+
+
+class MssqlPlugin(Plugin):
+    """Return information related to Microsoft SQL Server.
+
+    Currently returns ERRORLOG messages. These log files contain information such as:
+        - Logon failures
+        - Enabling/disabling of features, such as xp_cmdshell
+
+    References:
+        - https://learn.microsoft.com/en-us/sql/relational-databases/logs/view-offline-log-files
+    """
+
+    __namespace__ = "mssql"
+
+    MSSQL_KEY = "HKLM\\SOFTWARE\\Microsoft\\Microsoft SQL Server"
+    FILE_GLOB = "ERRORLOG*"
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self.instances = self._find_instances()
+
+    def check_compatible(self) -> None:
+        if not self.instances:
+            raise UnsupportedPluginError("System does not seem to be running SQL Server")
+
+    @export(record=MssqlErrorlogRecord)
+    def errorlog(self) -> Iterator[MssqlErrorlogRecord]:
+        """Return all Microsoft SQL Server ERRORLOG messages.
+
+        These log files contain information such as:
+         - Logon failures
+         - Enabling/disabling of features, such as xp_cmdshell
+
+        Yields MssqlErrorlogRecord instances with fields:
+
+        .. code-block:: text
+
+            ts (datetime): Timestamp of the log line.
+            instance (str): SQL Server instance name.
+            process (str): Process name.
+            message (str): Log message.
+            path (Path): Path to the log file.
+
+        References:
+            - https://learn.microsoft.com/en-us/sql/relational-databases/logs/view-offline-log-files
+        """
+
+        for instance, log_path in self.instances:
+            for errorlog in log_path.glob(self.FILE_GLOB):
+                # The errorlog includes a BOM, so endianess gets determined automatically
+                fh = errorlog.open(mode="rt", encoding="utf-16", errors="surrogateescape")
+                buf = ""
+
+                for line in fh:
+                    if ts := RE_TIMESTAMP_PATTERN.match(line):
+                        yield MssqlErrorlogRecord(
+                            ts=datetime.strptime(ts.group(), "%Y-%m-%d %H:%M:%S.%f").replace(tzinfo=timezone.utc),
+                            instance=instance,
+                            # The process name is a fixed-width field and is always 12 characters long.
+                            process=buf[23:35].strip(),
+                            message=buf[35:].strip(),
+                            path=errorlog,
+                            _target=self.target,
+                        )
+                        buf = ""
+
+                    buf += line
+
+    def _find_instances(self) -> list[str, TargetPath]:
+        instances = []
+
+        for subkey in self.target.registry.key(self.MSSQL_KEY).subkeys():
+            if subkey.name.startswith("MSSQL") and "." in subkey.name:
+                instances.append(
+                    (
+                        subkey.name,
+                        self.target.fs.path(subkey.subkey("SQLServerAgent").value("ErrorLogFile").value).parent,
+                    )
+                )
+        return instances

{dissect_target-3.20.dev60 → dissect_target-3.20.dev61/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.20.dev60
+Version: 3.20.dev61
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.dev60 → dissect_target-3.20.dev61}/dissect.target.egg-info/SOURCES.txt

@@ -140,6 +140,7 @@ dissect/target/plugins/apps/browser/firefox.py
 dissect/target/plugins/apps/browser/iexplore.py
 dissect/target/plugins/apps/container/__init__.py
 dissect/target/plugins/apps/container/docker.py
+dissect/target/plugins/apps/database/__init__.py
 dissect/target/plugins/apps/editor/__init__.py
 dissect/target/plugins/apps/editor/editor.py
 dissect/target/plugins/apps/editor/windowsnotepad.py
@@ -339,6 +340,7 @@ dissect/target/plugins/os/windows/log/amcache.py
 dissect/target/plugins/os/windows/log/etl.py
 dissect/target/plugins/os/windows/log/evt.py
 dissect/target/plugins/os/windows/log/evtx.py
+dissect/target/plugins/os/windows/log/mssql.py
 dissect/target/plugins/os/windows/log/pfro.py
 dissect/target/plugins/os/windows/log/schedlgu.py
 dissect/target/plugins/os/windows/regf/7zip.py
@@ -633,6 +635,7 @@ tests/plugins/os/windows/credential/test_sam.py
 tests/plugins/os/windows/log/test_etl.py
 tests/plugins/os/windows/log/test_evt.py
 tests/plugins/os/windows/log/test_evtx.py
+tests/plugins/os/windows/log/test_mssql.py
 tests/plugins/os/windows/log/test_schedlgu.py
 tests/plugins/os/windows/regf/__init__.py
 tests/plugins/os/windows/regf/test_applications.py

dissect_target-3.20.dev61/tests/plugins/os/windows/log/test_mssql.py

@@ -0,0 +1,35 @@
+from dissect.target.filesystem import Filesystem
+from dissect.target.helpers.regutil import VirtualHive, VirtualKey, VirtualValue
+from dissect.target.plugins.os.windows.log.mssql import MssqlPlugin
+from tests._utils import absolute_path
+
+
+def test_mssql_errorlog(target_win_users, hive_hklm: VirtualHive, fs_win: Filesystem) -> None:
+    errorlog_file = absolute_path("_data/plugins/os/windows/log/mssql/errorlog")
+    target_errorlog_name = "/sysvol/Temp/MSSQL/Log/ERRORLOG"
+
+    _, _, map_path = target_errorlog_name.partition("sysvol/")
+    fs_win.map_file(map_path, errorlog_file)
+
+    errorlog_name = "SOFTWARE\\Microsoft\\Microsoft SQL Server\\MSSQL69.MyInstance\\SQLServerAgent"
+    errorlog_key = VirtualKey(hive_hklm, errorlog_name)
+    hive_hklm.map_key(errorlog_name, errorlog_key)
+    errorlog_key.add_value(
+        "ErrorLogFile", VirtualValue(hive_hklm, "ErrorLogFile", "C:\\Temp\\MSSQL\\Log\\SQLAGENT.OUT")
+    )
+
+    datapath_name = "SOFTWARE\\Microsoft\\Microsoft SQL Server\\MSSQL69.MyInstance\\MSSQLServer"
+    datapath_key = VirtualKey(hive_hklm, datapath_name)
+    hive_hklm.map_key(datapath_name, datapath_key)
+    datapath_key.add_value("DefaultData", VirtualValue(hive_hklm, "DefaultData", "C:\\Temp\\MSSQL\\Data"))
+
+    target_win_users.add_plugin(MssqlPlugin)
+    records = list(target_win_users.mssql())
+    assert len(records) == 101
+
+    record = records[51]
+    assert str(record.ts) == "2024-04-08 12:16:41.190000+00:00"
+    assert record.instance == "MSSQL69.MyInstance"
+    assert record.process == "Server"
+    assert record.message.startswith("The SQL Server Network Interface library could not register")
+    assert record.path == "C:\\Temp\\MSSQL\\Log\\ERRORLOG"