dissect.target 3.25.dev11__tar.gz → 3.25.dev14__tar.gz

{dissect_target-3.25.dev11 → dissect_target-3.25.dev14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev11
+Version: 3.25.dev14
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{dissect_target-3.25.dev11 → dissect_target-3.25.dev14}/dissect/target/plugins/apps/browser/browser.py

@@ -142,4 +142,4 @@ def try_idna(url: str) -> bytes:
     try:
         return url.encode("idna")
     except Exception:
-        return url
+        return url.encode()

{dissect_target-3.25.dev11 → dissect_target-3.25.dev14}/dissect/target/plugins/apps/ssh/openssh.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import base64
+import binascii
 import re
 from itertools import product
 from typing import TYPE_CHECKING
@@ -78,9 +79,19 @@ class OpenSSHPlugin(SSHPlugin):
                 except ValueError:
                     continue
 
+                public_key_pem = None
+                fingerprints = None
+                try:
+                    public_key_pem = base64.b64decode(public_key)
+                    fingerprints = calculate_fingerprints(public_key_pem)
+                except (TypeError, ValueError, binascii.Error) as e:
+                    self.target.log.warning("Unable to parse public key %r in %s: %s", line, authorized_keys_file, e)
+                    self.target.log.debug("", exc_info=e)
+
                 yield AuthorizedKeysRecord(
                     key_type=keytype,
-                    public_key=public_key,
+                    public_key_pem=public_key_pem,
+                    fingerprint=fingerprints,
                     comment=comment,
                     options=options,
                     path=authorized_keys_file,
@@ -103,12 +114,22 @@ class OpenSSHPlugin(SSHPlugin):
                 except ValueError:
                     continue
 
+                public_key_pem = None
+                fingerprints = None
+                try:
+                    public_key_pem = base64.b64decode(public_key)
+                    fingerprints = calculate_fingerprints(public_key_pem)
+                except (TypeError, ValueError, binascii.Error) as e:
+                    self.target.log.warning("Unable to parse public key %r in %s: %s", line, known_hosts_file, e)
+                    self.target.log.debug("", exc_info=e)
+
                 for hostname in hostnames:
                     yield KnownHostRecord(
                         host=hostname,
                         port=None,
                         key_type=keytype,
-                        public_key=public_key,
+                        public_key_pem=public_key_pem,
+                        fingerprint=fingerprints,
                         comment=comment,
                         marker=marker,
                         path=known_hosts_file,
@@ -135,11 +156,26 @@ class OpenSSHPlugin(SSHPlugin):
                 self.target.log.debug("", exc_info=e)
                 continue
 
+            # For certain formats, the public key is not parsed from the private keys
+            public_key_pem = None
+            fingerprints = None
+            if private_key.public_key:
+                try:
+                    public_key_pem = base64.b64decode(private_key.public_key)
+                    fingerprints = calculate_fingerprints(public_key_pem)
+                except (TypeError, ValueError, binascii.Error) as e:
+                    self.target.log.warning(
+                        "Unable to parse public key %r in %s: %s", private_key.public_key, file_path, e
+                    )
+                    self.target.log.debug("", exc_info=e)
+
             yield PrivateKeyRecord(
                 mtime_ts=file_path.stat().st_mtime,
                 key_format=private_key.format,
                 key_type=private_key.key_type,
-                public_key=private_key.public_key,
+                private_key_pem=buffer,
+                public_key_pem=public_key_pem,
+                fingerprint=fingerprints,
                 comment=private_key.comment,
                 encrypted=private_key.is_encrypted,
                 path=file_path,
@@ -157,8 +193,9 @@ class OpenSSHPlugin(SSHPlugin):
 
             try:
                 key_type, public_key, comment = parse_ssh_public_key_file(file_path)
-                fingerprints = calculate_fingerprints(base64.b64decode(public_key))
-            except Exception as e:
+                public_key_pem = base64.b64decode(public_key)
+                fingerprints = calculate_fingerprints(public_key_pem)
+            except (TypeError, ValueError, binascii.Error) as e:
                 self.target.log.warning("Failed to parse SSH public key %s: %s", file_path, e)
                 self.target.log.debug("", exc_info=e)
                 continue
@@ -166,7 +203,7 @@ class OpenSSHPlugin(SSHPlugin):
             yield PublicKeyRecord(
                 mtime_ts=file_path.stat().st_mtime,
                 key_type=key_type,
-                public_key=public_key,
+                public_key_pem=public_key_pem,
                 comment=comment,
                 fingerprint=fingerprints,
                 path=file_path,

