dissect.target 3.22.dev14__tar.gz → 3.22.dev16__tar.gz

{dissect_target-3.22.dev14/dissect.target.egg-info → dissect_target-3.22.dev16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.22.dev14
+Version: 3.22.dev16
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

dissect_target-3.22.dev16/dissect/target/helpers/regex/ipaddress.py

@@ -0,0 +1,55 @@
+import re
+
+IPV4_SEG = r"(?:25[0-5]|2[0-4]\d|[1]\d\d|[1-9]?\d)"
+IPV4_ADDR = r"(?:" + IPV4_SEG + r"\.){3}" + IPV4_SEG + r"(?:\/(3[012]|[12]\d|[1-9]))?"
+
+IPV6_SEG = r"(?:(?:[0-9a-fA-F]){1,4})"
+IPV6_GROUPS = (
+    # 1:2:3:4:5:6:7:8
+    r"(?:" + IPV6_SEG + r":){7,7}" + IPV6_SEG,
+    # 1:: - 1:2:3:4:5:6:7::
+    r"(?:" + IPV6_SEG + r":){1,7}:",
+    # 1::8 - 1:2:3:4:5:6::8 - 1:2:3:4:5:6::8
+    r"(?:" + IPV6_SEG + r":){1,6}:" + IPV6_SEG,
+    # 1::7:8 - 1:2:3:4:5::7:8 - 1:2:3:4:5::8
+    r"(?:" + IPV6_SEG + r":){1,5}(?::" + IPV6_SEG + r"){1,2}",
+    # 1::6:7:8 - 1:2:3:4::6:7:8 - 1:2:3:4::8
+    r"(?:" + IPV6_SEG + r":){1,4}(?::" + IPV6_SEG + r"){1,3}",
+    # 1::5:6:7:8 - 1:2:3::5:6:7:8 - 1:2:3::8
+    r"(?:" + IPV6_SEG + r":){1,3}(?::" + IPV6_SEG + r"){1,4}",
+    # 1::4:5:6:7:8 - 1:2::4:5:6:7:8 - 1:2::8
+    r"(?:" + IPV6_SEG + r":){1,2}(?::" + IPV6_SEG + r"){1,5}",
+    # 1::3:4:5:6:7:8 - 1::3:4:5:6:7:8 - 1::8
+    IPV6_SEG + r":(?:(?::" + IPV6_SEG + r"){1,6})",
+    # ::2:3:4:5:6:7:8 - ::2:3:4:5:6:7:8 - ::8 - ::
+    r":(?:(?::" + IPV6_SEG + r"){1,7}|:)",
+    # (link - local IPv6 addresses with zone index)
+    # fe80::7:8%eth0 - fe80::7:8%1
+    r"fe80:(?::" + IPV6_SEG + r"){0,4}%[0-9a-zA-Z]{1,}",
+    # (IPv4-mapped IPv6 addresses and IPv4-translated addresses)
+    # ::255.255.255.255 - ::ffff:255.255.255.255 - ::ffff:0:255.255.255.255
+    r"::(?:ffff(?::0{1,4}){0,1}:){0,1}[^\s:]" + IPV4_ADDR,
+    # (IPv4 - Embedded IPv6 Address)
+    # 2001:db8:3:4::192.0.2.33 - 64:ff9b::192.0.2.33 - 0:0:0:0:0:0:10.0.0.1
+    r"(?:" + IPV6_SEG + r":){1,6}:?[^\s:]" + IPV4_ADDR,
+)
+IPV6_ADDR = "|".join(["(?:{})".format(group) for group in IPV6_GROUPS[::-1]])  # Reverse rows for greedy match
+IP_REGEX = re.compile(f"{IPV6_ADDR}|{IPV4_ADDR}", re.IGNORECASE)
+
+
+def extract_ips(text: str) -> list[str]:
+    """Extract IPv4 and IPv6 addresses from an input string.
+
+    Note: ``910.12.34.569`` matches ``10.12.34.56``, so always check your input!
+
+    Deliberately does not find octal representations of IP addresses (e.g. ``010.010.010.010``)
+    as this is generally discouraged and introduced ambiguity: the address could be interpreted as
+    ``8.8.8.8`` or ``10.10.10.10``. Most indexing services such as Elasticsearch also do not accept
+    octal representations of IP addresses.
+
+    Resources:
+        - https://github.com/GCHQ/CyberChef/blob/main/src/core/operations/ExtractIPAddresses.mjs
+        - https://gist.github.com/dfee/6ed3a4b05cfe7a6faf40a2102408d5d8
+    """
+
+    return list({match.group() for match in IP_REGEX.finditer(text)})

