dissect.target 3.23.dev67__tar.gz → 3.23.dev69__tar.gz

{dissect_target-3.23.dev67 → dissect_target-3.23.dev69}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev67
+Version: 3.23.dev69
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.23.dev67 → dissect_target-3.23.dev69}/dissect/target/plugins/os/unix/linux/services.py

@@ -63,20 +63,33 @@ class ServicesPlugin(Plugin):
                 if should_ignore_file(service_file.name, ignored_suffixes):
                     continue
 
+                config = {}
+                types = []
+
                 try:
-                    parsed_config = configutil.parse(service_file, hint="systemd")
-                    config = {}
-                    types = []
-                    for segment, configuration in parsed_config.items():
+                    for segment, configuration in configutil.parse(service_file, hint="systemd").items():
                         if not configuration:
                             continue
 
-                        for key, value in configuration.items():
-                            _value = value or None
-                            _key = f"{segment}_{key}"
-                            _key = _key.replace("-", "_")
-                            types.append(("string", _key))
-                            config.update({_key: _value})
+                        if not isinstance(configuration, list):
+                            configuration = [configuration]
+
+                        for nested_conf in configuration:
+                            for key, value in nested_conf.items():
+                                _key = f"{segment}_{key}".replace("-", "_")
+
+                                if _key not in config:
+                                    config.update({_key: value or None})
+                                else:
+                                    if not isinstance(config[_key], list):
+                                        config[_key] = [config[_key]]
+                                    config[_key].append(value or None)
+
+                                if isinstance(config[_key], list):
+                                    types.append(("string[]", _key))
+                                else:
+                                    types.append(("string", _key))
+
                 except FileNotFoundError:
                     # The service is registered but the symlink is broken.
                     yield LinuxServiceRecord(

{dissect_target-3.23.dev67 → dissect_target-3.23.dev69}/dissect/target/plugins/os/windows/regf/mru.py

@@ -168,57 +168,43 @@ class MRUPlugin(Plugin):
         """Return the OpenSaveMRU data.
 
         The ``HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\OpenSaveMRU`` registry key
-        contains information about the most recently opened or saved files.
+        - renamed to ``OpenSavePidlMRU`` since Windows Vista - contains information about the most recently
+        opened or saved files.
 
         References:
             - https://digitalf0rensics.wordpress.com/2014/01/17/windows-registry-and-forensics-part2/
         """
 
         KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\OpenSaveMRU"
+        PIDL_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\OpenSavePidlMRU"
 
         for key in self.target.registry.keys(KEY):
             yield from parse_mru_key(self.target, key, OpenSaveMRURecord)
 
+        for key in self.target.registry.keys(PIDL_KEY):
+            yield from parse_mru_ex_key(self.target, key, OpenSaveMRURecord)
+
     @export(record=LastVisitedMRURecord)
     def lastvisited(self) -> Iterator[LastVisitedMRURecord]:
         """Return the LastVisitedMRU data.
 
         The ``HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\LastVisitedMRU`` registry key
-        contains information about the executable used by an application to open the files that are documented at the
-        OpenSaveMRU registry key. Also each value tracks the directory location for the last file that was accessed by
-        that application.
+        - renamed to ``LastVisitedPidlMRU`` since Windows Vista - contains information about the executable used by
+        an application to open the files that are documented at the ``OpenSaveMRU`` registry key. Also, each value
+        tracks the directory location for the last file that was accessed by that application.
 
         References:
             - https://digitalf0rensics.wordpress.com/2014/01/17/windows-registry-and-forensics-part2/
         """
 
         KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\LastVisitedMRU"
+        PIDL_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\LastVisitedPidlMRU"
 
         for key in self.target.registry.keys(KEY):
-            user = self.target.registry.get_user(key)
-
-            try:
-                mrulist = key.value("MRUList").value
-            except RegistryError:
-                mrulist = None
-
-            for value in key.values():
-                if value.name == "MRUList":
-                    continue
+            yield from parse_mru_key(self.target, key, LastVisitedMRURecord)
 
-                entry_index = mrulist.index(value.name) if mrulist else None
-                filename, path, _ = value.value.rsplit(b"\x00\x00")
-
-                yield LastVisitedMRURecord(
-                    regf_mtime=key.ts,
-                    index=entry_index,
-                    filename=filename.decode("utf-16-le"),
-                    path=path.decode("utf-16-le"),
-                    key=key.path,
-                    _target=self.target,
-                    _user=user,
-                    _key=key,
-                )
+        for key in self.target.registry.keys(PIDL_KEY):
+            yield from parse_mru_ex_key(self.target, key, LastVisitedMRURecord)
 