{dissect_target-3.25.dev11 → dissect_target-3.25.dev14}/dissect/target/plugins/apps/ssh/putty.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import base64
 from base64 import b64decode
 from typing import TYPE_CHECKING
 
@@ -120,6 +121,7 @@ class PuTTYPlugin(SSHPlugin):
 
             try:
                 public_key, fingerprints = construct_public_key(key_type, entry.value)
+                public_key_pem = base64.b64decode(public_key)
             except Exception as e:
                 self.target.log.warning("Failed to parse PuTTY public key %r in registry %s: %s", entry.value, entry, e)
                 self.target.log.debug("", exc_info=e)
@@ -130,7 +132,7 @@ class PuTTYPlugin(SSHPlugin):
                 host=host,
                 port=port,
                 key_type=key_type,
-                public_key=public_key,
+                public_key_pem=public_key_pem,
                 fingerprint=fingerprints,
                 comment="",
                 marker=None,
@@ -153,6 +155,7 @@ class PuTTYPlugin(SSHPlugin):
 
                 try:
                     public_key, fingerprints = construct_public_key(key_type, parts[1])
+                    public_key_pem = base64.b64decode(public_key)
                 except Exception as e:
                     self.target.log.warning(
                         "Failed to parse PuTTY public key %r in file %s: %s", line, ssh_host_keys_path, e
@@ -165,7 +168,7 @@ class PuTTYPlugin(SSHPlugin):
                     host=host,
                     port=port,
                     key_type=key_type,
-                    public_key=public_key,
+                    public_key_pem=public_key_pem,
                     fingerprint=fingerprints,
                     comment="",
                     marker=None,

{dissect_target-3.25.dev11 → dissect_target-3.25.dev14}/dissect/target/plugins/apps/ssh/ssh.py

@@ -64,7 +64,8 @@ AuthorizedKeysRecord = OpenSSHUserRecordDescriptor(
     "application/openssh/authorized_keys",
     [
         *COMMON_ELLEMENTS,
-        ("string", "public_key"),
+        ("bytes", "public_key_pem"),
+        ("digest", "fingerprint"),
         ("string", "options"),
     ],
 )
@@ -77,7 +78,7 @@ KnownHostRecord = OpenSSHUserRecordDescriptor(
         *COMMON_ELLEMENTS,
         ("string", "host"),
         ("varint", "port"),
-        ("string", "public_key"),
+        ("bytes", "public_key_pem"),
         ("string", "marker"),
         ("digest", "fingerprint"),
     ],
@@ -90,7 +91,9 @@ PrivateKeyRecord = OpenSSHUserRecordDescriptor(
         ("datetime", "mtime_ts"),
         *COMMON_ELLEMENTS,
         ("string", "key_format"),
-        ("string", "public_key"),
+        ("bytes", "private_key_pem"),
+        ("bytes", "public_key_pem"),
+        ("digest", "fingerprint"),
         ("boolean", "encrypted"),
     ],
 )
@@ -100,7 +103,7 @@ PublicKeyRecord = OpenSSHUserRecordDescriptor(
     [
         ("datetime", "mtime_ts"),
         *COMMON_ELLEMENTS,
-        ("string", "public_key"),
+        ("bytes", "public_key_pem"),
         ("digest", "fingerprint"),
     ],
 )

