dissect.target 3.25.dev51__tar.gz → 3.25.dev54__tar.gz

{dissect_target-3.25.dev51 → dissect_target-3.25.dev54}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev51
+Version: 3.25.dev54
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later
@@ -23,7 +23,7 @@ License-File: LICENSE
 License-File: COPYRIGHT
 Requires-Dist: defusedxml
 Requires-Dist: dissect.cstruct<5,>=4
-Requires-Dist: dissect.database<2,>=1.1.dev3
+Requires-Dist: dissect.database<2,>=1.1.dev4
 Requires-Dist: dissect.eventlog<4,>=3
 Requires-Dist: dissect.evidence<4,>=3.13.dev3
 Requires-Dist: dissect.hypervisor<4,>=3.21.dev3
@@ -70,7 +70,7 @@ Requires-Dist: dissect.cim[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.clfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.cramfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.cstruct<5.0.dev,>=4.0.dev; extra == "dev"
-Requires-Dist: dissect.database[dev]<2.0.dev,>=1.1.dev3; extra == "dev"
+Requires-Dist: dissect.database[dev]<2.0.dev,>=1.1.dev8; extra == "dev"
 Requires-Dist: dissect.etl[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.eventlog[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.evidence[dev]<4.0.dev,>=3.13.dev2; extra == "dev"

{dissect_target-3.25.dev51 → dissect_target-3.25.dev54}/dissect/target/plugins/os/unix/linux/proc.py

@@ -472,9 +472,10 @@ class ProcProcess:
     def _parse_environ(self) -> Iterator[Environ]:
         """Internal function to parse entries in ``/proc/[pid]/environ``."""
         # entries in /proc/<pid>/environ are null-terminated
-        lines = self.get("environ").read_text().split("\x00")
+        if not (environ_path := self.get("environ")).exists():
+            return
 
-        for line in lines:
+        for line in environ_path.read_text().split("\x00"):
             if line == "":
                 # Skip empty line
                 continue

{dissect_target-3.25.dev51 → dissect_target-3.25.dev54}/dissect/target/plugins/os/windows/_os.py

@@ -16,7 +16,7 @@ if TYPE_CHECKING:
     from typing_extensions import Self
 
     from dissect.target.filesystem import Filesystem
-    from dissect.target.plugins.os.windows.credential.sam import SamRecord
+    from dissect.target.plugins.os.windows.sam import SamRecord
     from dissect.target.target import Target
 
