dissect.target 3.23.dev25__tar.gz → 3.23.dev27__tar.gz

{dissect_target-3.23.dev25 → dissect_target-3.23.dev27}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev25
+Version: 3.23.dev27
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.23.dev25 → dissect_target-3.23.dev27}/dissect/target/plugin.py

@@ -27,7 +27,7 @@ except ImportError:
 from flow.record import Record, RecordDescriptor
 
 import dissect.target.plugins.os.default as default
-from dissect.target.exceptions import PluginError, UnsupportedPluginError
+from dissect.target.exceptions import PluginError, PluginNotFoundError, UnsupportedPluginError
 from dissect.target.helpers import cache
 from dissect.target.helpers.fsutil import has_glob_magic
 from dissect.target.helpers.record import EmptyRecord
@@ -432,6 +432,20 @@ class Plugin:
     def __init__(self, target: Target):
         self.target = target
 
+    def __getattr__(self, name: str, /) -> Any:
+        # "Magic" attribute access is only allowed on namespace plugins, to allow for indirect nesting of namespaces
+        # E.g. `__namespace__ = "foo.bar"`, we should try to resolve `bar` on a plugin instance of `foo`
+        if not self.__namespace__:
+            raise AttributeError(name)
+
+        # Attempt to lookup the attribute using the namespace
+        try:
+            _, func = self.target.get_function(f"{self.__class__.__namespace__}.{name}")
+        except PluginNotFoundError:
+            raise AttributeError(name)
+
+        return func
+
     def is_compatible(self) -> bool:
         """Perform a compatibility check with the target."""
         try:
@@ -1258,6 +1272,18 @@ class OSPlugin(Plugin):
         """
         raise NotImplementedError
 
+    @internal
+    def misc_user_paths(self) -> Iterator[tuple[str, tuple[str, str] | None]]:
+        """Yields miscellaneous user paths and user keys.
+
+        Example:
+            ("c:/Windows/ServiceProfiles/LocalService", ("sid", "S-1-5-19"))
+        """
+
+        # Consider moving this to the UsersPlugin class, and create separate UsersPlugin subclasses for each OS
+        # when the machinery concerning users and user_paths becomes more complex.
+        raise NotImplementedError
+
     @internal
     def os_tree(self) -> list[str]:
         """Returns the :func:`os` value of this and all the OS plugin parents."""

{dissect_target-3.23.dev25 → dissect_target-3.23.dev27}/dissect/target/plugins/general/users.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-from functools import lru_cache
+from functools import cached_property, lru_cache
 from typing import TYPE_CHECKING, NamedTuple, Union
 
 from dissect.target.exceptions import UnsupportedPluginError
@@ -82,8 +82,49 @@ class UsersPlugin(InternalPlugin):
 
     def all_with_home(self) -> Iterator[UserDetails]:
         """Return :class:`UserDetails` objects for users that have existing directory set as home directory."""
-        for user in self.target.users():
-            if user.home:
-                user_details = self.get(user)
-                if user_details.home_path.exists():
-                    yield user_details
+
+        seen: set[TargetPath] = set()
+        try:
+            for user in self.target.users():
+                if user.home:
+                    user_details = self.get(user)
+                    if user_details.home_path.exists():
+                        seen.add(user_details.home_path)
+                        yield user_details
+        except Exception as e:
+            self.target.log.warning("Failed to retrieve user details, falling back to hardcoded locations")
+            self.target.log.debug("", exc_info=e)
+
+        # Iterate over misc home directories
+        for misc_home_dir, user_criterion in self.target.misc_user_paths():
+            # We skip the entry if no user can be found.
+            # We cannot use set membership check here because of https://github.com/fox-it/dissect.target/issues/1203
+            if any(seen_path.samefile(misc_home_dir) for seen_path in seen) or not user_criterion:
+                continue
+
+            if (user_details := self.find(**{user_criterion[0]: user_criterion[1]})) is None:
+                continue
+
+            yield UserDetails(user=user_details.user, home_path=misc_home_dir)
+            seen.add(misc_home_dir)
+
+    @cached_property
+    def all_home_paths(self) -> Iterator[TargetPath]:
+        """Return all home directories of users, including miscellaneous user directories that may not be linked to discovered local users."""  # noqa: E501
+
+        seen: set[TargetPath] = set()
+        try:
+            for user in self.target.users():
+                if user.home and (home_path := self.target.resolve(str(user.home))).exists():
+                    yield home_path
+                    seen.add(home_path)
+        except Exception as e:
+            self.target.log.warning("Failed to retrieve user details, falling back to hardcoded locations")
+            self.target.log.debug("", exc_info=e)
+
+        # Iterate over misc home directories
+        for misc_home_dir, _ in self.target.misc_user_paths():
+            # We cannot use set membership check here because of https://github.com/fox-it/dissect.target/issues/1203
+            if not any(seen_path.samefile(misc_home_dir) for seen_path in seen):
+                yield misc_home_dir
+                seen.add(misc_home_dir)