dissect_target-3.25.dev14/dissect/target/plugins/os/windows/certlog.py

@@ -0,0 +1,359 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Union
+
+from dissect.database.ese.tools import certlog
+from dissect.database.exception import Error
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, export
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+    from pathlib import Path
+
+    from dissect.target.target import Target
+
+RequestAttributeRecord = TargetRecordDescriptor(
+    "filesystem/windows/certlog/request_attribute",
+    [
+        ("string", "attribute_name"),
+        ("string", "common_name"),
+        ("varint", "request_id"),
+        ("string", "table_name"),
+        ("string", "ca"),
+        ("path", "source"),
+    ],
+)
+
+CertificateExtensionRecord = TargetRecordDescriptor(
+    "filesystem/windows/certlog/certificate_extension",
+    [
+        ("varint", "extension_flags"),
+        ("string", "extension_name"),
+        ("bytes", "extension_raw_value"),
+        ("varint", "request_id"),
+        ("string", "table_name"),
+        ("string", "ca"),
+        ("path", "source"),
+    ],
+)
+
+CertificateRecord = TargetRecordDescriptor(
+    "filesystem/windows/certlog/certificate",
+    [
+        ("string", "certificate_hash2"),
+        ("string", "certificate_template"),
+        ("string", "common_name"),
+        ("string", "country"),
+        ("string", "device_serial_number"),
+        ("string", "distinguished_name"),
+        ("string", "domain_component"),
+        ("string", "email"),
+        ("string", "given_name"),
+        ("string", "initials"),
+        ("string", "locality"),
+        ("string", "organization"),
+        ("string", "organizational_unit"),
+        ("string", "public_key_algorithm"),
+        ("string", "serial_number"),
+        ("string", "state_or_province"),
+        ("string", "street_address"),
+        ("string", "subject_key_identifier"),
+        ("string", "sur_name"),
+        ("string", "title"),
+        ("string", "unstructured_address"),
+        ("string", "unstructured_name"),
+        ("string", "upn"),
+        ("string", "enrollment_flags"),
+        ("string", "general_flags"),
+        ("string", "issuer_name_id"),
+        ("datetime", "not_after"),
+        ("datetime", "not_before"),
+        ("string", "private_key_flags"),
+        ("string", "public_key"),
+        ("varint", "public_key_length"),
+        ("string", "public_key_params"),
+        ("string", "publish_expired_cert_in_crl"),
+        ("bytes", "raw_certificate"),
+        ("bytes", "raw_name"),
+        ("varint", "request_id"),
+        ("string", "table_name"),
+        ("string", "ca"),
+        ("path", "source"),
+    ],
+)
+
+RequestRecord = TargetRecordDescriptor(
+    "filesystem/windows/certlog/request",
+    [
+        ("string", "attestation_challenge"),
+        ("string", "caller_name"),
+        ("string", "common_name"),
+        ("string", "country"),
+        ("string", "device_serial_number"),
+        ("string", "disposition"),
+        ("string", "disposition_message"),
+        ("string", "distinguished_name"),
+        ("string", "domain_component"),
+        ("string", "email"),
+        ("string", "endorsement_certificate_hash"),
+        ("string", "endorsement_key_hash"),
+        ("string", "given_name"),
+        ("string", "initials"),
+        ("string", "key_recovery_hashes"),
+        ("string", "locality"),
+        ("string", "organization"),
+        ("string", "organizational_unit"),
+        ("string", "raw_archived_key"),
+        ("bytes", "raw_name"),
+        ("bytes", "raw_old_certificate"),
+        ("bytes", "raw_precertificate"),
+        ("bytes", "raw_request"),
+        ("string", "request_attributes"),
+        ("string", "requester_name"),
+        ("string", "request_flags"),
+        ("varint", "request_id"),
+        ("string", "request_type"),
+        ("datetime", "resolved_when"),
+        ("string", "revoked_effective_when"),
+        ("string", "revoked_reason"),
+        ("datetime", "revoked_when"),
+        ("string", "signer_application_policies"),
+        ("string", "signer_policies"),
+        ("string", "state_or_province"),
+        ("string", "request_status_code"),
+        ("string", "street_address"),
+        ("datetime", "submitted_when"),
+        ("string", "sur_name"),
+        ("string", "title"),
+        ("string", "unstructured_address"),
+        ("string", "unstructured_name"),
+        ("string", "table_name"),
+        ("string", "ca"),
+        ("path", "source"),
+    ],
+)
+
+CRLRecord = TargetRecordDescriptor(
+    "filesystem/windows/certlog/crl",
+    [
