dissect.target 3.23.2.dev24__tar.gz → 3.23.2.dev26__tar.gz

{dissect_target-3.23.2.dev24 → dissect_target-3.23.2.dev26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.2.dev24
+Version: 3.23.2.dev26
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

dissect_target-3.23.2.dev26/dissect/target/plugins/apps/virtualization/vmware_workstation.py

@@ -0,0 +1,163 @@
+from __future__ import annotations
+
+from collections import defaultdict
+from typing import TYPE_CHECKING, Any
+
+from dissect.hypervisor.descriptor.vmx import VMX
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
+from dissect.target.helpers.record import create_extended_descriptor
+from dissect.target.plugin import Plugin, alias, export
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+    from pathlib import Path
+
+    from dissect.target.plugins.general.users import UserDetails
+    from dissect.target.target import Target
+
+VmwareDragAndDropRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
+    "virtualization/vmware/clipboard",
+    [
+        ("datetime", "ts"),
+        ("path", "path"),
+    ],
+)
+
+VmwareVirtualMachineRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
+    "virtualization/vmware/vm",
+    [
+        ("datetime", "ts"),
+        ("string", "name"),
+        ("boolean", "is_clone"),
+        ("boolean", "is_favorite"),
+        ("string", "state"),
+        ("string", "uuid"),
+        ("string", "annotation"),
+        ("string[]", "mac_addresses"),
+        ("path[]", "disks"),
+        ("path[]", "sources"),
+    ],
+)
+
+
+INVENTORY_PATHS = [
+    # Windows
+    "AppData/Roaming/VMware/inventory.vmls",
+    # Linux
+    ".vmware/inventory.vmls",
+    # macOS (Fusion)
+    "Library/Application Support/VMware Fusion/vmInventory",
+]
+
+
+DND_PATHS = [
+    # Windows
+    "AppData/Local/Temp/VmwareDND",
+    # Linux
+    ".cache/vmware/drag_and_drop",
+]
+
+
+class VmwareWorkstationPlugin(Plugin):
+    """VMware Workstation plugin."""
+
+    __namespace__ = "vmware"
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self.inventories = list(find_vm_inventory(self.target))
+        self.dnd_dirs = list(self.find_dnd_dirs())
+
+    def check_compatible(self) -> None:
+        if not self.dnd_dirs and not self.inventories:
+            raise UnsupportedPluginError("No VMware Workstation artifact(s) found")
+
+    def find_dnd_dirs(self) -> Iterator[tuple[UserDetails, Path]]:
+        for user_details in self.target.user_details.all_with_home():
+            for dnd_path in DND_PATHS:
+                if (dnd_dir := user_details.home_path.joinpath(dnd_path)).exists():
+                    yield user_details, dnd_dir
+
+    @alias("draganddrop")
+    @export(record=VmwareDragAndDropRecord)
+    def clipboard(self) -> Iterator[VmwareDragAndDropRecord]:
+        """Yield cached VMware Workstation drag-and-drop file artifacts."""
+
+        for user_details, dnd_dir in self.dnd_dirs:
+            for file in dnd_dir.rglob("*/*"):
+                if file.is_dir():
+                    continue
+
+                yield VmwareDragAndDropRecord(
+                    ts=file.lstat().st_mtime,
+                    path=file,
+                    _user=user_details.user,
+                    _target=self.target,
+                )
+
+    @export(record=VmwareVirtualMachineRecord)
+    def config(self) -> Iterator[VmwareVirtualMachineRecord]:
+        """Yield VMware Workstation Virtual Machine inventory configurations.
+
+        Parses ``inventory.vmls`` and ``.vmx`` descriptor files. Does not parse newer ``.vmxf`` XML files.
+        Does not support older ``vmAutoStart.xml`` or ``vmInventory.xml`` formats.
+
+        References:
+            - https://sanbarrow.com/vmx/vmx-network-advanced.html
+        """
+
+        for inventory, user_details in self.inventories:
+            for config in parse_inventory_file(inventory).values():
+                vmx_config = {}
+
+                if (vmx_path := self.target.fs.path(config.get("config"))).exists():
+                    vmx = VMX.parse(vmx_path.read_text())
+                    vmx_config = vmx.attr
+
+                yield VmwareVirtualMachineRecord(
+                    ts=vmx_path.lstat().st_mtime if vmx_config else inventory.lstat().st_mtime,
+                    # Inventory config fields
+                    name=config.get("DisplayName"),
+                    is_clone=config.get("IsClone", "").lower() == "true",
+                    is_favorite=config.get("IsFavorite", "").lower() == "true",
+                    state=config.get("State"),
+                    uuid=config.get("UUID").replace(" ", ""),
+                    # VMX config fields
+                    annotation=vmx_config.get("annotation"),
+                    mac_addresses={v for k, v in vmx_config.items() if k.endswith(("generatedAddress", "address"))},
+                    disks=vmx.disks(),
+                    # Metadata
+                    sources=[inventory, vmx_path],
+                    _user=user_details.user if user_details else None,
+                    _target=self.target,
+                )
+
+
+def find_vm_inventory(target: Target) -> Iterator[tuple[Path, UserDetails]]:
+    """Search for ``inventory.vmls`` files in user home folders."""
+
+    for user_details in target.user_details.all_with_home():
+        for inv_path in INVENTORY_PATHS:
+            if (inv_file := user_details.home_path.joinpath(inv_path)).exists():
+                yield inv_file, user_details
+
+
+def parse_inventory_file(inventory: Path) -> dict[str, Any] | None:
+    """Parse a single ``inventory.vmls`` (Windows, Linux) or ``vmInventory`` (macOS) file."""
+
+    config = defaultdict(dict)
+    with inventory.open("rt") as fh:
+        for line in map(str.strip, fh):
+            if not line or line.startswith("."):
+                continue
+            full_key, value = map(str.strip, line.split("=", 1))
+            vm, key = full_key.split(".", 1)
+
+            # Only process vmlist entries, not index entries
+            if "vmlist" not in vm:
+                continue
+
+            config[vm][key] = value.strip('"')
+        return config