{dissect_target-3.22.dev14 → dissect_target-3.22.dev16}/dissect/target/plugins/apps/shell/powershell.py

@@ -9,6 +9,7 @@ ConsoleHostHistoryRecord = create_extended_descriptor([UserRecordDescriptorExten
     "powershell/history",
     [
         ("datetime", "mtime"),
+        ("varint", "order"),
         ("string", "command"),
         ("path", "source"),
     ],
@@ -52,10 +53,11 @@ class PowerShellHistoryPlugin(Plugin):
             - https://learn.microsoft.com/en-us/powershell/module/psreadline/about/about_psreadline?view=powershell-7.3#command-history
         """  # noqa E501
 
-        for user, _path in self._history:
-            file_mtime = _path.stat().st_mtime
+        for user, path in self._history:
+            file_mtime = path.stat().st_mtime
 
-            for line in _path.open("r"):
+            i = 0
+            for line in path.open("r"):
                 line = line.strip()
                 if not line:
                     continue
@@ -63,7 +65,10 @@ class PowerShellHistoryPlugin(Plugin):
                 yield ConsoleHostHistoryRecord(
                     mtime=file_mtime,
                     command=line,
-                    source=_path,
+                    order=i,
+                    source=path,
                     _target=self.target,
                     _user=user,
                 )
+
+                i += 1

{dissect_target-3.22.dev14 → dissect_target-3.22.dev16}/dissect/target/plugins/os/unix/bsd/citrix/history.py

@@ -72,9 +72,10 @@ class CitrixCommandHistoryPlugin(CommandHistoryPlugin):
 
     @export(record=CommandHistoryRecord)
     def commandhistory(self) -> Iterator[CommandHistoryRecord]:
-        """Return shell history for all users.
+        """Return shell history for all Citrix users.
 
-        When using a shell, history of the used commands is kept on the system.
+        Some entries are returned in reverse chronological order and can contain negative command order integers due
+        to the way Citrix stores bash history commands.
         """
 
         for shell, history_path, user in self._history_files:
@@ -85,6 +86,8 @@ class CitrixCommandHistoryPlugin(CommandHistoryPlugin):
 
     def parse_netscaler_bash_history(self, path: TargetPath) -> Iterator[CommandHistoryRecord]:
         """Parse bash.log* contents."""
+
+        i = 0
         for ts, line in year_rollover_helper(path, RE_CITRIX_NETSCALER_BASH_HISTORY_DATE, "%b %d %H:%M:%S "):
             line = line.strip()
             if not line:
@@ -101,12 +104,15 @@ class CitrixCommandHistoryPlugin(CommandHistoryPlugin):
             yield CommandHistoryRecord(
                 ts=ts,
                 command=command,
+                order=-i,  # year_rollover_helper returns entries in reverse order.
                 shell="citrix-netscaler-bash",
                 source=path,
                 _target=self.target,
                 _user=user,
             )
 
+            i += 1
+
     def parse_netscaler_cli_history(
         self, history_file: TargetPath, user: UnixUserRecord
     ) -> Iterator[CommandHistoryRecord]:
@@ -115,18 +121,22 @@ class CitrixCommandHistoryPlugin(CommandHistoryPlugin):
         The only difference compared to generic bash history files is that the first line will start with
         ``_HiStOrY_V2_``, which we will skip.
         """
-        for idx, line in enumerate(history_file.open("rt")):
+        i = 0
+        for line in history_file.open("rt"):
             if not (line := line.strip()):
                 continue
 
-            if idx == 0 and line == "_HiStOrY_V2_":
+            if i == 0 and line == "_HiStOrY_V2_":
                 continue
 
             yield CommandHistoryRecord(
                 ts=None,
                 command=line,
+                order=i,
                 shell="citrix-netscaler-cli",
                 source=history_file,
                 _target=self.target,
                 _user=user,
             )
+
+            i += 1