+        ("varint", "count"),
+        ("datetime", "crl_last_published"),
+        ("varint", "crl_publish_attempts"),
+        ("string", "crl_publish_error"),
+        ("varint", "crl_publish_flags"),
+        ("varint", "crl_publish_status_code"),
+        ("datetime", "ts_effective"),
+        ("string", "min_base"),
+        ("varint", "name_id"),
+        ("datetime", "next_publish"),
+        ("datetime", "next_update"),
+        ("varint", "number"),
+        ("datetime", "propagation_complete"),
+        ("bytes", "raw_crl"),
+        ("varint", "row_id"),
+        ("datetime", "this_publish"),
+        ("datetime", "this_update"),
+        ("string", "table_name"),
+        ("string", "ca"),
+        ("path", "source"),
+    ],
+)
+
+CertLogRecord = Union[  # noqa: UP007
+    RequestRecord, RequestAttributeRecord, CertificateRecord, CRLRecord, CertificateExtensionRecord
+]
+
+# {i: "".join("_" + c.lower() if c.isupper() else c for c in i.replace('$', ''))[1:] for i in a}
+FIELD_MAPPINGS = {
+    "$AttributeName": "attribute_name",
+    "$AttributeValue": "common_name",
+    "$CRLPublishError": "crl_publish_error",
+    "$CallerName": "caller_name",
+    "$CertificateHash2": "certificate_hash2",
+    "$CertificateTemplate": "certificate_template",
+    "$CommonName": "common_name",
+    "$Country": "country",
+    "$DeviceSerialNumber": "device_serial_number",
+    "$DispositionMessage": "disposition_message",
+    "$DistinguishedName": "distinguished_name",
+    "$DomainComponent": "domain_component",
+    "$EMail": "email",
+    "$EndorsementCertificateHash": "endorsement_certificate_hash",
+    "$EndorsementKeyHash": "endorsement_key_hash",
+    "$ExtensionName": "extension_name",
+    "$GivenName": "given_name",
+    "$Initials": "initials",
+    "$KeyRecoveryHashes": "key_recovery_hashes",
+    "$Locality": "locality",
+    "$Organization": "organization",
+    "$OrganizationalUnit": "organizational_unit",
+    "$PublicKeyAlgorithm": "public_key_algorithm",
+    "$RequestAttributes": "request_attributes",
+    "$RequesterName": "requester_name",
+    "$SerialNumber": "serial_number",
+    "$SignerApplicationPolicies": "signer_application_policies",
+    "$SignerPolicies": "signer_policies",
+    "$StateOrProvince": "state_or_province",
+    "$StreetAddress": "street_address",
+    "$SubjectKeyIdentifier": "subject_key_identifier",
+    "$SurName": "sur_name",
+    "$Title": "title",
+    "$UPN": "upn",
+    "$UnstructuredAddress": "unstructured_address",
+    "$UnstructuredName": "unstructured_name",
+    "AttestationChallenge": "attestation_challenge",
+    "CRLLastPublished": "crl_last_published",
+    "CRLPublishAttempts": "crl_publish_attempts",
+    "CRLPublishFlags": "crl_publish_flags",
+    "CRLPublishStatusCode": "crl_publish_status_code",
+    "Count": "count",
+    "Disposition": "disposition",
+    "Effective": "ts_effective",  # prevent record_field_inconsistency
+    "EnrollmentFlags": "enrollment_flags",
+    "ExtensionFlags": "extension_flags",
+    "ExtensionRawValue": "extension_raw_value",
+    "GeneralFlags": "general_flags",
+    "IssuerNameID": "issuer_name_id",
+    "MinBase": "min_base",
+    "NameId": "name_id",
+    "NextPublish": "next_publish",
+    "NextUpdate": "next_update",
+    "NotAfter": "not_after",
+    "NotBefore": "not_before",
+    "Number": "number",
+    "PrivateKeyFlags": "private_key_flags",
+    "PropagationComplete": "propagation_complete",
+    "PropgationComplete": "propagation_complete",  # typo in some Windows versions
+    "PublicKey": "public_key",
+    "PublicKeyLength": "public_key_length",
+    "PublicKeyParams": "public_key_params",
+    "PublishExpiredCertInCRL": "publish_expired_cert_in_crl",
+    "RawArchivedKey": "raw_archived_key",
+    "RawCRL": "raw_crl",
+    "RawCertificate": "raw_certificate",
+    "RawName": "raw_name",
+    "RawOldCertificate": "raw_old_certificate",
+    "RawPrecertificate": "raw_precertificate",
+    "RawRequest": "raw_request",
+    "RequestFlags": "request_flags",
+    "RequestID": "request_id",
+    "RequestType": "request_type",
+    "ResolvedWhen": "resolved_when",
+    "RevokedEffectiveWhen": "revoked_effective_when",
+    "RevokedReason": "revoked_reason",
+    "RevokedWhen": "revoked_when",
+    "RowId": "row_id",
+    "StatusCode": "request_status_code",  # prevent record_field_inconsistency
+    "SubmittedWhen": "submitted_when",
+    "TableName": "table_name",
+    "ThisPublish": "this_publish",
+    "ThisUpdate": "this_update",
+}
+
+
+class CertLogPlugin(Plugin):
+    """Return all available data stored in CertLog databases.
+
+    Certificate Authority databases are databases related to the Active Directory Certificate Services (AD CS) feature.
