dissect.target 3.23.2.dev2__tar.gz → 3.23.2.dev4__tar.gz

{dissect_target-3.23.2.dev2 → dissect_target-3.23.2.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.2.dev2
+Version: 3.23.2.dev4
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{dissect_target-3.23.2.dev2 → dissect_target-3.23.2.dev4}/dissect/target/filesystem.py

@@ -1215,8 +1215,9 @@ class VirtualFilesystem(Filesystem):
                 real_file_path = root.joinpath(file_)
                 directory.add(file_, MappedFile(self, vfs_file_path, str(real_file_path)))
 
-    def map_file(self, vfspath: str, realpath: str, compression: str | None = None) -> None:
+    def map_file(self, vfspath: str, realpath: str | pathlib.Path, compression: str | None = None) -> None:
         """Map a file from the host machine into the VFS."""
+        realpath = str(realpath)
         vfspath = fsutil.normalize(vfspath, alt_separator=self.alt_separator)
         if vfspath[-1] == "/":
             raise AttributeError(f"Can't map a file onto a directory: {vfspath}")

{dissect_target-3.23.2.dev2 → dissect_target-3.23.2.dev4}/dissect/target/plugins/os/windows/dpapi/dpapi.py

@@ -34,6 +34,7 @@ class DPAPIPlugin(InternalPlugin):
 
     def __init__(self, target: Target):
         super().__init__(target)
+        self._seen_mks = set()
         self.keychain = cache(self.keychain)
 
     def check_compatible(self) -> None:
@@ -88,6 +89,11 @@ class DPAPIPlugin(InternalPlugin):
             if not self.RE_MASTER_KEY.findall(file.name):
                 continue
 
+            if (file.name, sid) in self._seen_mks:
+                continue
+
+            self._seen_mks.add((file.name, sid))
+
             with file.open() as fh:
                 mkf = MasterKeyFile(fh)
 
@@ -118,7 +124,11 @@ class DPAPIPlugin(InternalPlugin):
                     try:
                         if mkf.decrypt_with_password(sid, mk_pass):
                             self.target.log.info(
-                                "Decrypted user master key with password '%s' from provider %s", mk_pass, provider
+                                "Decrypted SID %s master key %s with password '%s' from provider %s",
+                                sid,
+                                file,
+                                mk_pass,
+                                provider,
                             )
                             break
                     except ValueError:
@@ -127,7 +137,11 @@ class DPAPIPlugin(InternalPlugin):
                     try:
                         if mkf.decrypt_with_hash(sid, bytes.fromhex(mk_pass)):
                             self.target.log.info(
-                                "Decrypted SID %s master key with hash '%s' from provider %s", sid, mk_pass, provider
+                                "Decrypted SID %s master key %s with hash '%s' from provider %s",
+                                sid,
+                                file,
+                                mk_pass,
+                                provider,
                             )
                             break
                     except ValueError:

{dissect_target-3.23.2.dev2 → dissect_target-3.23.2.dev4}/dissect/target/target.py

@@ -396,7 +396,8 @@ class Target:
                     # For file/dir-like paths it's a Path object
                     target = cls._load(load_spec, ldr)
                 except Exception as e:
-                    getlogger(load_spec).error("Failed to load target with loader %s", ldr, exc_info=e)
+                    getlogger(load_spec).error("Failed to load target with loader %s", ldr)
+                    getlogger(load_spec).debug("", exc_info=e)
                     continue
                 else:
                     yield target
@@ -432,6 +433,11 @@ class Target:
             if parsed_path is None or isinstance(spec, os.PathLike):
                 path = Path(spec) if not isinstance(spec, os.PathLike) else spec
 
+                if not path.exists():
+                    raise TargetError(f"Failed to find loader for {path}: path does not exist")
+                elif not path.is_dir():
+                    raise TargetError(f"Failed to find loader for {path}: path is not a directory")
+
                 for entry in path.iterdir():
                     for target in _open_all(entry, include_children=include_children):
                         at_least_one_loaded = True