{dissect_target-3.22.dev14 → dissect_target-3.22.dev16}/dissect/target/plugins/os/unix/history.py

@@ -14,6 +14,7 @@ CommandHistoryRecord = create_extended_descriptor([UserRecordDescriptorExtension
     "unix/history",
     [
         ("datetime", "ts"),
+        ("varint", "order"),
         ("string", "command"),
         ("string", "shell"),
         ("path", "source"),
@@ -26,7 +27,7 @@ RE_FISH = re.compile(r"- cmd: (?P<command>.+?)\s+when: (?P<ts>\d+)")
 
 
 class CommandHistoryPlugin(Plugin):
-    """Unix command history plugin."""
+    """UNIX command history plugin."""
 
     COMMAND_HISTORY_RELATIVE_PATHS = (
         ("bash", ".bash_history"),
@@ -62,11 +63,10 @@ class CommandHistoryPlugin(Plugin):
     @alias("bashhistory")
     @export(record=CommandHistoryRecord)
     def commandhistory(self) -> Iterator[CommandHistoryRecord]:
-        """Return shell history for all users.
+        """Return shell history for all UNIX users.
 
-        When using a shell, history of the used commands is kept on the system.
-        It is kept in a hidden file named ".$SHELL_history" and may expose
-        commands that were used by an adversary.
+        When using a shell, history of the used commands can be kept on the system. These are usually written to
+        a hidden file named ``.$SHELL_history`` and may expose commands that were used by an adversary.
         """
 
         for shell, history_path, user in self._history_files:
@@ -95,6 +95,7 @@ class CommandHistoryPlugin(Plugin):
         """
         next_cmd_ts = None
 
+        i = 0
         for line in file.open("rt", errors="replace"):
             ts = None
             line = line.strip()
@@ -113,12 +114,15 @@ class CommandHistoryPlugin(Plugin):
             yield CommandHistoryRecord(
                 ts=ts,
                 command=line,
+                order=i,
                 shell=shell,
                 source=file,
                 _target=self.target,
                 _user=user,
             )
 
+            i += 1
+
     @internal
     def parse_zsh_history(self, file, user: UnixUserRecord) -> Iterator[CommandHistoryRecord]:
         """Parse zsh_history contents.
@@ -133,6 +137,7 @@ class CommandHistoryPlugin(Plugin):
         Resources:
             - https://sourceforge.net/p/zsh/code/ci/master/tree/Src/hist.c
         """
+        i = 0
         for line in file.open("rt", errors="replace"):
             line = line.strip()
 
@@ -149,12 +154,15 @@ class CommandHistoryPlugin(Plugin):
             yield CommandHistoryRecord(
                 ts=ts,
                 command=command,
+                order=i,
                 shell="zsh",
                 source=file,
                 _target=self.target,
                 _user=user,
             )
 
+            i += 1
+
     @internal
     def parse_fish_history(self, history_file: TargetPath, user: UnixUserRecord) -> Iterator[CommandHistoryRecord]:
         """Parses the history file of the fish shell.
@@ -182,10 +190,11 @@ class CommandHistoryPlugin(Plugin):
         with history_file.open("r") as h_file:
             history_data = h_file.read()
 
-        for command, ts in RE_FISH.findall(history_data):
+        for i, (command, ts) in enumerate(RE_FISH.findall(history_data)):
             yield CommandHistoryRecord(
                 ts=from_unix(int(ts)),
                 command=command,
+                order=i,
                 shell="fish",
                 source=history_file,
                 _target=self.target,

{dissect_target-3.22.dev14 → dissect_target-3.22.dev16}/dissect/target/plugins/os/unix/log/auth.py

@@ -12,6 +12,7 @@ from typing import Any, Iterator
 from dissect.target import Target
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import DynamicDescriptor, TargetRecordDescriptor
+from dissect.target.helpers.regex.ipaddress import extract_ips
 from dissect.target.helpers.utils import year_rollover_helper
 from dissect.target.plugin import Plugin, alias, export
 from dissect.target.plugins.os.unix.log.helpers import (
@@ -23,15 +24,6 @@ from dissect.target.plugins.os.unix.log.helpers import (
 
 log = logging.getLogger(__name__)
 