+
+    References:
+        - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-csra/5f06c74c-1a29-4fdf-b8dd-ae3300d1b90d
+        - https://assets.crowdstrike.com/is/content/crowdstrikeinc/investigating-active-directory-certificate-abusepdf
+        - https://learn.microsoft.com/en-gb/troubleshoot/windows-server/certificates-and-public-key-infrastructure-pki/move-certificate-server-database-log-files
+    """
+
+    __namespace__ = "certlog"
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self._certlog_dbs: list[tuple[certlog.CertLog, Path]] = []
+        for path in self.get_paths():
+            try:
+                self._certlog_dbs.append((certlog.CertLog(path.open(mode="rb")), path))
+            except Error as e:  # noqa: PERF203
+                self.target.log.warning("Error opening Certlog database")
+                self.target.log.debug("", exc_info=e)
+
+    def _get_paths(self) -> Iterator[Path]:
+        """Return all artifact files of interest to the plugin."""
+        certlog_dir = self.target.resolve("%windir%/System32/CertLog")
+        if certlog_dir.exists():
+            yield from certlog_dir.glob("*.edb")
+
+    def check_compatible(self) -> None:
+        if not self._certlog_dbs:
+            raise UnsupportedPluginError("No Certificate Authority Databases found")
+
+    def read_records(self, table_name: str, record_type: CertLogRecord) -> Iterator[CertLogRecord]:
+        for db, path in self._certlog_dbs:
+            ca_name = path.stem
+            table = next((table for table in db.tables() if table.name == table_name), None)
+            if not table:
+                self.target.log.warning("Table not found for ca %s: %s", ca_name, table_name)
+                continue
+            columns = [c.name for c in table.columns]
+            for entry in db.records(table_name=table_name):
+                values = (entry[name] for name in columns)
+                column_values = zip(columns, values, strict=False)
+
+                record_values = {}
+                for column, value in column_values:
+                    new_column = FIELD_MAPPINGS.get(column)
+                    if new_column:
+                        record_values[new_column] = value
+                    else:
+                        self.target.log.debug(
+                            "Unexpected column for table %s in CA %s: %s", table_name, ca_name, column
+                        )
+
+                yield record_type(
+                    _target=self.target,
+                    source=path,
+                    table_name=table_name,
+                    ca=ca_name,
+                    **record_values,
+                )
+
+    @export(record=RequestRecord)
+    def requests(self) -> Iterator[RequestRecord]:
+        """Return the contents of the ``Requests`` table from all Certificate Authority databases.
+
+        Gives insight into certificates requested (caller name, request ID, request attributes).
+        """
+        yield from self.read_records("Requests", RequestRecord)
+
+    @export(record=RequestAttributeRecord)
+    def request_attributes(self) -> Iterator[RequestAttributeRecord]:
+        """Return the contents of the ``RequestAttributes`` table from all Certificate Authority databases.
+
+        Gives insight into attributes of requested certificates (same information as in ``request_attributes`` field
+        of ``Requests`` table).
+        """
+        yield from self.read_records("RequestAttributes", RequestAttributeRecord)
+
+    @export(record=CRLRecord)
+    def crls(self) -> Iterator[CRLRecord]:
+        """Return the contents of the ``CRLs`` table from all Certificate Authority databases.
+
+        Gives insight into the Certificate Revocation List of a Certificate Authority.
+        """
+        yield from self.read_records("CRLs", CRLRecord)
+
+    @export(record=CertificateRecord)
+    def certificates(self) -> Iterator[CertificateRecord]:
+        """Return the contents of ``Certificates`` table from all Certificate Authority databases.
+
+        Gives insight into issued certificates for a Certificate authority (public key, validity date).
+        """
+        yield from self.read_records("Certificates", CertificateRecord)
+
+    @export(record=CertificateExtensionRecord)
+    def certificate_extensions(self) -> Iterator[CertificateExtensionRecord]:
+        """Return the contents of ``CertificateExtensions`` table from all Certificate Authority databases.
+
+        Gives insight into certificate extensions for a CA.
+        """
+        yield from self.read_records("CertificateExtensions", CertificateExtensionRecord)