{dissect_target-3.23.dev25 → dissect_target-3.23.dev27}/dissect/target/plugins/os/default/_os.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 from typing import TYPE_CHECKING
 
 from dissect.target.helpers.record import EmptyRecord
-from dissect.target.plugin import OSPlugin, export
+from dissect.target.plugin import OSPlugin, export, internal
 
 if TYPE_CHECKING:
     from collections.abc import Iterator
@@ -50,6 +50,10 @@ class DefaultOSPlugin(OSPlugin):
     def users(self) -> Iterator[Record]:
         yield from ()
 
+    @internal
+    def misc_user_paths(self) -> Iterator[tuple[str, tuple[str, str] | None]]:
+        yield from ()
+
     @export(property=True)
     def os(self) -> str:
         return "default"

{dissect_target-3.23.dev25 → dissect_target-3.23.dev27}/dissect/target/plugins/os/unix/_os.py

@@ -17,7 +17,7 @@ from dissect.target.helpers.record import UnixUserRecord
 from dissect.target.helpers.sunrpc.client import LocalPortPolicy, auth_unix
 from dissect.target.helpers.utils import parse_options_string
 from dissect.target.loaders.local import LocalLoader
-from dissect.target.plugin import OperatingSystem, OSPlugin, arg, export
+from dissect.target.plugin import OperatingSystem, OSPlugin, arg, export, internal
 
 if TYPE_CHECKING:
     from collections.abc import Iterator
@@ -159,6 +159,14 @@ class UnixPlugin(OSPlugin):
                     _target=self.target,
                 )
 
+    @internal
+    def misc_user_paths(self) -> Iterator[tuple[str, tuple[str, str] | None]]:
+        if (root_path := self.target.fs.path("/root")).exists():
+            yield (root_path, ("uid", 0))
+
+        if (home_path := self.target.fs.path("/home")).exists():
+            yield from ((entry, None) for entry in home_path.iterdir() if entry.is_dir())
+
     @export(property=True)
     def architecture(self) -> str | None:
         return self._get_architecture(self.os)

{dissect_target-3.23.dev25 → dissect_target-3.23.dev27}/dissect/target/plugins/os/unix/bsd/darwin/_os.py

@@ -2,9 +2,11 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
+from dissect.target.plugin import internal
 from dissect.target.plugins.os.unix.bsd._os import BsdPlugin
 
 if TYPE_CHECKING:
+    from collections.abc import Iterator
     from pathlib import Path
 
     from dissect.target.filesystem import Filesystem
@@ -32,6 +34,13 @@ class DarwinPlugin(BsdPlugin):
                 return fs
         return None
 
+    @internal
+    def misc_user_paths(self) -> Iterator[tuple[str, tuple[str, str] | None]]:
+        yield from super().misc_user_paths()
+
+        if (user_path := self.target.fs.path("/Users")).exists():
+            yield from ((entry, None) for entry in user_path.iterdir() if entry.is_dir())
+
 
 def detect_macho_arch(paths: list[str | Path], fs: Filesystem | None = None) -> str | None:
     """Detect the architecture of the system by reading the Mach-O headers of the provided binaries.

