dissect.target 3.23.dev9__tar.gz → 3.23.dev11__tar.gz

{dissect_target-3.23.dev9 → dissect_target-3.23.dev11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev9
+Version: 3.23.dev11
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.23.dev9 → dissect_target-3.23.dev11}/dissect/target/plugin.py

@@ -1258,6 +1258,22 @@ class OSPlugin(Plugin):
         """
         raise NotImplementedError
 
+    @internal
+    def os_tree(self) -> list[str]:
+        """Returns the :func:`os` value of this and all the OS plugin parents."""
+        result: list[str] = []
+        for klass in self.__class__.mro():
+            if not issubclass(klass, OSPlugin):
+                # In case the plugin extends multiple different classes.
+                continue
+
+            if klass is OSPlugin:
+                break
+
+            result.append(klass.os.__get__(self))
+        # dicts maintain insertion order, we use it here to get rid of duplicates
+        return list(dict.fromkeys(result))
+
     @export(property=True)
     def architecture(self) -> str | None:
         """Return a slug of the target's OS architecture.

{dissect_target-3.23.dev9 → dissect_target-3.23.dev11}/dissect/target/plugins/os/windows/dpapi/keyprovider/lsa.py

@@ -6,9 +6,7 @@ from dissect.cstruct import cstruct
 
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.plugin import export
-from dissect.target.plugins.os.windows.dpapi.keyprovider.keyprovider import (
-    KeyProviderPlugin,
-)
+from dissect.target.plugins.os.windows.dpapi.keyprovider.keyprovider import KeyProviderPlugin
 
 if TYPE_CHECKING:
     from collections.abc import Iterator
@@ -36,15 +34,15 @@ class LSADefaultPasswordKeyProviderPlugin(KeyProviderPlugin):
 
     @export(output="yield")
     def keys(self) -> Iterator[tuple[str, str]]:
-        """Yield Windows LSA DefaultPassword strings.
+        """Yield Windows LSA DefaultPassword decrypted strings.
 
-        Currently extracts decrypted ``DefaultPassword`` values from LSA.
-        Does not yet parse ``HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\DefaultPassword``.
+        Extracts decrypted ``DefaultPassword`` values from the LSA.
 
         Resources:
             - https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon
         """
 
+        # Search for DefaultPassword values in the LSA
         for secret in ["DefaultPassword", "DefaultPassword_OldVal"]:
             if default_pass := self.target.lsa._secrets.get(secret):
                 try:

dissect_target-3.23.dev11/dissect/target/plugins/os/windows/dpapi/keyprovider/winlogon.py

@@ -0,0 +1,36 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.target.exceptions import RegistryValueNotFoundError, UnsupportedPluginError
+from dissect.target.plugin import export
+from dissect.target.plugins.os.windows.dpapi.keyprovider.keyprovider import KeyProviderPlugin
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+
+class WinlogonDefaultPasswordKeyProviderPlugin(KeyProviderPlugin):
+    """Windows Winlogon DefaultPassword key provider plugin."""
+
+    __namespace__ = "_dpapi_keyprovider_winlogon_defaultpassword"
+
+    def check_compatible(self) -> None:
+        if not self.target.has_function("registry"):
+            raise UnsupportedPluginError("Windows registry plugin not available on target")
+
+    @export(output="yield")
+    def keys(self) -> Iterator[tuple[str, str]]:
+        """Yield Windows Winlogon DefaultPassword strings.
+
+        Extracts plaintext ``DefaultPassword`` values from the ``Winlogon`` registry.
+
+        Resources:
+            - https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon
+        """
+
+        for key in self.target.registry.keys("HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"):
+            try:
+                yield self.__namespace__, key.value("DefaultPassword").value
+            except RegistryValueNotFoundError:  # noqa: PERF203
+                pass

{dissect_target-3.23.dev9 → dissect_target-3.23.dev11}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev9
+Version: 3.23.dev11
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.23.dev9 → dissect_target-3.23.dev11}/dissect.target.egg-info/SOURCES.txt

@@ -375,6 +375,7 @@ dissect/target/plugins/os/windows/dpapi/keyprovider/empty.py
 dissect/target/plugins/os/windows/dpapi/keyprovider/keychain.py
 dissect/target/plugins/os/windows/dpapi/keyprovider/keyprovider.py
 dissect/target/plugins/os/windows/dpapi/keyprovider/lsa.py
+dissect/target/plugins/os/windows/dpapi/keyprovider/winlogon.py
 dissect/target/plugins/os/windows/exchange/__init__.py
 dissect/target/plugins/os/windows/exchange/exchange.py
 dissect/target/plugins/os/windows/log/__init__.py
@@ -690,7 +691,6 @@ tests/plugins/os/windows/test_catroot.py
 tests/plugins/os/windows/test_clfs.py
 tests/plugins/os/windows/test_datetime.py
 tests/plugins/os/windows/test_defender.py
-tests/plugins/os/windows/test_dpapi.py
 tests/plugins/os/windows/test_env.py
 tests/plugins/os/windows/test_generic.py
 tests/plugins/os/windows/test_jumplist.py
@@ -715,6 +715,12 @@ tests/plugins/os/windows/credential/__init__.py
 tests/plugins/os/windows/credential/test_credhist.py
 tests/plugins/os/windows/credential/test_lsa.py
 tests/plugins/os/windows/credential/test_sam.py
+tests/plugins/os/windows/dpapi/__init__.py
+tests/plugins/os/windows/dpapi/test_dpapi.py
+tests/plugins/os/windows/dpapi/keyprovider/__init__.py
+tests/plugins/os/windows/dpapi/keyprovider/test_empty.py
+tests/plugins/os/windows/dpapi/keyprovider/test_keychain.py
+tests/plugins/os/windows/dpapi/keyprovider/test_winlogon.py
 tests/plugins/os/windows/log/__init__.py
 tests/plugins/os/windows/log/test_amcache.py
 tests/plugins/os/windows/log/test_etl.py

dissect_target-3.23.dev11/tests/plugins/os/windows/dpapi/keyprovider/test_empty.py