 ARCH_MAP = {

dissect_target-3.25.dev54/dissect/target/plugins/os/windows/ad/ntds.py

@@ -0,0 +1,188 @@
+from __future__ import annotations
+
+from datetime import datetime
+from functools import cached_property
+from typing import TYPE_CHECKING, Any
+
+from dissect.database.ese.ntds import NTDS
+
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, UnsupportedPluginError, export, internal
+from dissect.target.plugins.os.windows.sam import des_decrypt
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+    from dissect.database.ese.ntds.objects import Computer, User
+
+    from dissect.target.target import Target
+
+
+GENERIC_FIELDS = [
+    ("string", "cn"),
+    ("string", "upn"),
+    ("string", "sam_name"),
+    ("string", "sam_type"),
+    ("string", "description"),
+    ("string", "sid"),
+    ("varint", "rid"),
+    ("datetime", "password_last_set"),
+    ("datetime", "logon_last_failed"),
+    ("datetime", "logon_last_success"),
+    ("datetime", "account_expires"),
+    ("datetime", "creation_time"),
+    ("datetime", "last_modified_time"),
+    ("boolean", "admin_count"),
+    ("boolean", "is_deleted"),
+    ("string", "lm"),
+    ("string[]", "lm_history"),
+    ("string", "nt"),
+    ("string[]", "nt_history"),
+    ("string", "supplemental_credentials"),
+    ("string", "user_account_control"),
+    ("string[]", "object_classes"),
+    ("string", "distinguished_name"),
+    ("string", "object_guid"),
+    ("uint32", "primary_group_id"),
+    ("string[]", "member_of"),
+    ("string[]", "service_principal_name"),
+]
+
+# Record descriptor for NTDS user secrets
+NtdsUserRecord = TargetRecordDescriptor(
+    "windows/ad/user",
+    [
+        *GENERIC_FIELDS,
+        ("string", "info"),
+        ("string", "comment"),
+        ("string", "telephone_number"),
+        ("string", "home_directory"),
+    ],
+)
+NtdsComputerRecord = TargetRecordDescriptor(
+    "windows/ad/computer",
+    [
+        *GENERIC_FIELDS,
+        ("string", "dns_hostname"),
+        ("string", "operating_system"),
+        ("string", "operating_system_version"),
+    ],
+)
+
+
+# NTDS Registry consts
+NTDS_PARAMETERS_REGISTRY_PATH = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters"
+NTDS_PARAMETERS_DB_VALUE = "DSA Database file"
+
+# Default values
+DEFAULT_LM_HASH = "aad3b435b51404eeaad3b435b51404ee"
+DEFAULT_NT_HASH = "31d6cfe0d16ae931b73c59d7e0c089c0"
+
+
+class NtdsPlugin(Plugin):
+    """Plugin to parse NTDS.dit Active Directory database and extract user credentials.
+
+    This plugin extracts user password hashes, password history, Kerberos keys, and other authentication data
+    from the NTDS.dit database found on Windows Domain Controllers.
+    """
+
+    __namespace__ = "ad"
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self.path = None
+
+        if self.target.has_function("registry"):
+            key = self.target.registry.value(NTDS_PARAMETERS_REGISTRY_PATH, NTDS_PARAMETERS_DB_VALUE)
+            self.path = self.target.fs.path(key.value)
+
+    def check_compatible(self) -> None:
+        if not self.target.has_function("lsa"):
+            raise UnsupportedPluginError("System Hive is not present or LSA function not available")
+
+        if self.path is None or not self.path.is_file():
+            raise UnsupportedPluginError("No NTDS.dit database found on target")
+
+    @cached_property
+    @internal
+    def ntds(self) -> NTDS:
+        ntds = NTDS(self.path.open("rb"))
+
+        if self.target.has_function("lsa"):
+            ntds.pek.unlock(self.target.lsa.syskey)
+
+        return ntds
+
+    @export(record=NtdsUserRecord)
+    def users(self) -> Iterator[NtdsUserRecord]:
+        """Extract all user accounts from the NTDS.dit database."""
+        for user in self.ntds.users():
+            yield NtdsUserRecord(
+                **extract_user_info(user, self.target),
+                info=user.get("info"),
+                comment=user.get("comment"),
+                telephone_number=user.get("telephoneNumber"),
+                home_directory=user.get("homeDirectory"),
+                _target=self.target,
+            )
+
+    @export(record=NtdsComputerRecord)
+    def computers(self) -> Iterator[NtdsComputerRecord]:
+        """Extract all computer accounts from the NTDS.dit database."""
+        for computer in self.ntds.computers():
+            yield NtdsComputerRecord(
+                **extract_user_info(computer, self.target),
+                dns_hostname=computer.get("dNSHostName"),
+                operating_system=computer.get("operatingSystem"),
+                operating_system_version=computer.get("operatingSystemVersion"),
+                _target=self.target,
+            )
+
+
+def extract_user_info(user: User | Computer, target: Target) -> dict[str, Any]:
+    """Extract generic information from a User or Computer account."""
+
+    lm_hash = des_decrypt(lm_pwd, user.rid).hex() if (lm_pwd := user.get("dBCSPwd")) else DEFAULT_LM_HASH
+    nt_hash = des_decrypt(nt_pwd, user.rid).hex() if (nt_pwd := user.get("unicodePwd")) else DEFAULT_NT_HASH
+
+    # Decrypt password history
+    lm_history = [des_decrypt(lm, user.rid).hex() for lm in user.get("lmPwdHistory")]
+    nt_history = [des_decrypt(nt, user.rid).hex() for nt in user.get("ntPwdHistory")]
+
+    try:
+        member_of = [group.distinguished_name for group in user.groups()]
+    except Exception as e:
+        member_of = []
+        target.log.warning("Failed to extract group membership for user %s: %s", user, e)
+        target.log.debug("", exc_info=e)
+
+    # Extract supplemental credentials and yield records
+    return {
+        "cn": user.get("cn"),
+        "upn": user.get("userPrincipalName"),
+        "sam_name": user.sam_account_name,
+        "sam_type": user.sam_account_type.name,
+        "description": user.get("description"),
+        "sid": user.sid,
+        "rid": user.rid,
+        "password_last_set": user.get("pwdLastSet"),
+        "logon_last_failed": user.get("badPasswordTime"),
+        "logon_last_success": user.get("lastLogon"),
+        "account_expires": user.get("accountExpires") if isinstance(user.get("accountExpires"), datetime) else None,
+        "creation_time": user.when_created,
+        "last_modified_time": user.when_changed,
+        "admin_count": user.get("adminCount"),
+        "is_deleted": user.is_deleted,
+        "lm": lm_hash,
+        "lm_history": lm_history,
+        "nt": nt_hash,
+        "nt_history": nt_history,
+        "supplemental_credentials": user.get("supplementalCredentials"),
+        "user_account_control": user.user_account_control.name,
+        "object_classes": user.object_class,
+        "distinguished_name": user.distinguished_name,
+        "object_guid": user.guid,
+        "primary_group_id": user.primary_group_id,
+        "member_of": member_of,
+        "service_principal_name": user.get("servicePrincipalName"),
+    }

dissect_target-3.25.dev54/dissect/target/plugins/os/windows/credential/credential.py