{dissect_target-3.23.dev25 → dissect_target-3.23.dev27}/dissect/target/plugins/os/windows/_os.py

@@ -6,7 +6,7 @@ from typing import TYPE_CHECKING, Any
 
 from dissect.target.exceptions import RegistryError, RegistryValueNotFoundError
 from dissect.target.helpers.record import WindowsUserRecord
-from dissect.target.plugin import OperatingSystem, OSPlugin, export
+from dissect.target.plugin import OperatingSystem, OSPlugin, export, internal
 
 if TYPE_CHECKING:
     from collections.abc import Iterator
@@ -314,6 +314,24 @@ class WindowsPlugin(OSPlugin):
                     _target=self.target,
                 )
 
+    @internal
+    def misc_user_paths(self) -> Iterator[tuple[str, tuple[str, str] | None]]:
+        yield from (
+            (resolved_path, user_criterion)
+            for path, user_criterion in [
+                ("%windir%/ServiceProfiles/LocalService", ("sid", "S-1-5-19")),
+                ("%windir%/ServiceProfiles/NetworkService", ("sid", "S-1-5-20")),
+                ("%windir%/System32/config/systemprofile", ("sid", "S-1-5-18")),
+                ("%windir%/SysWOW64/config/systemprofile", ("sid", "S-1-5-18")),
+            ]
+            if (resolved_path := self.target.resolve(path)).exists()
+        )
+
+        # Homedirs for users when there is no user profile information available.
+        for user_dir in ("sysvol/Users", "sysvol/Documents and Settings"):
+            if (resolved := self.target.resolve(user_dir)).exists():
+                yield from ((entry, None) for entry in resolved.iterdir() if entry.is_dir())
+
     @export(property=True)
     def os(self) -> str:
         return OperatingSystem.WINDOWS.value

{dissect_target-3.23.dev25 → dissect_target-3.23.dev27}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev25
+Version: 3.23.dev27
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.23.dev25 → dissect_target-3.23.dev27}/tests/conftest.py

@@ -288,6 +288,11 @@ def hive_hklm() -> VirtualHive:
     # set current control set to ControlSet001 and mock it
     change_controlset(hive, 1)
 
+    # set windir
+    current_version_key = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
+    hive.map_key(current_version_key, VirtualKey(hive, current_version_key))
+    hive.map_value(current_version_key, "SystemRoot", VirtualValue(hive, "SystemRoot", "c:\\Windows"))
+
     return hive
 
 

{dissect_target-3.23.dev25 → dissect_target-3.23.dev27}/tests/plugins/general/test_users.py

@@ -35,6 +35,22 @@ def test_users_plugin(target_win_users: Target, fs_win: VirtualFilesystem, tmp_p
     users_with_home = list(target_win_users.user_details.all_with_home())
     assert len(users_with_home) == 1  # only John has a home dir
 
+    home_dirs = list(target_win_users.user_details.all_home_paths)
+    assert len(home_dirs) == 1
+    assert home_dirs[0] == target_win_users.fs.path("C:/Users/John")
+
+
+def test_misc_users(target_win_users: Target, fs_win: VirtualFilesystem, tmp_path: Path) -> None:
+    fs_win.map_dir("Windows/SysWOW64/config/systemprofile", tmp_path)
+    users_with_home = list(target_win_users.user_details.all_with_home())
+    assert len(users_with_home) == 1  # Misc home dir is found
+    assert users_with_home[0].user.sid == "S-1-5-18"
+    assert users_with_home[0].home_path == target_win_users.fs.path("c:/Windows/SysWOW64/config/systemprofile")
+
+    home_dirs = list(target_win_users.user_details.all_home_paths)
+    assert len(home_dirs) == 1  # Misc home dir is found
+    assert home_dirs[0] == target_win_users.fs.path("c:/Windows/SysWOW64/config/systemprofile")
+
 
 def test_users_plugin_find_no_params(target_unix_users: Target) -> None:
     with pytest.raises(ValueError, match="Either sid or uid or username is expected"):

{dissect_target-3.23.dev25 → dissect_target-3.23.dev27}/tests/plugins/os/windows/test__os.py