{dissect_target-3.23.2.dev24 → dissect_target-3.23.2.dev26}/dissect/target/plugins/apps/webserver/iis.py

@@ -81,7 +81,7 @@ class IISLogsPlugin(WebserverPlugin):
         self.config = self.target.resolve(self.APPLICATION_HOST_CONFIG)
 
     def check_compatible(self) -> None:
-        if not self.log_dirs:
+        if not any(self.log_dirs.values()):
             raise UnsupportedPluginError("No IIS log files found")
 
     @cached_property

dissect_target-3.23.2.dev26/dissect/target/plugins/child/vmware_workstation.py

@@ -0,0 +1,39 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.record import ChildTargetRecord
+from dissect.target.plugin import ChildTargetPlugin
+from dissect.target.plugins.apps.virtualization.vmware_workstation import find_vm_inventory, parse_inventory_file
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+    from dissect.target.target import Target
+
+
+class VmwareWorkstationChildTargetPlugin(ChildTargetPlugin):
+    """Child target plugin that yields from VMware Workstation VM inventory."""
+
+    __type__ = "vmware_workstation"
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self.inventories = [inventory for inventory, _ in find_vm_inventory(target)]
+
+    def check_compatible(self) -> None:
+        if not self.inventories:
+            raise UnsupportedPluginError("No VMWare Workstation inventories found")
+
+    def list_children(self) -> Iterator[ChildTargetRecord]:
+        for inv in self.inventories:
+            inventory = parse_inventory_file(inv)
+
+            for config in inventory.values():
+                yield ChildTargetRecord(
+                    type=self.__type__,
+                    name=config.get("DisplayName"),
+                    path=config.get("config"),
+                    _target=self.target,
+                )

{dissect_target-3.23.2.dev24 → dissect_target-3.23.2.dev26}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.2.dev24
+Version: 3.23.2.dev26
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

dissect_target-3.23.2.dev26/tests/plugins/apps/virtualization/test_vmware_workstation.py