     @export(record=ACMruRecord)
     def acmru(self) -> Iterator[ACMruRecord]:
@@ -251,7 +237,6 @@ class MRUPlugin(Plugin):
                         index=int(value.name),
                         category=subkey.name,
                         value=value.value,
-                        key=key.path,
                         _target=self.target,
                         _user=user,
                         _key=subkey,
@@ -294,7 +279,6 @@ class MRUPlugin(Plugin):
                     regf_mtime=key.ts,
                     index=entry_index,
                     value=value.value,
-                    key=key.path,
                     _target=self.target,
                     _user=user,
                     _key=key,
@@ -343,18 +327,31 @@ def parse_mru_key(target: Target, key: RegistryKey, record: TargetRecordDescript
         if value.name == "MRUList":
             continue
 
-        entry_index = mrulist.index(value.name) if mrulist else None
-        entry_value = value.value
-
-        yield record(
-            regf_mtime=key.ts,
-            index=entry_index,
-            value=entry_value,
-            key=key.path,
-            _target=target,
-            _user=user,
-            _key=key,
-        )
+        if record == LastVisitedMRURecord:
+            entry_index = mrulist.index(value.name) if mrulist else None
+            values = read_wstrings(value.value)
+
+            yield record(
+                regf_mtime=key.ts,
+                index=entry_index,
+                filename=next(values).decode("utf-16-le"),
+                path=next(values).decode("utf-16-le"),
+                _target=target,
+                _user=user,
+                _key=key,
+            )
+        else:
+            entry_index = mrulist.index(value.name) if mrulist else None
+            entry_value = value.value
+
+            yield record(
+                regf_mtime=key.ts,
+                index=entry_index,
+                value=entry_value,
+                _target=target,
+                _user=user,
+                _key=key,
+            )
 
     for subkey in key.subkeys():
         yield from parse_mru_key(target, subkey, record)
@@ -363,30 +360,60 @@ def parse_mru_key(target: Target, key: RegistryKey, record: TargetRecordDescript
 def parse_mru_ex_key(target: Target, key: RegistryKey, record: TargetRecordDescriptor) -> Iterator[Record]:
     user = target.registry.get_user(key)
 
-    mrulist_ex = key.value("MRUListEx").value
-    mrulist_ex = struct.unpack(f"<{len(mrulist_ex) // 4}I", mrulist_ex)
+    try:
+        mrulist_ex = key.value("MRUListEx").value
+        mrulist_ex = struct.unpack(f"<{len(mrulist_ex) // 4}I", mrulist_ex)
+    except RegistryError:
+        mrulist_ex = None
 
     for value in key.values():
         if value.name == "MRUListEx":
             continue
 
         entry_index = mrulist_ex.index(int(value.name))
-        split_idx = value.value.index(b"\x00\x00")
-        # Poor mans null terminated utf-16-le
-        path, bag = value.value[: split_idx + 1], value.value[split_idx + 3 :]
+        if record != OpenSaveMRURecord:
+            path = next(read_wstrings(value.value))
+            bag = value.value[len(path) + 2 :]
+        else:
+            bag = value.value
+            path = None
         parsed_bag = list(parse_shell_item_list(bag))
         if len(parsed_bag) != 1 or not isinstance(parsed_bag, FILE_ENTRY):
             target.log.debug("Unexpected shell bag entry in MRUListEx entry: %s:%s", key, value)
 
-        yield record(
-            regf_mtime=key.ts,
-            index=entry_index,
-            value=path.decode("utf-16-le"),
-            key=key.path,
-            _target=target,
-            _user=user,
-            _key=key,
-        )
+        if record == LastVisitedMRURecord:
+            filepath = "\\".join(el.name.rstrip("\\") for el in parsed_bag) + "\\"
+            yield record(
+                regf_mtime=key.ts,
+                index=entry_index,
+                filename=path.decode("utf-16-le"),
+                path=filepath,
+                _target=target,
+                _user=user,
+                _key=key,
+            )
+        elif record == OpenSaveMRURecord:
+            filepath = "\\".join(el.name.rstrip("\\") for el in parsed_bag)
+            yield record(
+                regf_mtime=key.ts,
+                index=entry_index,
+                value=filepath,
+                _target=target,
+                _user=user,
+                _key=key,
+            )
+        else:
+            yield record(
+                regf_mtime=key.ts,
+                index=entry_index,
+                value=path.decode("utf-16-le"),
+                _target=target,
+                _user=user,
+                _key=key,
+            )
+
+    for subkey in key.subkeys():
+        yield from parse_mru_ex_key(target, subkey, record)
 