{dissect_target-3.23.2.dev2 → dissect_target-3.23.2.dev4}/dissect/target/tools/shell.py

@@ -1604,7 +1604,7 @@ def main() -> int:
     try:
         open_shell(args.targets, args.python, args.registry, args.commands)
     except TargetError as e:
-        log.exception("Error opening shell")
+        log.error("Error opening shell: %s", e)  # noqa: TRY400
         log.debug("", exc_info=e)
 
     return 0

{dissect_target-3.23.2.dev2 → dissect_target-3.23.2.dev4}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.2.dev2
+Version: 3.23.2.dev4
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{dissect_target-3.23.2.dev2 → dissect_target-3.23.2.dev4}/tests/plugins/os/windows/dpapi/test_dpapi.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 from typing import TYPE_CHECKING
+from unittest.mock import patch
 
 import pytest
 
@@ -50,7 +51,7 @@ To create mock Windows targets you'll need the following additional data:
 @pytest.mark.parametrize(
     ("user_type", "master_key_guid", "enc_data", "plaintext"),
     [
-        (
+        pytest.param(
             "user",
             "f5638f3b-9632-480b-ba9c-c73bdabe9f86",
             (
@@ -66,8 +67,9 @@ To create mock Windows targets you'll need the following additional data:
                 "3940324b68b9"
             ),
             "this is a windows 10 user secret!",
+            id="user",
         ),
-        (
+        pytest.param(
             "system",
             "59873e79-ca24-459a-8b17-a5dcd82c6ea1",
             (
@@ -83,6 +85,7 @@ To create mock Windows targets you'll need the following additional data:
                 "e5db2b95ff71"
             ),
             "this is a windows 10 system secret!",
+            id="system",
         ),
     ],
 )
@@ -174,7 +177,7 @@ def test_dpapi_decrypt_blob_win_10(
 @pytest.mark.parametrize(
     ("user_type", "master_key_guid", "enc_data", "plaintext"),
     [
-        (
+        pytest.param(
             "user",
             "835419eb-ce4a-4ae3-a72a-35c1383a6519",
             (
@@ -189,8 +192,9 @@ def test_dpapi_decrypt_blob_win_10(
                 "e40d07649869"
             ),
             "this is a user secret!",
+            id="user",
         ),
-        (
+        pytest.param(
             "system",
             "ab15130c-61cd-4065-be48-faba655f80d1",
             (
@@ -205,6 +209,7 @@ def test_dpapi_decrypt_blob_win_10(
                 "a80b813315de746d3334e7abb3bddae312a87b132384"
             ),
             "this is a system secret!",
+            id="system",
         ),
     ],
 )
@@ -299,7 +304,7 @@ def test_dpapi_decrypt_blob_win_7(
 @pytest.mark.parametrize(
     ("user_type", "master_key_guid", "enc_data", "plaintext"),
     [
-        (
+        pytest.param(
             "user",
             "8bd87dd9-10fa-40b5-8614-5d0a7e8911c5",
             (
@@ -312,8 +317,9 @@ def test_dpapi_decrypt_blob_win_7(
                 "91941400000070e42b6873f1372abd5dbaced1e97dd0fbeee5c0"
             ),
             "this is a windows vista user secret!",
+            id="user",
         ),
-        (
+        pytest.param(
             "system",
             "9ed75ec3-d074-4a7a-a428-1b70188cce4c",
             (
@@ -326,6 +332,7 @@ def test_dpapi_decrypt_blob_win_7(
                 "bea5140000003ec445826ec3c1dce592a6b15d467290ca1f4068"
             ),
             "this is a windows vista system secret!",
+            id="system",
         ),
     ],
 )
@@ -422,7 +429,7 @@ def test_dpapi_decrypt_blob_win_vista(
 @pytest.mark.parametrize(
     ("user_type", "master_key_guid", "enc_data", "plaintext"),
     [
-        (
+        pytest.param(
             "user",
             "e1245b49-43d9-465f-b161-eab88c27620d",
             (
@@ -435,8 +442,9 @@ def test_dpapi_decrypt_blob_win_vista(
                 "f626a57c4b1c4dd15267560b945c4c7e9124"
             ),
             "this is a windows xp user secret!",
+            id="user",
         ),
-        (
+        pytest.param(
             "system",
             "2ee95631-ed37-43f9-8a08-378924a60de7",
             (
@@ -449,6 +457,7 @@ def test_dpapi_decrypt_blob_win_vista(
                 "50be593b511450387842969ee1217fc07870"
             ),
             "this is a windows xp system secret!",
+            id="system",
         ),
     ],
 )
@@ -536,3 +545,31 @@ def test_dpapi_decrypt_blob_win_xp(
         decrypted = target_win.dpapi.decrypt_system_blob(enc_data)
 
