dissect.target 3.23.2.dev23__tar.gz → 3.23.2.dev24__tar.gz

{dissect_target-3.23.2.dev23 → dissect_target-3.23.2.dev24}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.2.dev23
+Version: 3.23.2.dev24
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{dissect_target-3.23.2.dev23 → dissect_target-3.23.2.dev24}/dissect/target/plugins/apps/ssh/openssh.py

@@ -22,6 +22,7 @@ if TYPE_CHECKING:
     from pathlib import Path
 
     from dissect.target.helpers.fsutil import TargetPath
+    from dissect.target.plugins.general.users import UserDetails
     from dissect.target.target import Target
 
 
@@ -55,16 +56,18 @@ class OpenSSHPlugin(SSHPlugin):
         if not ssh_user_dirs and not self.sshd_directory.exists():
             raise UnsupportedPluginError("No OpenSSH directories found")
 
-    def ssh_directory_globs(self, glob_user: str, glob_sshd: str) -> list[tuple[str, TargetPath]]:
+    def ssh_directory_globs(self, glob_user: str, glob_sshd: str) -> Iterator[tuple[UserDetails | None, TargetPath]]:
         for user_details in self.target.user_details.all_with_home():
-            yield from product([user_details.user], user_details.home_path.glob(f".ssh/{glob_user}"))
+            yield from product([user_details], user_details.home_path.glob(f".ssh/{glob_user}"))
 
         yield from product([None], self.sshd_directory.glob(glob_sshd))
 
     @export(record=AuthorizedKeysRecord)
     def authorized_keys(self) -> Iterator[AuthorizedKeysRecord]:
         """Yields the content of the authorized_keys files on a target for each user."""
-        for user, authorized_keys_file in self.ssh_directory_globs("authorized_keys*", "administrator_authorized_keys"):
+        for user_details, authorized_keys_file in self.ssh_directory_globs(
+            "authorized_keys*", "administrator_authorized_keys"
+        ):
             for line in authorized_keys_file.open("rt"):
                 line = line.strip()
                 if not line or line.startswith("#"):
@@ -82,14 +85,14 @@ class OpenSSHPlugin(SSHPlugin):
                     options=options,
                     path=authorized_keys_file,
                     _target=self.target,
-                    _user=user,
+                    _user=user_details.user if user_details else None,
                 )
 
     @export(record=KnownHostRecord)
     def known_hosts(self) -> Iterator[KnownHostRecord]:
         """Yields the content of the known_hosts files on a target for each user."""
 
-        for user, known_hosts_file in self.ssh_directory_globs("known_hosts*", "ssh_known_hosts"):
+        for user_details, known_hosts_file in self.ssh_directory_globs("known_hosts*", "ssh_known_hosts"):
             for line in known_hosts_file.open("rt"):
                 line = line.strip()
                 if not line or line.startswith("#"):
@@ -110,14 +113,14 @@ class OpenSSHPlugin(SSHPlugin):
                         marker=marker,
                         path=known_hosts_file,
                         _target=self.target,
-                        _user=user,
+                        _user=user_details.user if user_details else None,
                     )
 
     @export(record=PrivateKeyRecord)
     def private_keys(self) -> Iterator[PrivateKeyRecord]:
         """Yields OpenSSH private keys on a target for each user."""
 
-        for user, file_path in self.ssh_directory_globs("*", "*"):
+        for user_details, file_path in self.ssh_directory_globs("*", "*"):
             if not file_path.is_file():
                 continue
 
@@ -128,7 +131,7 @@ class OpenSSHPlugin(SSHPlugin):
             try:
                 private_key = SSHPrivateKey(buffer)
             except ValueError as e:
-                self.target.log.warning("Failed to parse SSH private key: %s", file_path)
+                self.target.log.warning("Failed to parse SSH private key %s: %s", file_path, e)
                 self.target.log.debug("", exc_info=e)
                 continue
 
@@ -141,19 +144,24 @@ class OpenSSHPlugin(SSHPlugin):
                 encrypted=private_key.is_encrypted,
                 path=file_path,
                 _target=self.target,
-                _user=user,
+                _user=user_details.user if user_details else None,
             )
 
     @export(record=PublicKeyRecord)
     def public_keys(self) -> Iterator[PublicKeyRecord]:
         """Yields all OpenSSH public keys from all user home directories and the OpenSSH daemon directory."""
 