-
-# Generic regular expressions
-RE_IPV4_ADDRESS = re.compile(
-    r"""
-    ((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}   # First three octets
-    (25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)          # Last octet
-    """,
-    re.VERBOSE,
-)
 RE_USER = re.compile(r"for ([^\s]+)")
 
 
@@ -78,9 +70,14 @@ class SshdService(BaseService):
     def parse(cls, message: str) -> dict[str, str | int]:
         """Parse message from sshd"""
         additional_fields = {}
-        if ip_address := RE_IPV4_ADDRESS.search(message):
+        if ip_address := extract_ips(message):
             field_name = "host_ip" if "listening" in message else "remote_ip"
-            additional_fields[field_name] = ip_address.group(0)
+
+            if len(ip_address) > 1:
+                field_name += "s"
+
+            additional_fields[field_name] = ip_address[0] if len(ip_address) == 1 else ip_address
+
         if port := cls.RE_SSHD_PORTREGEX.search(message):
             additional_fields["port"] = int(port.group(1))
         if user := cls.RE_USER.search(message):
@@ -279,9 +276,16 @@ class AuthLogRecordBuilder:
 
         for key, value in self._parse_additional_fields(record_values["service"], line).items():
             record_type = "string"
+
             if isinstance(value, int):
                 record_type = "varint"
 
+            elif key.startswith(("remote_ip", "host_ip")):
+                record_type = "net.ipaddress"
+
+            if isinstance(value, list):
+                record_type += "[]"
+
             record_fields.append((record_type, key))
             record_values[key] = value
 

{dissect_target-3.22.dev14 → dissect_target-3.22.dev16/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.22.dev14
+Version: 3.22.dev16
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.22.dev14 → dissect_target-3.22.dev16}/dissect.target.egg-info/SOURCES.txt

@@ -93,6 +93,8 @@ dissect/target/helpers/nfs/serializer.py
 dissect/target/helpers/nfs/client/__init__.py
 dissect/target/helpers/nfs/client/mount.py
 dissect/target/helpers/nfs/client/nfs.py
+dissect/target/helpers/regex/__init__.py
+dissect/target/helpers/regex/ipaddress.py
 dissect/target/helpers/sunrpc/__init__.py
 dissect/target/helpers/sunrpc/client.py
 dissect/target/helpers/sunrpc/serializer.py
@@ -470,6 +472,7 @@ tests/helpers/test_localeutil.py
 tests/helpers/test_modifier.py
 tests/helpers/test_protobuf.py
 tests/helpers/test_record.py
+tests/helpers/test_regex.py
 tests/helpers/test_regutil.py
 tests/helpers/test_scrape.py
 tests/helpers/test_utils.py