@@ -0,0 +1,7 @@
+from __future__ import annotations
+
+from dissect.target.plugin import NamespacePlugin
+
+
+class WindowsCredentialPlugin(NamespacePlugin):
+    __namespace__ = "credential"

{dissect_target-3.25.dev51 → dissect_target-3.25.dev54}/dissect/target/plugins/os/windows/credential/credhist.py

@@ -13,7 +13,8 @@ from dissect.target.helpers import keychain
 from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
 from dissect.target.helpers.logging import get_logger
 from dissect.target.helpers.record import create_extended_descriptor
-from dissect.target.plugin import Plugin, export
+from dissect.target.plugin import export
+from dissect.target.plugins.os.windows.credential.credential import WindowsCredentialPlugin
 from dissect.target.plugins.os.windows.dpapi.crypto import (
     CipherAlgorithm,
     HashAlgorithm,
@@ -156,7 +157,7 @@ class CredHistFile:
             password_hash = entry.sha1
 
 
-class CredHistPlugin(Plugin):
+class CredHistPlugin(WindowsCredentialPlugin):
     """Windows CREDHIST file parser.
 
     Windows XP:         ``C:\\Documents and Settings\\username\\Application Data\\Microsoft\\Protect\\CREDHIST``
@@ -166,6 +167,8 @@ class CredHistPlugin(Plugin):
         - https://www.passcape.com/index.php?section=docsys&cmd=details&id=28#41
     """
 
+    __namespace__ = "credhist"
+
     def __init__(self, target: Target):
         super().__init__(target)
         self.files = list(self._find_files())
@@ -198,6 +201,9 @@ class CredHistPlugin(Plugin):
             for password in passwords:
                 credhist.decrypt(hashlib.sha1(password.encode("utf-16-le")).digest())
 
+            if not credhist.entries:
+                self.target.log.warning("File has no credhist entries: %s", path)
+
             for entry in credhist.entries:
                 yield CredHistRecord(
                     guid=entry.guid,

dissect_target-3.25.dev54/dissect/target/plugins/os/windows/credential/defaultpassword.py

@@ -0,0 +1,92 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.cstruct import cstruct
+
+from dissect.target.exceptions import RegistryKeyNotFoundError, UnsupportedPluginError
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import export
+from dissect.target.plugins.os.windows.credential.credential import WindowsCredentialPlugin
+from dissect.target.plugins.os.windows.lsa import LSAPlugin
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+defaultpassword_def = """
+struct DefaultPassword {
+    DWORD   length;
+    char    flags[4*3];
+    WCHAR   data[length/2];
+    // char    checksum_or_guid[0x10];
+};
+"""
+
+c_defaultpassword = cstruct().load(defaultpassword_def)
+
+DefaultPasswordRecord = TargetRecordDescriptor(
+    "windows/credential/default_password",
+    [
+        ("datetime", "ts_mtime"),
+        ("string", "default_password"),
+        ("path", "source"),
+    ],
+)
+
+
+class DefaultPasswordPlugin(WindowsCredentialPlugin):
+    """Windows LSA DefaultPassword plugin."""
+
+    __namespace__ = "defaultpassword"
+
+    def check_compatible(self) -> None:
+        if not self.target.has_function("lsa"):
+            raise UnsupportedPluginError("LSA plugin not available on target")
+
+    @export(record=DefaultPasswordRecord)
+    def defaultpassword(self) -> Iterator[DefaultPasswordRecord]:
+        """Yield decrypted Windows LSA DefaultPassword records.
+
+        Extracts decrypted ``DefaultPassword`` values from the LSA.
+
+        References:
+            - https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon
+        """
+
+        # Search for DefaultPassword values in the LSA
+        for secret in ["DefaultPassword", "DefaultPassword_OldVal"]:
+            if default_pass := self.target.lsa._secrets.get(secret):
+                # Ignore irrelevant DefaultPassword references
+                if "TBAL_{".encode("utf-16-le") in default_pass:
+                    continue
+
+                ts = None
+                try:
+                    ts = self.target.registry.key(
+                        f"{LSAPlugin.SECURITY_POLICY_KEY}\\Secrets\\{secret.replace('_OldVal', '')}"
+                    ).ts
+                except RegistryKeyNotFoundError:
+                    pass
+
+                if default_pass.startswith(b"\x00" * 16) and len(default_pass) == 32:
+                    yield DefaultPasswordRecord(
+                        ts_mtime=ts,
+                        default_password=default_pass[16:32].hex(),
+                        source=f"HKLM\\SECURITY\\Policy\\Secrets\\{secret}",
+                        _target=self.target,
+                    )
+                    continue
+
+                try:
+                    value = c_defaultpassword.DefaultPassword(default_pass).data
+                except Exception as e:
+                    self.target.log.warning("Failed to parse LSA %s value (%r): %s", secret, default_pass, e)
+                    self.target.log.debug("", exc_info=e)
+                    continue
+
+                yield DefaultPasswordRecord(
+                    ts_mtime=ts,
+                    default_password=value,
+                    source=f"HKLM\\SECURITY\\Policy\\Secrets\\{secret}",
+                    _target=self.target,
+                )