-        for user, file_path in self.ssh_directory_globs("*.pub", "*.pub"):
+        for user_details, file_path in self.ssh_directory_globs("*.pub", "*.pub"):
             if not file_path.is_file():
                 continue
 
-            key_type, public_key, comment = parse_ssh_public_key_file(file_path)
-            fingerprints = calculate_fingerprints(base64.b64decode(public_key))
+            try:
+                key_type, public_key, comment = parse_ssh_public_key_file(file_path)
+                fingerprints = calculate_fingerprints(base64.b64decode(public_key))
+            except Exception as e:
+                self.target.log.warning("Failed to parse SSH public key %s: %s", file_path, e)
+                self.target.log.debug("", exc_info=e)
+                continue
 
             yield PublicKeyRecord(
                 mtime_ts=file_path.stat().st_mtime,
@@ -163,16 +171,16 @@ class OpenSSHPlugin(SSHPlugin):
                 fingerprint=fingerprints,
                 path=file_path,
                 _target=self.target,
-                _user=user,
+                _user=user_details.user if user_details else None,
             )
 
 
-def parse_ssh_public_key_file(path: Path) -> tuple[str, str, str]:
+def parse_ssh_public_key_file(path: Path) -> tuple[str | None, str, str]:
     _, key_type, public_key, comment = parse_ssh_key(path.read_text().strip())
     return key_type, public_key, comment
 
 
-def parse_ssh_key(key_string: str) -> tuple[str, str, str, str]:
+def parse_ssh_key(key_string: str) -> tuple[str | None, str, str, str]:
     parts = re.findall(r'(?:[^\s,"]|"(?:\\.|[^"])*")+', key_string)
 
     options = None
@@ -188,7 +196,7 @@ def parse_ssh_key(key_string: str) -> tuple[str, str, str, str]:
     return options, keytype, public_key, comment
 
 
-def parse_known_host(known_host_string: str) -> tuple[str, list, str, str, str]:
+def parse_known_host(known_host_string: str) -> tuple[str | None, list, str, str, str]:
     parts = known_host_string.split()
 
     marker = None

{dissect_target-3.23.2.dev23 → dissect_target-3.23.2.dev24}/dissect/target/plugins/apps/ssh/putty.py

@@ -117,7 +117,12 @@ class PuTTYPlugin(SSHPlugin):
             key_type, host = entry.name.split("@")
             port, host = host.split(":")
 
-            public_key, fingerprints = construct_public_key(key_type, entry.value)
+            try:
+                public_key, fingerprints = construct_public_key(key_type, entry.value)
+            except Exception as e:
+                self.target.log.warning("Failed to parse PuTTY public key %r in registry %s: %s", entry.value, entry, e)
+                self.target.log.debug("", exc_info=e)
+                continue
 
             yield KnownHostRecord(
                 mtime_ts=ssh_host_keys.ts,
@@ -145,7 +150,14 @@ class PuTTYPlugin(SSHPlugin):
                 key_type, host = parts[0].split("@")
                 port, host = host.split(":")
 
-                public_key, fingerprints = construct_public_key(key_type, parts[1])
+                try:
+                    public_key, fingerprints = construct_public_key(key_type, parts[1])
+                except Exception as e:
+                    self.target.log.warning(
+                        "Failed to parse PuTTY public key %r in file %s: %s", line, ssh_host_keys_path, e
+                    )
+                    self.target.log.debug("", exc_info=e)
+                    continue
 
                 yield KnownHostRecord(
                     mtime_ts=ts,
@@ -195,7 +207,7 @@ class PuTTYPlugin(SSHPlugin):
 
     def _build_session_record(
         self, ts: float, name: float | datetime, source: Path, cfg: dict, user_details: UserDetails
-    ) -> PuTTYSessionRecord:
+    ) -> Iterator[PuTTYSessionRecord]:
         host, user = parse_host_user(cfg.get("HostName"), cfg.get("UserName"))
 
         yield PuTTYSessionRecord(
@@ -224,7 +236,7 @@ def parse_host_user(host: str, user: str) -> tuple[str, str]:
     return host, user
 
 
-def construct_public_key(key_type: str, iv: str) -> tuple[str, tuple[str, str, str]]:
+def construct_public_key(key_type: str, iv: str) -> tuple[str, tuple[str | None, str | None, str | None]]:
     """Returns OpenSSH format public key calculated from PuTTY SshHostKeys format and set of fingerprints.
 
     PuTTY stores raw public key components instead of OpenSSH-formatted public keys

{dissect_target-3.23.2.dev23 → dissect_target-3.23.2.dev24}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.2.dev23
+Version: 3.23.2.dev24
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later