dissect.target 3.20.dev60__tar.gz → 3.20.dev62__tar.gz

{dissect_target-3.20.dev60/dissect.target.egg-info → dissect_target-3.20.dev62}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.20.dev60
+Version: 3.20.dev62
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.dev60 → dissect_target-3.20.dev62}/dissect/target/plugins/os/unix/linux/fortios/_os.py

@@ -248,10 +248,16 @@ class FortiOSPlugin(LinuxPlugin):
                 self.target.log.warning("Exception while parsing FortiManager admin users")
                 self.target.log.debug("", exc_info=e)
 
-        if self._config.get("root-config"):
+        if self._config.get("root-config", {}).get("user", {}).get("local"):
             # Local users
             try:
                 local_groups = local_groups_to_users(self._config["root-config"]["user"]["group"])
+            except KeyError as e:
+                self.target.log.warning("Unable to get local user groups in root config")
+                self.target.log.debug("", exc_info=e)
+                local_groups = {}
+
+            try:
                 for username, entry in self._config["root-config"]["user"].get("local", {}).items():
                     try:
                         password = decrypt_password(entry["passwd"][-1])
@@ -269,6 +275,7 @@ class FortiOSPlugin(LinuxPlugin):
                 self.target.log.warning("Exception while parsing FortiOS local users")
                 self.target.log.debug("", exc_info=e)
 
+        if self._config.get("root-config", {}).get("user", {}).get("group", {}).get("guestgroup"):
             # Temporary guest users
             try:
                 for _, entry in (

dissect_target-3.20.dev62/dissect/target/plugins/os/windows/log/mssql.py

@@ -0,0 +1,103 @@
+import re
+from datetime import datetime, timezone
+from typing import Iterator
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.fsutil import TargetPath
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, export
+from dissect.target.target import Target
+
+MssqlErrorlogRecord = TargetRecordDescriptor(
+    "microsoft/sql/errorlog",
+    [
+        ("datetime", "ts"),
+        ("string", "instance"),
+        ("string", "process"),
+        ("string", "message"),
+        ("path", "path"),
+    ],
+)
+
+RE_TIMESTAMP_PATTERN = re.compile(r"^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{2}")
+
+
+class MssqlPlugin(Plugin):
+    """Return information related to Microsoft SQL Server.
+
+    Currently returns ERRORLOG messages. These log files contain information such as:
+        - Logon failures
+        - Enabling/disabling of features, such as xp_cmdshell
+
+    References:
+        - https://learn.microsoft.com/en-us/sql/relational-databases/logs/view-offline-log-files
+    """
+
+    __namespace__ = "mssql"
+
+    MSSQL_KEY = "HKLM\\SOFTWARE\\Microsoft\\Microsoft SQL Server"
+    FILE_GLOB = "ERRORLOG*"
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self.instances = self._find_instances()
+
+    def check_compatible(self) -> None:
+        if not self.instances:
+            raise UnsupportedPluginError("System does not seem to be running SQL Server")
+
+    @export(record=MssqlErrorlogRecord)
+    def errorlog(self) -> Iterator[MssqlErrorlogRecord]:
+        """Return all Microsoft SQL Server ERRORLOG messages.
+
+        These log files contain information such as:
+         - Logon failures
+         - Enabling/disabling of features, such as xp_cmdshell
+
+        Yields MssqlErrorlogRecord instances with fields:
+
+        .. code-block:: text
+
+            ts (datetime): Timestamp of the log line.
+            instance (str): SQL Server instance name.
+            process (str): Process name.
+            message (str): Log message.
+            path (Path): Path to the log file.
+
+        References:
+            - https://learn.microsoft.com/en-us/sql/relational-databases/logs/view-offline-log-files
+        """
+
+        for instance, log_path in self.instances:
+            for errorlog in log_path.glob(self.FILE_GLOB):
+                # The errorlog includes a BOM, so endianess gets determined automatically
+                fh = errorlog.open(mode="rt", encoding="utf-16", errors="surrogateescape")
+                buf = ""
+
+                for line in fh:
+                    if ts := RE_TIMESTAMP_PATTERN.match(line):
+                        yield MssqlErrorlogRecord(
+                            ts=datetime.strptime(ts.group(), "%Y-%m-%d %H:%M:%S.%f").replace(tzinfo=timezone.utc),
+                            instance=instance,
+                            # The process name is a fixed-width field and is always 12 characters long.
+                            process=buf[23:35].strip(),
+                            message=buf[35:].strip(),
+                            path=errorlog,
+                            _target=self.target,
+                        )
+                        buf = ""
+
+                    buf += line
+
+    def _find_instances(self) -> list[str, TargetPath]:
+        instances = []
+
+        for subkey in self.target.registry.key(self.MSSQL_KEY).subkeys():
+            if subkey.name.startswith("MSSQL") and "." in subkey.name:
+                instances.append(
+                    (
+                        subkey.name,
+                        self.target.fs.path(subkey.subkey("SQLServerAgent").value("ErrorLogFile").value).parent,
+                    )
+                )
+        return instances