dissect_target-3.25.dev54/dissect/target/plugins/os/windows/credential/winlogon.py

@@ -0,0 +1,53 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.target.exceptions import RegistryValueNotFoundError, UnsupportedPluginError
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import export
+from dissect.target.plugins.os.windows.credential.credential import WindowsCredentialPlugin
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+WinlogonRecord = TargetRecordDescriptor(
+    "windows/credential/winlogon",
+    [
+        ("datetime", "ts_mtime"),
+        ("string", "password"),
+        ("path", "source"),
+    ],
+)
+
+
+class WinlogonPlugin(WindowsCredentialPlugin):
+    """Windows Winlogon plugin."""
+
+    __namespace__ = "winlogon"
+
+    WINLOGON_KEY = "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"
+
+    def check_compatible(self) -> None:
+        if not self.target.has_function("registry"):
+            raise UnsupportedPluginError("Windows registry plugin not available on target")
+
+    @export(record=WinlogonRecord)
+    def winlogon(self) -> Iterator[WinlogonRecord]:
+        """Yield Windows Winlogon DefaultPassword strings.
+
+        Extracts plaintext ``DefaultPassword`` values from the ``Winlogon`` registry.
+
+        References:
+            - https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon
+        """
+
+        for key in self.target.registry.keys(self.WINLOGON_KEY):
+            try:
+                yield WinlogonRecord(
+                    ts_mtime=key.ts,
+                    password=key.value("DefaultPassword").value,
+                    source=self.WINLOGON_KEY,
+                    _target=self.target,
+                )
+            except RegistryValueNotFoundError:  # noqa: PERF203
+                pass

{dissect_target-3.25.dev51 → dissect_target-3.25.dev54}/dissect/target/plugins/os/windows/dpapi/keyprovider/credhist.py

@@ -24,6 +24,6 @@ class CredHistKeyProviderPlugin(KeyProviderPlugin):
     @export(output="yield")
     def keys(self) -> Iterator[tuple[str, str]]:
         """Yield Windows CREDHIST SHA1 hashes."""
-        for credhist in self.target.credhist():
+        for credhist in self.target.credential.credhist():
             if value := credhist.sha1:
                 yield self.__namespace__, value

dissect_target-3.25.dev54/dissect/target/plugins/os/windows/dpapi/keyprovider/defaultpassword/lsa.py

@@ -0,0 +1,29 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.plugin import export
+from dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.defaultpassword import (
+    DefaultPasswordKeyProvider,
+)
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+
+class LSADefaultPasswordKeyProviderPlugin(DefaultPasswordKeyProvider):
+    """Windows LSA DefaultPassword key provider plugin."""
+
+    __namespace__ = "dpapi.keyprovider.defaultpassword.lsa"
+
+    def check_compatible(self) -> None:
+        if not self.target.has_function("lsa"):
+            raise UnsupportedPluginError("LSA plugin not available on target")
+
+    @export(output="yield")
+    def keys(self) -> Iterator[tuple[str, str]]:
+        """Yield Windows LSA DefaultPassword strings."""
+
+        for record in self.target.credential.defaultpassword():
+            yield self.__namespace__, record.default_password

{dissect_target-3.25.dev51 → dissect_target-3.25.dev54}/dissect/target/plugins/os/windows/dpapi/keyprovider/defaultpassword/winlogon.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-from dissect.target.exceptions import RegistryValueNotFoundError, UnsupportedPluginError
+from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.plugin import export
 from dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.defaultpassword import (
     DefaultPasswordKeyProvider,
@@ -23,16 +23,7 @@ class WinlogonDefaultPasswordKeyProviderPlugin(DefaultPasswordKeyProvider):
 
     @export(output="yield")
     def keys(self) -> Iterator[tuple[str, str]]:
-        """Yield Windows Winlogon DefaultPassword strings.
+        """Yield Windows Winlogon DefaultPassword strings."""
 