     assert decrypted.decode("utf-16-le") == plaintext
+
+
+def test_dpapi_master_keys_deduplicate(
+    target_win: Target, fs_win: VirtualFilesystem, hive_hklm: VirtualHive, hive_hku: VirtualHive
+) -> None:
+    """Test if we correctly deduplicate master keys."""
+
+    add_win_user(
+        hive_hklm,
+        hive_hku,
+        target_win,
+        sid="S-1-5-21-1555088973-3915578919-3195617063-1003",
+        home="c:\\users\\user",
+    )
+
+    # Mock "Application Data" -> "AppData/Roaming" symlink
+    fs_win.symlink("/sysvol/Users/user/AppData/Roaming", "/Users/user/Application Data")
+
+    fs_win.map_file(
+        "Users/user/AppData/Roaming/Microsoft/Protect/S-1-5-21-1555088973-3915578919-3195617063-1003/f5638f3b-9632-480b-ba9c-c73bdabe9f86",
+        absolute_path("_data/plugins/os/windows/dpapi/master_keys/f5638f3b-9632-480b-ba9c-c73bdabe9f86"),
+    )
+
+    plugin = target_win.add_plugin(DPAPIPlugin, check_compatible=False)
+
+    with patch("dissect.target.plugins.os.windows.dpapi.dpapi.MasterKeyFile") as MasterKeyFileMock:
+        dict(plugin.master_keys)
+        MasterKeyFileMock.assert_called_once()

{dissect_target-3.23.2.dev2 → dissect_target-3.23.2.dev4}/tests/test_target.py

@@ -13,7 +13,7 @@ import pytest
 
 from dissect.target import loader
 from dissect.target.containers.raw import RawContainer
-from dissect.target.exceptions import FilesystemError
+from dissect.target.exceptions import FilesystemError, TargetError
 from dissect.target.filesystem import VirtualFilesystem
 from dissect.target.filesystems.dir import DirectoryFilesystem
 from dissect.target.helpers.fsutil import TargetPath
@@ -748,3 +748,25 @@ def test_expected_path(path: str | Path, expected: Path) -> None:
     assert target.path == expected
     if isinstance(path, Path):
         assert type(target.path) is type(expected)
+
+
+def test_exception_invalid_path() -> None:
+    """Test if we throw small and neat error messages and not long stack traces when giving invalid path(s)."""
+
+    with pytest.raises(
+        TargetError,
+        match=r"Failed to initiate RawLoader for target [/\\]path[/\\]to[/\\]invalid.img: Provided target path does not exist",  # noqa: E501
+    ):
+        Target.open("/path/to/invalid.img")
+
+    with pytest.raises(
+        TargetError,
+        match=r"Failed to find loader for [/\\]path[/\\]to[/\\]invalid.img: path does not exist",
+    ):
+        next(Target.open_all("/path/to/invalid.img"))
+
+    with pytest.raises(
+        TargetError,
+        match=r"Failed to find any loader for targets: \['smb://invalid'\]",
+    ):
+        next(Target.open_all("smb://invalid"))