{dissect_target-3.20.dev60 → dissect_target-3.20.dev62/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.20.dev60
+Version: 3.20.dev62
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.dev60 → dissect_target-3.20.dev62}/dissect.target.egg-info/SOURCES.txt

@@ -140,6 +140,7 @@ dissect/target/plugins/apps/browser/firefox.py
 dissect/target/plugins/apps/browser/iexplore.py
 dissect/target/plugins/apps/container/__init__.py
 dissect/target/plugins/apps/container/docker.py
+dissect/target/plugins/apps/database/__init__.py
 dissect/target/plugins/apps/editor/__init__.py
 dissect/target/plugins/apps/editor/editor.py
 dissect/target/plugins/apps/editor/windowsnotepad.py
@@ -339,6 +340,7 @@ dissect/target/plugins/os/windows/log/amcache.py
 dissect/target/plugins/os/windows/log/etl.py
 dissect/target/plugins/os/windows/log/evt.py
 dissect/target/plugins/os/windows/log/evtx.py
+dissect/target/plugins/os/windows/log/mssql.py
 dissect/target/plugins/os/windows/log/pfro.py
 dissect/target/plugins/os/windows/log/schedlgu.py
 dissect/target/plugins/os/windows/regf/7zip.py
@@ -581,6 +583,8 @@ tests/plugins/os/unix/linux/debian/test_dpkg.py
 tests/plugins/os/unix/linux/debian/test_snap.py
 tests/plugins/os/unix/linux/debian/proxmox/__init__.py
 tests/plugins/os/unix/linux/debian/proxmox/test__os.py
+tests/plugins/os/unix/linux/fortios/__init__.py
+tests/plugins/os/unix/linux/fortios/test__os.py
 tests/plugins/os/unix/linux/fortios/test_keys.py
 tests/plugins/os/unix/linux/redhat/__init__.py
 tests/plugins/os/unix/linux/redhat/test_yum.py
@@ -633,6 +637,7 @@ tests/plugins/os/windows/credential/test_sam.py
 tests/plugins/os/windows/log/test_etl.py
 tests/plugins/os/windows/log/test_evt.py
 tests/plugins/os/windows/log/test_evtx.py
+tests/plugins/os/windows/log/test_mssql.py
 tests/plugins/os/windows/log/test_schedlgu.py
 tests/plugins/os/windows/regf/__init__.py
 tests/plugins/os/windows/regf/test_applications.py