 
 def parse_office_mru(target: Target, key: RegistryKey, record: TargetRecordDescriptor) -> Iterator[Record]:
@@ -424,8 +451,23 @@ def parse_office_mru_key(target: Target, key: RegistryKey, record: TargetRecordD
             regf_mtime=key.ts,
             index=entry_index,
             value=path,
-            key=key.path,
             _target=target,
             _user=user,
             _key=key,
         )
+
+
+def read_wstrings(buf: bytes) -> Iterator[bytes]:
+    idx = 0
+    remaining = buf
+    while (idx := remaining.find(b"\x00\x00", idx)) != -1:
+        if idx & 1:
+            idx += 1
+            continue
+
+        yield remaining[:idx]
+        remaining = remaining[idx + 2 :]
+        idx = 0
+
+    if remaining:
+        yield remaining

{dissect_target-3.23.dev67 → dissect_target-3.23.dev69}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev67
+Version: 3.23.dev69
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.23.dev67 → dissect_target-3.23.dev69}/tests/plugins/os/unix/linux/test_services.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+from io import BytesIO
 from typing import TYPE_CHECKING
 
 from dissect.target.plugins.os.unix.linux.services import ServicesPlugin
@@ -66,3 +67,43 @@ def test_services(target_unix_users: Target, fs_unix: VirtualFilesystem) -> None
 
     assert results[3].name == "example"
     assert str(results[3].source) == "/etc/init.d/example"
+
+
+def test_services_systemd_drop_folder(target_unix: Target, fs_unix: VirtualFilesystem) -> None:
+    """Test if we correctly parse systemd ``.service`` and drop folder ``.conf`` files. Data based on Ubuntu 22.04 LTS default files."""  # noqa: E501
+
+    fs_unix.map_file(
+        "/lib/systemd/system/systemd-localed.service",
+        str(absolute_path("_data/plugins/os/unix/linux/services/systemd-localed.service")),
+    )
+    fs_unix.map_file(
+        "/lib/systemd/system/systemd-localed.service.d/locale-gen.conf",
+        str(absolute_path("_data/plugins/os/unix/linux/services/locale-gen.conf")),
+    )
+    fs_unix.map_file_fh(
+        "/lib/systemd/system/systemd-localed.service.d/test.conf",
+        BytesIO(b"[Unit]\nDescription=Another Description\n"),
+    )
+
+    target_unix.add_plugin(ServicesPlugin)
+    results = list(target_unix.services())
+
+    # Make sure we convert duplicate values to a list
+    assert results[0].Unit_Description == ["Locale Service", "Another Description"]
+
+    # Make sure we convert multiple entries to a list
+    assert results[0].Unit_Documentation == [
+        "man:systemd-localed.service(8)",
+        "man:locale.conf(5)",
+        "man:vconsole.conf(5)",
+        "man:org.freedesktop.locale1(5)",
+    ]
+
+    # Make sure we map empty values to None
+    assert results[0].Service_CapabilityBoundingSet is None
+
+    # Make sure we merge .service entries and drop file entries into a single list
+    assert results[0].Service_ReadWritePaths == ["/etc", "/usr/lib/locale", "/usr/lib/locale/"]
+
+    # We do not have visibility in the parsed drop files since that is handled internally by the drop file configparser
+    assert results[0].source == "/lib/systemd/system/systemd-localed.service"

{dissect_target-3.23.dev67 → dissect_target-3.23.dev69}/tests/plugins/os/windows/test_mru.py

@@ -56,6 +56,29 @@ def target_win_mru(target_win_users: Target) -> Target:
     opensave_sub_key.add_value("b", VirtualValue(user_hive, "b", "C:\\path\\to\\sub\\b"))
     opensave_key.add_subkey("*", opensave_sub_key)
 