{dissect_target-3.25.dev11 → dissect_target-3.25.dev14}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev11
+Version: 3.25.dev14
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{dissect_target-3.25.dev11 → dissect_target-3.25.dev14}/dissect.target.egg-info/SOURCES.txt

@@ -346,6 +346,7 @@ dissect/target/plugins/os/windows/adpolicy.py
 dissect/target/plugins/os/windows/amcache.py
 dissect/target/plugins/os/windows/cam.py
 dissect/target/plugins/os/windows/catroot.py
+dissect/target/plugins/os/windows/certlog.py
 dissect/target/plugins/os/windows/cim.py
 dissect/target/plugins/os/windows/clfs.py
 dissect/target/plugins/os/windows/datetime.py
@@ -723,6 +724,7 @@ tests/plugins/os/windows/test_adpolicy.py
 tests/plugins/os/windows/test_amcache.py
 tests/plugins/os/windows/test_cam.py
 tests/plugins/os/windows/test_catroot.py
+tests/plugins/os/windows/test_certlog.py
 tests/plugins/os/windows/test_cim.py
 tests/plugins/os/windows/test_clfs.py
 tests/plugins/os/windows/test_datetime.py

{dissect_target-3.25.dev11 → dissect_target-3.25.dev14}/tests/plugins/apps/ssh/test_openssh.py

@@ -105,22 +105,37 @@ def test_authorized_keys_plugin(target_and_filesystem: tuple[Target, VirtualFile
     assert results[0].key_type == "ssh-ed25519"
     assert results[0].options is None
     assert results[0].comment == ""
+    assert results[0].fingerprint.md5 == "1f3d475966231eeb5455c8485dd030e4"
+    assert results[0].fingerprint.sha1 == "e39242ca1d74bea99285b212e908e18cc67e4dec"
+    assert results[0].fingerprint.sha256 == "7b77007b0b51a86ced6b5fe25639092484c4c39cf76b283ef65fdf49a00f44d2"
 
     assert results[1].key_type == "ssh-ed25519"
     assert results[1].options is None
     assert results[1].comment == "comment"
+    assert results[1].fingerprint.md5 == "1f3d475966231eeb5455c8485dd030e4"
+    assert results[1].fingerprint.sha1 == "e39242ca1d74bea99285b212e908e18cc67e4dec"
+    assert results[1].fingerprint.sha256 == "7b77007b0b51a86ced6b5fe25639092484c4c39cf76b283ef65fdf49a00f44d2"
 
     assert results[2].key_type == "ssh-ed25519"
     assert results[2].options is None
     assert results[2].comment == "long comment with spaces"
+    assert results[2].fingerprint.md5 == "1f3d475966231eeb5455c8485dd030e4"
+    assert results[2].fingerprint.sha1 == "e39242ca1d74bea99285b212e908e18cc67e4dec"
+    assert results[2].fingerprint.sha256 == "7b77007b0b51a86ced6b5fe25639092484c4c39cf76b283ef65fdf49a00f44d2"
 
     assert results[3].key_type == "ssh-ed25519"
     assert results[3].options == 'command="foo bar"'
     assert results[3].comment == ""
+    assert results[3].fingerprint.md5 == "1f3d475966231eeb5455c8485dd030e4"
+    assert results[3].fingerprint.sha1 == "e39242ca1d74bea99285b212e908e18cc67e4dec"
+    assert results[3].fingerprint.sha256 == "7b77007b0b51a86ced6b5fe25639092484c4c39cf76b283ef65fdf49a00f44d2"
 