@@ -0,0 +1,97 @@
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from typing import TYPE_CHECKING
+
+import pytest
+
+from dissect.target.plugins.apps.virtualization.vmware_workstation import (
+    VmwareWorkstationPlugin,
+)
+from tests._utils import absolute_path
+
+if TYPE_CHECKING:
+    from dissect.target.filesystem import VirtualFilesystem
+    from dissect.target.target import Target
+
+
+@pytest.mark.parametrize(
+    ("target", "fs", "dnd_path"),
+    [
+        pytest.param("target_win_users", "fs_win", "Users\\John\\AppData\\Local\\Temp\\VmwareDND", id="windows"),
+        pytest.param("target_unix_users", "fs_unix", "/home/user/.cache/vmware/drag_and_drop", id="linux"),
+    ],
+)
+def test_vmware_workstation_clipboard_dnd(
+    target: Target, fs: VirtualFilesystem, dnd_path: str, request: pytest.FixtureRequest
+) -> None:
+    """Test if we correctly detect drag and drop artifacts on Windows and Unix targets."""
+
+    target = request.getfixturevalue(target)
+    fs = request.getfixturevalue(fs)
+    fs.map_dir_from_tar(dnd_path, absolute_path("_data/plugins/apps/virtualization/vmware_workstation/dnd.tar"))
+    target.add_plugin(VmwareWorkstationPlugin)
+    results = sorted(target.vmware.clipboard(), key=lambda r: r.path)
+    dnd_path = dnd_path.replace("\\", "/")
+
+    assert len(results) == 3
+    assert [str(r.path).replace("C:\\", "").replace("\\", "/") for r in results] == [
+        f"{dnd_path}/8lkBf1/wachter.jpg",
+        f"{dnd_path}/iUpQHG/credentials.txt",
+        f"{dnd_path}/x1G9fJ/example.txt",
+    ]
+    assert results[0].ts == datetime(2024, 9, 18, 11, 16, 44, tzinfo=timezone.utc)
+
+
+@pytest.mark.parametrize(
+    ("target", "fs", "inventory_dir"),
+    [
+        pytest.param(
+            "target_win_users",
+            "fs_win",
+            "Users\\John\\AppData\\Roaming\\VMware\\inventory.vmls",
+            id="windows",
+        ),
+        pytest.param(
+            "target_unix_users",
+            "fs_unix",
+            "/home/user/.vmware/inventory.vmls",
+            id="linux",
+        ),
+    ],
+)
+def test_vmware_workstation_vm_configs(
+    target: Target, fs: VirtualFilesystem, inventory_dir: str, request: pytest.FixtureRequest
+) -> None:
+    """Test if we find and parse VM configuration files correctly."""
+
+    target = request.getfixturevalue(target)
+    fs = request.getfixturevalue(fs)
+    fs.map_file(
+        inventory_dir,
+        str(absolute_path(f"_data/plugins/apps/virtualization/vmware_workstation/inventory-{target.os}.vmls")),
+    )
+    fs.map_file(
+        "first.vmx" if target.os == "windows" else "/path/to/first.vmx",
+        str(absolute_path("_data/plugins/apps/virtualization/vmware_workstation/first.vmx")),
+    )
+
+    target.add_plugin(VmwareWorkstationPlugin)
+
+    records = list(target.vmware.config())
+
+    assert len(records) == 3
+
+    assert records[0].ts
+    assert records[0].name == "First Virtual Machine"
+    assert not records[0].is_clone
+    assert not records[0].is_favorite
+    assert records[0].state == "normal"
+    assert records[0].uuid == "41cca13579fa4366abef2582d21a0c20"
+    assert records[0].annotation == "This is an example annotation."
+    assert records[0].mac_addresses == ["00:0C:29:12:34:56"]
+    assert records[0].disks == ["First Virtual Machine.vmdk"]
+    assert records[0].sources in (
+        ["C:\\Users\\John\\AppData\\Roaming\\VMware\\inventory.vmls", "sysvol\\first.vmx"],
+        ["/home/user/.vmware/inventory.vmls", "/path/to/first.vmx"],
+    )

{dissect_target-3.23.2.dev24 → dissect_target-3.23.2.dev26}/tests/plugins/child/test_vmware_workstation.py

@@ -15,19 +15,35 @@ if TYPE_CHECKING:
 