+    # OpenSavePidlMRU
+    opensave_pidl_key = VirtualKey(
+        user_hive, "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\OpenSavePidlMRU"
+    )
+    opensave_pidl_subkey = VirtualKey(user_hive, opensave_pidl_key.path + "\\*")
+    opensave_pidl_subkey.add_value(
+        "MRUListEx",
+        VirtualValue(
+            user_hive,
+            "MRUListEx",
+            b"\x08\x00\x00\x00\t\x00\x00\x00\x07\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x03\x00\x00\x00\x05\x00\x00\x00\x04\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00\x12\x00\x00\x00\x11\x00\x00\x00\x10\x00\x00\x00\x0f\x00\x00\x00\x0e\x00\x00\x00\r\x00\x00\x00\x0c\x00\x00\x00\x0b\x00\x00\x00\n\x00\x00\x00\xff\xff\xff\xff",
+        ),
+    )
+    opensave_pidl_subkey.add_value(
+        "0",
+        VirtualValue(
+            user_hive,
+            "0",
+            b"\x14\x00\x1fP\xe0O\xd0 \xea:i\x10\xa2\xd8\x08\x00+00\x9d\x19\x00/Z:\\\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00p\x002\x00\xef\x1d\x01\x00dR|j \x00W9R717~O.ZIP\x00\x00T\x00\t\x00\x04\x00\xef\xbedR|jdR|j.\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00W\x00e\x00b\x00 \x00O\x00p\x00t\x00i\x00m\x00i\x00z\x00e\x00r\x00.\x00z\x00i\x00p\x00\x00\x00\x1c\x00\x00\x00",  # noqa: E501
+        ),
+    )
+    opensave_pidl_key.add_subkey("*", opensave_pidl_subkey)
+
     # LastVisitedMRU
     lastvisited_key = VirtualKey(
         user_hive, "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\LastVisitedMRU"
@@ -66,6 +89,27 @@ def target_win_mru(target_win_users: Target) -> Target:
     lastvisited_key.add_value("a", VirtualValue(user_hive, "a", value_a))
     lastvisited_key.add_value("b", VirtualValue(user_hive, "b", value_b))
 
+    # LastVisitedPidlMRU
+    lastvisited_pidl_key = VirtualKey(
+        user_hive, "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\LastVisitedPidlMRU"
+    )
+    lastvisited_pidl_key.add_value(
+        "MRUListEx",
+        VirtualValue(
+            user_hive,
+            "MRUListEx",
+            b"\x05\x00\x00\x00\x07\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x04\x00\x00\x00\x03\x00\x00\x00\x01\x00\x00\x00\xff\xff\xff\xff",
+        ),
+    )
+    lastvisited_pidl_key.add_value(
+        "1",
+        VirtualValue(
+            user_hive,
+            "1",
+            b"K\x00e\x00e\x00P\x00a\x00s\x00s\x00.\x00e\x00x\x00e\x00\x00\x00\x14\x00\x1fP\xe0O\xd0 \xea:i\x10\xa2\xd8\x08\x00+00\x9d\x14\x00.\x80\x92+\x16\xd3e\x93zF\x95k\x92p:\xca\x08\xaf\x00\x00",  # noqa: E501
+        ),
+    )
+
     # ACMru
     acmru_key = VirtualKey(user_hive, "Software\\Microsoft\\Search Assistant\\ACMru\\5603")
     acmru_key.add_value("000", VirtualValue(user_hive, "000", "value"))
@@ -109,7 +153,9 @@ def target_win_mru(target_win_users: Target) -> Target:
         run_key,
         recentdocs_key,
         opensave_key,
+        opensave_pidl_key,
         lastvisited_key,
+        lastvisited_pidl_key,
         acmru_key,
         wordwheel_key,
         networkdrive_key,
@@ -142,11 +188,16 @@ def test_mru_plugin(target_win_mru: Target) -> None:
 
     assert len(run) == 2
     assert len(recentdocs) == 1
-    assert len(opensave) == 4
-    assert len(lastvisited) == 2
+    assert len(opensave) == 5
+    # test if opensave_pidl_key is correctly resolved
+    assert opensave[4].value == "My Computer\\Z:\\Web Optimizer.zip"
+    assert len(lastvisited) == 3
+    # test if lastvisited_pidl_key is correctly resolved
+    assert lastvisited[2].filename == "KeePass.exe"
+    assert lastvisited[2].path == "My Computer\\{d3162b92-9365-467a-956b-92703aca08af}\\"
     assert len(acmru) == 3
     assert len(networkdrive) == 2
     assert len(mstsc) == 3
     assert len(msoffice) == 6
 
-    assert len(list(target_win_mru.mru())) == 23
+    assert len(list(target_win_mru.mru())) == 25