@@ -263,7 +263,7 @@ def test_windows_user(target_win_users: Target) -> None:
 
     assert users[0].sid == "S-1-5-18"
     assert users[0].name == "systemprofile"
-    assert users[0].home == windows_path("%systemroot%\\system32\\config\\systemprofile")
+    assert users[0].home == windows_path("c:\\windows\\system32\\config\\systemprofile")
 
     assert users[1].sid == "S-1-5-21-3263113198-3007035898-945866154-1002"
     assert users[1].name == "John"

{dissect_target-3.23.dev25 → dissect_target-3.23.dev27}/tests/test_plugin.py

@@ -597,6 +597,59 @@ def test_namesplace_plugin_multiple_same_module(mock_plugins: PluginRegistry) ->
     assert sorted(desc.name for desc in result) == ["bar.baz", "foo.baz"]
 
 
+@patch("dissect.target.plugin.PLUGINS", new_callable=PluginRegistry)
+def test_nested_namespace_getattr(mock_plugins: PluginRegistry, target_bare: Target) -> None:
+    class Foo(Plugin):
+        __namespace__ = "foo"
+
+        @export(output="yield")
+        def buzz(self) -> Iterator[str]:
+            yield from ["buzz"]
+
+    class FooBar(Plugin):
+        __namespace__ = "foo.bar"
+
+        @export(output="yield")
+        def bazz(self) -> Iterator[str]:
+            yield from ["bazz1"]
+
+        @export(output="yield")
+        def bar(self) -> Iterator[str]:
+            yield from ["bar1"]
+
+    class FooBaz(Plugin):
+        __namespace__ = "foo.baz"
+
+        @export(output="yield")
+        def bazz(self) -> Iterator[str]:
+            yield from ["bazz2"]
+
+        @export(output="yield")
+        def bar(self) -> Iterator[str]:
+            yield from ["bar2"]
+
+    for plugin in [Foo, FooBar, FooBaz]:
+        target_bare._register_plugin_functions(plugin(target_bare))
+
+    assert isinstance(target_bare.foo, Foo)
+    assert isinstance(target_bare.foo.bar, FooBar)
+    assert isinstance(target_bare.foo.baz, FooBaz)
+    assert hasattr(target_bare.foo.bar, "bazz")
+
+    with pytest.raises(AttributeError):
+        target_bare.foo.bazz()
+
+    with pytest.raises(AttributeError):
+        target_bare.foo.bar.foo()
+
+    # Test whether we can access the plugin this way
+    assert next(target_bare.foo.bar.bazz()) == "bazz1"
+    assert next(target_bare.foo.bar.bar()) == "bar1"
+    assert next(target_bare.foo.baz.bazz()) == "bazz2"
+    assert next(target_bare.foo.baz.bar()) == "bar2"
+    assert next(target_bare.foo.buzz()) == "buzz"
+
+
 def test_find_plugin_function_default(target_default: Target) -> None:
     found, _ = find_functions("services", target_default)
 
@@ -1352,3 +1405,26 @@ def assert_valid_rst(src: str) -> None:
         # We can assume that if the rst is truly invalid this will also be caught by `tox -e build-docs`.
         if "Unknown interpreted text role" not in str(e):
             pytest.fail(f"Invalid rst: {e}", pytrace=False)
+
+
+@pytest.mark.parametrize(
+    "descriptor",
+    [descriptor for descriptor in plugins() if descriptor.namespace and "." in descriptor.namespace],
+    ids=lambda descriptor: descriptor.namespace,
+)
+def test_nested_namespace_consistency(descriptor: PluginDescriptor) -> None:
+    """Test whether all parts of nested namespaces exist and that there are no conflicts with other functions."""
+
+    parts = descriptor.namespace.split(".")
+    for i in range(len(parts)):
+        part = ".".join(parts[: i + 1])
+        result = list(lookup(part))
+
+        if not result:
+            pytest.fail(f"Unreachable namespace {descriptor.namespace!r}, namespace {part!r} does not exist.")
+
+        if len(result) > 1:
+            conflicts = ", ".join(
+                f"{desc.name} ({desc.module}.{desc.qualname})" for desc in result if desc.namespace != part
+            )
+            pytest.fail(f"Namespace name {descriptor.namespace!r} has conflicts with function name: {conflicts}")