 
 @pytest.mark.parametrize(
-    ("target", "fs", "inventory_path"),
+    ("target_fixture", "fs_fixture", "inventory_path"),
     [
-        ("target_win_users", "fs_win", "Users\\John\\AppData\\Roaming\\VMware\\inventory.vmls"),
-        ("target_unix_users", "fs_unix", "/home/user/.vmware/inventory.vmls"),
+        pytest.param(
+            "target_win_users",
+            "fs_win",
+            "Users\\John\\AppData\\Roaming\\VMware\\inventory.vmls",
+            id="windows",
+        ),
+        pytest.param(
+            "target_unix_users",
+            "fs_unix",
+            "/home/user/.vmware/inventory.vmls",
+            id="linux",
+        ),
+        pytest.param(
+            "target_macos_users",
+            "fs_macos",
+            "/Users/dissect/Library/Application Support/VMware Fusion/vmInventory",
+            id="macos",
+        ),
     ],
 )
 def test_child_vmware_workstation(
-    target: Target, fs: VirtualFilesystem, inventory_path: str, request: pytest.FixtureRequest
+    target_fixture: str, fs_fixture: str, inventory_path: str, request: pytest.FixtureRequest
 ) -> None:
     """Test if we detect VMware Workstation children from inventory files correctly on Windows and Unix targets."""
 
-    target = request.getfixturevalue(target)
-    fs = request.getfixturevalue(fs)
+    target: Target = request.getfixturevalue(target_fixture)
+    fs: VirtualFilesystem = request.getfixturevalue(fs_fixture)
 
     fs.map_file(inventory_path, absolute_path("_data/plugins/child/vmware_workstation/inventory.vmls"))
 

dissect_target-3.23.2.dev24/dissect/target/plugins/apps/virtualization/vmware_workstation.py

@@ -1,67 +0,0 @@
-from __future__ import annotations
-
-from typing import TYPE_CHECKING
-
-from dissect.target.exceptions import UnsupportedPluginError
-from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
-from dissect.target.helpers.record import create_extended_descriptor
-from dissect.target.plugin import Plugin, alias, export
-
-if TYPE_CHECKING:
-    from collections.abc import Iterator
-
-    from dissect.target.helpers.fsutil import TargetPath
-    from dissect.target.plugins.general.users import UserDetails
-    from dissect.target.target import Target
-
-VmwareDragAndDropRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
-    "virtualization/vmware/clipboard",
-    [
-        ("datetime", "ts"),
-        ("path", "path"),
-    ],
-)
-
-VMWARE_DND_PATHS = [
-    # Windows
-    "AppData/Local/Temp/VmwareDND",
-    # Linux
-    ".cache/vmware/drag_and_drop",
-]
-
-
-class VmwareWorkstationPlugin(Plugin):
-    """VMware Workstation plugin."""
-
-    __namespace__ = "vmware"
-
-    def __init__(self, target: Target):
-        super().__init__(target)
-        self.dnd_dirs = list(self.find_dnd_dirs())
-
-    def check_compatible(self) -> None:
-        if not self.dnd_dirs:
-            raise UnsupportedPluginError("No VMware Workstation DnD artifact(s) found")
-
-    def find_dnd_dirs(self) -> Iterator[tuple[UserDetails, TargetPath]]:
-        for user_details in self.target.user_details.all_with_home():
-            for dnd_path in VMWARE_DND_PATHS:
-                if (dnd_dir := user_details.home_path.joinpath(dnd_path)).exists():
-                    yield user_details, dnd_dir
-
-    @alias("draganddrop")
-    @export(record=VmwareDragAndDropRecord)
-    def clipboard(self) -> Iterator[VmwareDragAndDropRecord]:
-        """Yield cached VMware Workstation drag-and-drop file artifacts."""
-
-        for user_details, dnd_dir in self.dnd_dirs:
-            for file in dnd_dir.rglob("*/*"):
-                if file.is_dir():
-                    continue
-
-                yield VmwareDragAndDropRecord(
-                    ts=file.lstat().st_mtime,
-                    path=file,
-                    _user=user_details.user,
-                    _target=self.target,
-                )