     assert results[4].key_type == "ssh-ed25519"
     assert results[4].options == 'command="foo bar"'
     assert results[4].comment == "with a comment"
+    assert results[4].fingerprint.md5 == "1f3d475966231eeb5455c8485dd030e4"
+    assert results[4].fingerprint.sha1 == "e39242ca1d74bea99285b212e908e18cc67e4dec"
+    assert results[4].fingerprint.sha256 == "7b77007b0b51a86ced6b5fe25639092484c4c39cf76b283ef65fdf49a00f44d2"
 
 
 def test_known_hosts_plugin(target_and_filesystem: tuple[Target, VirtualFilesystem]) -> None:
@@ -216,11 +231,14 @@ def test_private_keys_plugin_rfc4716_ed25519(target_and_filesystem: tuple[Target
     assert private_key.key_format == "RFC4716"
     assert private_key.key_type == "ssh-ed25519"
     assert private_key.comment == "long comment here"
-    assert private_key.public_key == public_key_data
+    assert private_key.public_key_pem == base64.b64decode(public_key_data)
     assert not private_key.encrypted
     assert str(private_key.path).replace("\\", "/") == target_system.filesystem_path(
         "ssh_host_ed25519_key", TargetDir.SSHD
     ).replace(target_system.label, "\\sysvol\\").replace("\\", "/")
+    assert private_key.fingerprint.md5 == "1f3d475966231eeb5455c8485dd030e4"
+    assert private_key.fingerprint.sha1 == "e39242ca1d74bea99285b212e908e18cc67e4dec"
+    assert private_key.fingerprint.sha256 == "7b77007b0b51a86ced6b5fe25639092484c4c39cf76b283ef65fdf49a00f44d2"
 
 
 def test_private_keys_plugin_rfc4716_rsa_encrypted(target_and_filesystem: tuple[Target, VirtualFilesystem]) -> None:
@@ -290,12 +308,15 @@ def test_private_keys_plugin_rfc4716_rsa_encrypted(target_and_filesystem: tuple[
     assert len(results) == 1
     assert private_key.key_format == "RFC4716"
     assert private_key.key_type == "ssh-rsa"
-    assert private_key.public_key == public_key_data
+    assert private_key.public_key_pem == base64.b64decode(public_key_data)
     assert private_key.comment == ""
     assert private_key.encrypted
     assert str(private_key.path).replace("\\", "/") == target_system.filesystem_path(
         ".ssh/id_rsa", TargetDir.HOME
     ).replace("\\", "/")
+    assert private_key.fingerprint.md5 == "fd5c8ec37b91d356bba27a12639ef414"
+    assert private_key.fingerprint.sha1 == "f9aa4500bb49a27c0274e29e192696af2ae34ab3"
+    assert private_key.fingerprint.sha256 == "86f3cdff3ccb04cee5f0093408ba581b09018777a99feb1a77c37b11d30972ba"
 
 
 def test_private_keys_plugin_pem_ecdsa(target_and_filesystem: tuple[Target, VirtualFilesystem]) -> None:
@@ -400,7 +421,7 @@ def test_public_keys_plugin(target_and_filesystem: tuple[Target, VirtualFilesyst
     host_public_key = results[1]
 
     assert user_public_key.key_type == user_public_key_data.split(" ", 2)[0]
-    assert user_public_key.public_key == user_public_key_data.split(" ", 2)[1]
+    assert user_public_key.public_key_pem == base64.b64decode(user_public_key_data.split(" ", 2)[1])
     assert user_public_key.comment == user_public_key_data.split(" ", 2)[2]
     assert user_public_key.fingerprint.md5 == "1f3d475966231eeb5455c8485dd030e4"
     assert user_public_key.fingerprint.sha1 == "e39242ca1d74bea99285b212e908e18cc67e4dec"
@@ -410,7 +431,7 @@ def test_public_keys_plugin(target_and_filesystem: tuple[Target, VirtualFilesyst
     ).replace("\\", "/")
 
     assert host_public_key.key_type == host_public_key_data.split(" ", 2)[0]
-    assert host_public_key.public_key == host_public_key_data.split(" ", 2)[1]
+    assert host_public_key.public_key_pem == base64.b64decode(host_public_key_data.split(" ", 2)[1])
     assert host_public_key.comment == host_public_key_data.split(" ", 2)[2]
     assert host_public_key.fingerprint.md5 == "a3f2ebfa8d16efd321015e1618fd281b"
     assert host_public_key.fingerprint.sha1 == "f6656cc642fb08f53a1df77d0acff9852a649989"