dissect_target-3.20.dev62/tests/plugins/os/unix/linux/fortios/test__os.py

@@ -0,0 +1,98 @@
+import gzip
+from io import BytesIO
+
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugins.os.unix.linux.fortios._os import FortiOSPlugin
+from dissect.target.plugins.os.unix.linux.fortios.generic import GenericPlugin
+from dissect.target.plugins.os.unix.linux.fortios.locale import LocalePlugin
+from dissect.target.target import Target
+
+
+def test_fortigate_os(target_unix: Target, fs_unix: VirtualFilesystem) -> None:
+    """test if we detect FortiGate OS correctly."""
+
+    global_config = """\
+    #config-version=FGVM64-7.4.2-FW-build2571-231219:opmode=0:vdom=0
+    config system global
+        set alias "FortiGate-VM64"
+        set hostname "FortiGate-VM64"
+        set timezone "US/Pacific"
+    end
+    config system admin
+        edit "admin"
+            set accprofile "super_admin"
+            set vdom "root"
+            set password ENC SH22zS4+QvU399DXuDApIVHu5fGh3wQCwO1aGeqlbA08G9tB/DvJsqLdG9HA18=
+        next
+    end
+    config system dns
+        set primary 96.45.45.45
+        set secondary 96.45.46.46
+    end
+    """
+
+    iface_config = """\
+    edit "port1"
+        set vdom "root"
+        set ip 1.2.3.4 255.255.255.0
+        set allowaccess https
+        set type physical
+        set snmp-index 1
+    next
+    """
+
+    root_config = """\
+    config user group
+        edit "Guest-group"
+            set member "guest"
+        next
+    end
+    config user local
+        edit "guest"
+            set type password
+            set passwd ENC pATZu+74jg21Ktwn9zMDS/bGcYumPFDZMnBKh+86851cd0Ig2CS1zbqQa7mpUGpCNfnDKlDkjobzwIlUbXkHgRYxBWWf99DtTvm7g7UsEBGnf8Xa06ZNd62b5Zb4MVfKQJ/uh5Ky0dI4RujLfv8PqrU7VVKKTAPUdzEtC5ehWZzUxRAFohNM6WhklTUpLV58M+zoRA==
+        next
+    end
+    """  # noqa: E501
+
+    fs_unix.map_file_fh("/.flatkc", BytesIO(b""))
+    fs_unix.map_file_fh("/rootfs.gz", BytesIO(b""))
+    fs_unix.map_file_fh("/data/config/sys_global.conf.gz", BytesIO(gzip.compress(global_config.encode())))
+    fs_unix.map_file_fh("/data/config/global_system_interface.gz", BytesIO(gzip.compress(iface_config.encode())))
+    fs_unix.map_file_fh("/data/config/sys_vd_root+root.conf.gz", BytesIO(gzip.compress(root_config.encode())))
+    fs_unix.map_file_fh(
+        "/bin/grep", BytesIO(bytes.fromhex("7f454c4602010100000000000000000002003e0001000000004b4000000000"))
+    )
+
+    target_unix.add_plugin(FortiOSPlugin)
+    target_unix.add_plugin(LocalePlugin)
+    target_unix.add_plugin(GenericPlugin)
+
+    # tests FortiOSPlugin.detect() indirectly
+    assert target_unix.os == "fortios"
+
+    target_unix._os_plugin = FortiOSPlugin
+    target_unix.apply()
+
+    assert target_unix.os == "fortios"
+    assert target_unix.hostname == "FortiGate-VM64"
+    assert target_unix.version == "FortiGate VM 7.4.2 (build 2571, 2023-12-19)"
+    assert target_unix.ips == ["1.2.3.4"]
+    assert target_unix.dns == ["96.45.45.45", "96.45.46.46"]
+    assert target_unix.architecture == "x86_64-unix"
+    assert target_unix.language == "en_US"
+    assert target_unix.timezone == "US/Pacific"
+
+    users = list(target_unix.users())
+    assert len(users) == 2
+    assert users[0].hostname == "FortiGate-VM64"
+    assert users[0].name == "admin"
+    assert users[0].groups == ["super_admin"]
+    assert users[0].password == "ENC:SH22zS4+QvU399DXuDApIVHu5fGh3wQCwO1aGeqlbA08G9tB/DvJsqLdG9HA18="
+    assert users[0].home == "/root"
+
+    assert users[1].hostname == "FortiGate-VM64"
+    assert users[1].name == "guest"
+    assert users[1].groups == ["Guest-group"]
+    assert users[1].password == "guest"
+    assert users[1].home is None

dissect_target-3.20.dev62/tests/plugins/os/windows/log/test_mssql.py

@@ -0,0 +1,35 @@
+from dissect.target.filesystem import Filesystem
+from dissect.target.helpers.regutil import VirtualHive, VirtualKey, VirtualValue
+from dissect.target.plugins.os.windows.log.mssql import MssqlPlugin
+from tests._utils import absolute_path
+
+
+def test_mssql_errorlog(target_win_users, hive_hklm: VirtualHive, fs_win: Filesystem) -> None:
+    errorlog_file = absolute_path("_data/plugins/os/windows/log/mssql/errorlog")
+    target_errorlog_name = "/sysvol/Temp/MSSQL/Log/ERRORLOG"
+
+    _, _, map_path = target_errorlog_name.partition("sysvol/")
+    fs_win.map_file(map_path, errorlog_file)
+
+    errorlog_name = "SOFTWARE\\Microsoft\\Microsoft SQL Server\\MSSQL69.MyInstance\\SQLServerAgent"
+    errorlog_key = VirtualKey(hive_hklm, errorlog_name)
+    hive_hklm.map_key(errorlog_name, errorlog_key)
+    errorlog_key.add_value(
+        "ErrorLogFile", VirtualValue(hive_hklm, "ErrorLogFile", "C:\\Temp\\MSSQL\\Log\\SQLAGENT.OUT")
+    )
+
+    datapath_name = "SOFTWARE\\Microsoft\\Microsoft SQL Server\\MSSQL69.MyInstance\\MSSQLServer"
+    datapath_key = VirtualKey(hive_hklm, datapath_name)
+    hive_hklm.map_key(datapath_name, datapath_key)
+    datapath_key.add_value("DefaultData", VirtualValue(hive_hklm, "DefaultData", "C:\\Temp\\MSSQL\\Data"))
+
+    target_win_users.add_plugin(MssqlPlugin)
+    records = list(target_win_users.mssql())
+    assert len(records) == 101
+
+    record = records[51]
+    assert str(record.ts) == "2024-04-08 12:16:41.190000+00:00"
+    assert record.instance == "MSSQL69.MyInstance"
+    assert record.process == "Server"
+    assert record.message.startswith("The SQL Server Network Interface library could not register")
+    assert record.path == "C:\\Temp\\MSSQL\\Log\\ERRORLOG"