dissect_target-3.23.2.dev24/dissect/target/plugins/child/vmware_workstation.py

@@ -1,78 +0,0 @@
-from __future__ import annotations
-
-from typing import TYPE_CHECKING
-
-from dissect.target.exceptions import UnsupportedPluginError
-from dissect.target.helpers.record import ChildTargetRecord
-from dissect.target.plugin import ChildTargetPlugin
-
-if TYPE_CHECKING:
-    from collections.abc import Iterator
-    from pathlib import Path
-
-    from dissect.target.helpers.fsutil import TargetPath
-    from dissect.target.target import Target
-
-INVENTORY_PATHS = [
-    # Windows
-    "AppData/Roaming/VMware/inventory.vmls",
-    # Linux
-    ".vmware/inventory.vmls",
-]
-
-
-def find_vm_inventory(target: Target) -> Iterator[TargetPath]:
-    """Search for inventory.vmls files in user home folders.
-
-    Does not support older vmAutoStart.xml or vmInventory.xml formats."""
-
-    for user_details in target.user_details.all_with_home():
-        for inv_path in INVENTORY_PATHS:
-            if (inv_file := user_details.home_path.joinpath(inv_path)).exists():
-                yield inv_file
-
-
-def parse_vm_inventory(path: Path) -> dict[str, dict[str, str]]:
-    config = {}
-
-    with path.open("rt") as fh:
-        for line in fh:
-            if not (line := line.strip()) or line.startswith("."):
-                continue
-
-            full_key, value = line.split("=", 1)
-            vm, key = full_key.strip().split(".", 1)
-
-            # Only process vmlist entries, not index entries
-            if "vmlist" not in vm:
-                continue
-
-            config.setdefault(vm, {})[key] = value.strip().strip('"')
-
-    return config
-
-
-class VmwareWorkstationChildTargetPlugin(ChildTargetPlugin):
-    """Child target plugin that yields from VMware Workstation VM inventory."""
-
-    __type__ = "vmware_workstation"
-
-    def __init__(self, target: Target):
-        super().__init__(target)
-        self.inventories = list(find_vm_inventory(target))
-
-    def check_compatible(self) -> None:
-        if not self.inventories:
-            raise UnsupportedPluginError("No VMWare inventories found")
-
-    def list_children(self) -> Iterator[ChildTargetRecord]:
-        for inv in self.inventories:
-            inventory = parse_vm_inventory(inv)
-
-            for config in inventory.values():
-                yield ChildTargetRecord(
-                    type=self.__type__,
-                    name=config.get("DisplayName"),
-                    path=config.get("config"),
-                    _target=self.target,
-                )

dissect_target-3.23.2.dev24/tests/plugins/apps/virtualization/test_vmware_workstation.py

@@ -1,43 +0,0 @@
-from __future__ import annotations
-
-from datetime import datetime, timezone
-from typing import TYPE_CHECKING
-
-import pytest
-
-from dissect.target.plugins.apps.virtualization.vmware_workstation import (
-    VmwareWorkstationPlugin,
-)
-from tests._utils import absolute_path
-
-if TYPE_CHECKING:
-    from dissect.target.filesystem import VirtualFilesystem
-    from dissect.target.target import Target
-
-
-@pytest.mark.parametrize(
-    ("target", "fs", "dnd_path"),
-    [
-        ("target_win_users", "fs_win", "Users\\John\\AppData\\Local\\Temp\\VmwareDND"),
-        ("target_unix_users", "fs_unix", "/home/user/.cache/vmware/drag_and_drop"),
-    ],
-)
-def test_vmware_workstation_clipboard_dnd(
-    target: Target, fs: VirtualFilesystem, dnd_path: str, request: pytest.FixtureRequest
-) -> None:
-    """Test if we correctly detect drag and drop artifacts on Windows and Unix targets."""
-
-    target = request.getfixturevalue(target)
-    fs = request.getfixturevalue(fs)
-    fs.map_dir_from_tar(dnd_path, absolute_path("_data/plugins/apps/virtualization/vmware_workstation/dnd.tar"))
-    target.add_plugin(VmwareWorkstationPlugin)
-    results = sorted(target.vmware.clipboard(), key=lambda r: r.path)
-    dnd_path = dnd_path.replace("\\", "/")
-
-    assert len(results) == 3
-    assert [str(r.path).replace("C:\\", "").replace("\\", "/") for r in results] == [
-        f"{dnd_path}/8lkBf1/wachter.jpg",
-        f"{dnd_path}/iUpQHG/credentials.txt",
-        f"{dnd_path}/x1G9fJ/example.txt",
-    ]
-    assert results[0].ts == datetime(2024, 9, 18, 11, 16, 44, tzinfo=timezone.utc)