dissect_target-3.22.dev16/tests/helpers/test_regex.py

@@ -0,0 +1,87 @@
+from __future__ import annotations
+
+import pytest
+
+from dissect.target.helpers.regex.ipaddress import extract_ips
+
+
+@pytest.mark.parametrize(
+    "input_ip, expected_output",
+    [
+        # Correct ipv6 addresses
+        ("1::", "1::"),
+        ("1:2:3:4:5:6:7::", "1:2:3:4:5:6:7::"),
+        ("1::8", "1::8"),
+        ("1:2:3:4:5:6::8", "1:2:3:4:5:6::8"),
+        ("1::7:8", "1::7:8"),
+        ("1:2:3:4:5::7:8", "1:2:3:4:5::7:8"),
+        ("1:2:3:4:5::8", "1:2:3:4:5::8"),
+        ("1::6:7:8", "1::6:7:8"),
+        ("1:2:3:4::6:7:8", "1:2:3:4::6:7:8"),
+        ("1:2:3:4::8", "1:2:3:4::8"),
+        ("1::5:6:7:8", "1::5:6:7:8"),
+        ("1:2:3::5:6:7:8", "1:2:3::5:6:7:8"),
+        ("1:2:3::8", "1:2:3::8"),
+        ("1::4:5:6:7:8", "1::4:5:6:7:8"),
+        ("1:2::4:5:6:7:8", "1:2::4:5:6:7:8"),
+        ("1:2::8", "1:2::8"),
+        ("1::3:4:5:6:7:8", "1::3:4:5:6:7:8"),
+        ("::2:3:4:5:6:7:8", "::2:3:4:5:6:7:8"),
+        ("::8", "::8"),
+        ("::", "::"),
+        ("fe80::7:8%eth0", "fe80::7:8%eth0"),
+        ("fe80::7:8%1", "fe80::7:8%1"),
+        ("::255.255.255.255", "::255.255.255.255"),
+        ("::ffff:255.255.255.255", "::ffff:255.255.255.255"),
+        ("::FFFF:255.255.255.255", "::FFFF:255.255.255.255"),
+        ("::ffff:0:255.255.255.255", "::ffff:0:255.255.255.255"),
+        ("2001:db8:3:4::192.0.2.33", "2001:db8:3:4::192.0.2.33"),
+        ("64:ff9b::192.0.2.33", "64:ff9b::192.0.2.33"),
+        ("0:0:0:0:0:0:10.0.0.1", "0:0:0:0:0:0:10.0.0.1"),
+        ("2001:db8:3:4::192.256.2.33", "2001:db8:3:4::192"),
+        # Correct ipv4 addresses
+        ("1.2.3.4", "1.2.3.4"),
+        ("192.168.0.0/24", "192.168.0.0/24"),
+        ("10.0.0.0/32", "10.0.0.0/32"),
+        # Private IP address ranges
+        ("0.0.0.0/8", "0.0.0.0/8"),
+        ("10.0.0.0/16", "10.0.0.0/16"),
+        ("127.0.0.0/8", "127.0.0.0/8"),
+        ("169.254.0.0/16", "169.254.0.0/16"),
+        ("172.16.0.0/12", "172.16.0.0/12"),
+        ("192.0.0.170/31", "192.0.0.170/31"),
+        ("192.0.2.0/24", "192.0.2.0/24"),
+        ("192.168.0.0/16", "192.168.0.0/16"),
+        ("192.18.0.0/15", "192.18.0.0/15"),
+        ("192.51.100.0/24", "192.51.100.0/24"),
+        ("203.0.113.0/24", "203.0.113.0/24"),
+        ("240.0.0.0/4", "240.0.0.0/4"),
+        ("255.255.255.255/32", "255.255.255.255/32"),
+        # Valid but unlikely addresses
+        ("1.02.34.56", None),
+        ("1.002.34.56", None),
+        ("010.010.010.010", None),
+        ("10.0.001.001", None),
+        # Bad addresses
+        ("256.256.255.255", None),
+        ("10.65.0.456", "10.65.0.45"),
+        ("910.12.34.569", "10.12.34.56"),
+        ("999.1.1.1/30", "99.1.1.1/30"),
+        ("10.13.999.0/32", None),
+        ("1.2.03.4", None),
+        ("1.2.00.4", None),
+        # Dates
+        ("2025.08.31", None),  # best notation
+        ("31.08.25", None),  # sane notation
+        ("08.31.25", None),  # freedom units
+        # Time notation
+        ("2025-08-31T13:37:12.345678", None),
+        ("the time is 15:00 right now.", None),
+        ("to be exact, it is 15:00:01 at the moment.", None),
+    ],
+)
+def test_ip_regexes(input_ip: str, expected_output: str | None) -> None:
+    if expected_output is None:
+        assert extract_ips(input_ip) == []
+    else:
+        assert extract_ips(input_ip) == [expected_output]

{dissect_target-3.22.dev14 → dissect_target-3.22.dev16}/tests/plugins/apps/shell/test_powershell.py

@@ -31,4 +31,5 @@ def test_plugins_os_windows_powershell(target, fs, target_file, request):
 
     assert len(records) == 4
     assert records[0].command == 'Write-Host "Hello World!"'
+    assert records[0].order == 0
     assert str(records[0].source) == target_file

{dissect_target-3.22.dev14 → dissect_target-3.22.dev16}/tests/plugins/os/unix/bsd/citrix/test_history.py