@@ -0,0 +1,18 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.target.plugins.os.windows.dpapi.keyprovider.empty import EmptyKeyProviderPlugin
+
+if TYPE_CHECKING:
+    from dissect.target.target import Target
+
+
+def test_dpapi_keyprovider_empty(target_win: Target) -> None:
+    """test if we yield an empty key correctly."""
+
+    target_win.add_plugin(EmptyKeyProviderPlugin)
+
+    key = next(target_win._dpapi_keyprovider_empty())
+
+    assert key == ("_dpapi_keyprovider_empty", "")

dissect_target-3.23.dev11/tests/plugins/os/windows/dpapi/keyprovider/test_keychain.py

@@ -0,0 +1,36 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.target.helpers import keychain
+from dissect.target.plugins.os.windows.dpapi.keyprovider.keychain import KeychainKeyProviderPlugin
+
+if TYPE_CHECKING:
+    from dissect.target.target import Target
+
+
+def test_dpapi_keyprovider_keychain(target_win: Target) -> None:
+    """test if we yield provided keychain items correctly."""
+
+    keychain.KEYCHAIN.clear()
+    keychain.register_key(
+        key_type=keychain.KeyType.PASSPHRASE,
+        value="password1",
+        identifier=None,
+        provider="user",
+    )
+    keychain.register_key(
+        key_type=keychain.KeyType.PASSPHRASE,
+        value="password2",
+        identifier=None,
+        provider=None,
+    )
+
+    target_win.add_plugin(KeychainKeyProviderPlugin)
+
+    keys = list(target_win._dpapi_keyprovider_keychain())
+
+    assert keys == [
+        ("_dpapi_keyprovider_keychain", "password1"),
+        ("_dpapi_keyprovider_keychain", "password2"),
+    ]

dissect_target-3.23.dev11/tests/plugins/os/windows/dpapi/keyprovider/test_winlogon.py

@@ -0,0 +1,25 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.target.helpers.regutil import VirtualKey
+from dissect.target.plugins.os.windows.dpapi.keyprovider.winlogon import WinlogonDefaultPasswordKeyProviderPlugin
+
+if TYPE_CHECKING:
+    from dissect.target.helpers.regutil import VirtualHive
+    from dissect.target.target import Target
+
+
+def test_dpapi_keyprovider_winlogon(target_win: Target, hive_hklm: VirtualHive) -> None:
+    """test if we find a Winlogon DefaultPassword entry in the registry."""
+
+    winlogon_path = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"
+    winlogon_key = VirtualKey(hive_hklm, winlogon_path)
+    winlogon_key.add_value("DefaultPassword", "password")
+    hive_hklm.map_key(winlogon_path, winlogon_key)
+
+    target_win.add_plugin(WinlogonDefaultPasswordKeyProviderPlugin)
+
+    key = next(target_win._dpapi_keyprovider_winlogon_defaultpassword())
+
+    assert key == ("_dpapi_keyprovider_winlogon_defaultpassword", "password")

{dissect_target-3.23.dev9 → dissect_target-3.23.dev11}/tests/test_plugin.py

@@ -42,6 +42,9 @@ from dissect.target.plugin import (
 from dissect.target.plugins.apps.other.env import EnvironmentFilePlugin
 from dissect.target.plugins.general.users import UsersPlugin
 from dissect.target.plugins.os.default._os import DefaultOSPlugin
+from dissect.target.plugins.os.unix.linux._os import LinuxPlugin
+from dissect.target.plugins.os.unix.linux.debian._os import DebianPlugin
+from dissect.target.plugins.os.unix.linux.fortios._os import FortiOSPlugin
 from dissect.target.target import Target
 
 if TYPE_CHECKING:
@@ -1159,6 +1162,21 @@ def test_os_plugin___init_subclass__(subclass: type[OSPlugin], replaced: bool) -
             assert subclass_docstring == f"Test docstring {method_name}."
 
 
+@pytest.mark.parametrize(
+    argnames=("os_plugin", "results"),
+    argvalues=[
+        (LinuxPlugin, ["linux", "unix"]),
+        (FortiOSPlugin, ["fortios", "linux", "unix"]),
+        (DebianPlugin, ["linux", "unix"]),
+    ],
+)
+def test_os_tree(target_bare: Target, os_plugin: type[OSPlugin], results: list[str]) -> None:
+    """Test if we correctly return the OS name tree."""
+    target_bare._os_plugin = os_plugin
+    target_bare.apply()
+    assert target_bare.os_tree() == results
+
+
 class _TestInternalPlugin(InternalPlugin):
     def test(self) -> None:
         pass