@@ -27,11 +27,13 @@ def test_netscaler_bash_history_absolute_path_glob(target_citrix: Target, fs_bsd
     # year from the file's mtime, which in this mocked version is epoch 0 (thus the year 1970)
     assert results[1].ts == datetime.datetime(1970, 8, 9, 12, 56, 0, tzinfo=datetime.timezone.utc)
     assert results[1].command == "find . -name '*ci.php*'"
+    assert results[1].order == -1
     assert results[1].shell == "citrix-netscaler-bash"
     assert results[1].source.as_posix() == "/var/log/bash.log"
 
     assert results[0].ts == datetime.datetime(1970, 8, 10, 11, 57, 39, tzinfo=datetime.timezone.utc)
     assert results[0].command == 'debug "hello world"'
+    assert results[0].order == 0
     assert results[0].shell == "citrix-netscaler-bash"
     assert results[0].source.as_posix() == "/var/log/bash.log"
 
@@ -54,11 +56,13 @@ def test_netscaler_commandhistory_decompress(target_citrix: Target, fs_bsd: Virt
     # Due to the usage of year_rollover_history, the results are returned back-to-front
     assert results[1].ts == datetime.datetime(1970, 8, 9, 12, 56, 0, tzinfo=datetime.timezone.utc)
     assert results[1].command == "find . -name '*ci.php*'"
+    assert results[1].order == -1
     assert results[1].shell == "citrix-netscaler-bash"
     assert results[1].source.as_posix() == "/var/log/bash.log.0.gz"
 
     assert results[0].ts == datetime.datetime(1970, 8, 10, 11, 57, 39, tzinfo=datetime.timezone.utc)
     assert results[0].command == 'debug "hello world"'
+    assert results[0].order == 0
     assert results[0].shell == "citrix-netscaler-bash"
     assert results[0].source.as_posix() == "/var/log/bash.log.0.gz"
 
@@ -79,10 +83,12 @@ def test_netscaler_cli_history(target_citrix: Target, fs_bsd: VirtualFilesystem)
 
     assert not results[0].ts
     assert results[0].command == "help"
+    assert results[0].order == 0
     assert results[0].shell == "citrix-netscaler-cli"
     assert results[0].source.as_posix() == "/var/nstmp/user/.nscli_history"
 
     assert not results[1].ts
     assert results[1].command == "shell"
+    assert results[1].order == 1
     assert results[1].shell == "citrix-netscaler-cli"
     assert results[1].source.as_posix() == "/var/nstmp/user/.nscli_history"

{dissect_target-3.22.dev14 → dissect_target-3.22.dev16}/tests/plugins/os/unix/log/test_auth.py

@@ -131,6 +131,15 @@ def test_auth_plugin_year_rollover(target_unix: Target, fs_unix: VirtualFilesyst
             },
             id="sshd: failed password",
         ),
+        pytest.param(
+            "Jun 4 22:14:15 ubuntu-1 sshd[12345]: reverse mapping checking getaddrinfo for some-hostname-with-digits-012.34.56.78.example.com [90.12.34.56] failed - POSSIBLE BREAK-IN ATTEMPT!",  # noqa: E501
+            {
+                "service": "sshd",
+                "pid": 12345,
+                "remote_ips": ["90.12.34.56", "12.34.56.78"],
+            },
+            id="sshd: reverse dns ip addr",
+        ),
         pytest.param(
             "Mar 27 13:08:09 ubuntu-1 sshd[1361]: Accepted publickey for test_user "
             "from 8.8.8.8 port 12345 ssh2: RSA SHA256:123456789asdfghjklertzuio",
@@ -284,10 +293,17 @@ def test_auth_plugin_additional_fields(
     fs_unix.map_file("var/log/auth.log", data_path)
 
     target_unix.add_plugin(AuthPlugin)
-    record = list(target_unix.authlog())[0]
+
+    result = list(target_unix.authlog())
+    assert len(result) == 1
 
     for key, value in results.items():
-        assert getattr(record, key) == value
+        plugin_result = getattr(result[0], key)
+        if isinstance(value, list):
+            value = sorted(map(str, value))
+            plugin_result = sorted(map(str, plugin_result))
+
+        assert plugin_result == value
 
 
 def test_auth_plugin_iso_date_format(target_unix: Target, fs_unix: VirtualFilesystem) -> None:

{dissect_target-3.22.dev14 → dissect_target-3.22.dev16}/tests/plugins/os/unix/test_history.py

@@ -40,21 +40,25 @@ def test_commandhistory_with_timestamps(target_unix_users, fs_unix):
 
     assert results[0].ts == dt("2022-03-29T23:58:59Z")
     assert results[0].command == 'echo "this is a test"'
+    assert results[0].order == 0
     assert results[0].shell == "bash"
     assert results[0].source.as_posix() == "/root/.bash_history"
 
     assert results[1].ts is None
     assert results[1].command == 'echo "O no. A line without timestamp"'
+    assert results[1].order == 1
     assert results[1].shell == "bash"
     assert results[1].source.as_posix() == "/root/.bash_history"
 
     assert results[2].ts == dt("2022-07-23T12:14:28Z")
     assert results[2].command == "exit"
+    assert results[2].order == 2
     assert results[2].shell == "bash"
     assert results[2].source.as_posix() == "/root/.bash_history"
 
     assert results[3].ts is None
     assert results[3].command == 'echo "this for user 2"'
+    assert results[3].order == 0
     assert results[3].shell == "bash"
     assert results[3].source.as_posix() == "/home/user/.bash_history"
 
@@ -77,11 +81,13 @@ def test_commandhistory_without_timestamps(target_unix_users, fs_unix):
 
     assert results[0].ts is None
     assert results[0].command == 'echo "Test if basic commandhistory works" > /dev/null'
+    assert results[0].order == 0
     assert results[0].shell == "zsh"
     assert results[0].source.as_posix() == "/root/.zsh_history"
 
     assert results[1].ts is None
     assert results[1].command == "exit"
+    assert results[1].order == 1
     assert results[1].shell == "zsh"
     assert results[1].source.as_posix() == "/root/.zsh_history"
 
@@ -105,11 +111,13 @@ def test_commandhistory_zsh_history(target_unix_users, fs_unix):
 
     assert results[0].ts == from_unix(1673860722)
     assert results[0].command == "sudo apt install sl"
+    assert results[0].order == 0
     assert results[0].shell == "zsh"
     assert results[0].source.as_posix() == "/root/.zsh_history"
 
     assert not results[1].ts
     assert results[1].command == 'echo "Whoops no timestamps"'
+    assert results[1].order == 1
     assert results[1].shell == "zsh"
     assert results[1].source.as_posix() == "/root/.zsh_history"
 
@@ -138,16 +146,19 @@ def test_commandhistory_fish_history(target_unix_users, fs_unix):
 
     assert results[0].ts == from_unix(1688642435)
     assert results[0].command == "ls"
+    assert results[0].order == 0
     assert results[0].shell == "fish"
     assert results[0].source.as_posix() == "/root/.local/share/fish/fish_history"
 
     assert results[1].ts == from_unix(1688642441)
     assert results[1].command == "cd home/"
+    assert results[1].order == 1
     assert results[1].shell == "fish"
     assert results[1].source.as_posix() == "/root/.local/share/fish/fish_history"
 
     assert results[2].ts == from_unix(1688986629)
     assert results[2].command == 'echo "test: test"'
+    assert results[2].order == 2
     assert results[2].shell == "fish"
     assert results[2].source.as_posix() == "/root/.local/share/fish/fish_history"
 
@@ -214,6 +225,7 @@ def test_commandhistory_database_history(target_unix_users, fs_unix, db_type, db
     for i, line in enumerate(history_lines):
         assert results[i].ts is None
         assert results[i].command == line
+        assert results[i].order == i
         assert results[i].shell == db_type
         assert results[i].source.as_posix() == f"/root/{db_file}"
 
@@ -233,5 +245,6 @@ def test_commandhistory_is_directory(target_unix_users: Target, fs_unix: Virtual
 
     assert results[0].ts is None
     assert results[0].command == "test"
+    assert results[0].order == 0
     assert results[0].shell == "zsh"
     assert results[0].source.as_posix() == "/root/.zsh_history"