-        Extracts plaintext ``DefaultPassword`` values from the ``Winlogon`` registry.
-
-        References:
-            - https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon
-        """
-
-        for key in self.target.registry.keys("HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"):
-            try:
-                yield self.__namespace__, key.value("DefaultPassword").value
-            except RegistryValueNotFoundError:  # noqa: PERF203
-                pass
+        for record in self.target.credential.winlogon():
+            yield self.__namespace__, record.password

{dissect_target-3.25.dev51/dissect/target/plugins/os/windows/credential → dissect_target-3.25.dev54/dissect/target/plugins/os/windows}/lsa.py

@@ -6,7 +6,7 @@ from typing import TYPE_CHECKING
 
 from dissect.target.exceptions import RegistryKeyNotFoundError, UnsupportedPluginError
 from dissect.target.helpers.record import TargetRecordDescriptor
-from dissect.target.plugin import Plugin, export
+from dissect.target.plugin import Plugin, export, internal
 
 if TYPE_CHECKING:
     from collections.abc import Iterator
@@ -52,6 +52,7 @@ class LSAPlugin(Plugin):
             raise UnsupportedPluginError("Registry key not found: %s", self.SYSTEM_KEY)
 
     @cached_property
+    @internal
     def syskey(self) -> bytes:
         """Return byte value of Windows system SYSKEY, also called BootKey."""
         lsa = self.target.registry.key(self.SYSTEM_KEY)
@@ -63,6 +64,7 @@ class LSAPlugin(Plugin):
         return bytes(r[i] for i in alterator)
 
     @cached_property
+    @internal
     def lsakey(self) -> bytes:
         """Decrypt and return the LSA key of the Windows system."""
         security_pol = self.target.registry.key(self.SECURITY_POLICY_KEY)

{dissect_target-3.25.dev51/dissect/target/plugins/os/windows/credential → dissect_target-3.25.dev54/dissect/target/plugins/os/windows}/sam.py

@@ -263,6 +263,29 @@ def rid_to_key(rid: int) -> tuple[bytes, bytes]:
     return k1, k2
 
 
+def des_decrypt(data: bytes, rid: int) -> bytes:
+    """Decrypt a DES-encrypted hash using the RID-derived keys.
+
+    Args:
+        data: Encrypted data (16 bytes).
+        rid: Relative ID of the user account.
+
+    Raises:
+        ValueError: If data is not 16 bytes.
+    """
+    if len(data) != 16:
+        raise ValueError("data must be 16 bytes long")
+
+    key1, key2 = rid_to_key(rid)
+    des1 = DES.new(key1, DES.MODE_ECB)
+    des2 = DES.new(key2, DES.MODE_ECB)
+
+    block1 = des1.decrypt(data[:8])
+    block2 = des2.decrypt(data[8:])
+
+    return block1 + block2
+
+
 def decrypt_single_hash(rid: int, samkey: bytes, enc_hash: bytes, apwd: bytes) -> bytes:
     if not enc_hash:
         return b""
@@ -272,8 +295,6 @@ def decrypt_single_hash(rid: int, samkey: bytes, enc_hash: bytes, apwd: bytes) -
     if sh.revision not in [0x01, 0x02]:
         raise ValueError(f"Unsupported LM/NT hash revision encountered: {sh.revision}")
 
-    d1, d2 = (DES.new(k, DES.MODE_ECB) for k in rid_to_key(rid))
-
     if sh.revision == 0x01:  # LM/NT revision 0x01 involving RC4
         sh_hash = enc_hash[len(c_sam.SAM_HASH) :]
         if not sh_hash:  # Empty hash
@@ -290,7 +311,7 @@ def decrypt_single_hash(rid: int, samkey: bytes, enc_hash: bytes, apwd: bytes) -
         sh_hash = enc_hash[len(c_sam.SAM_HASH_AES) :]
         obfkey = AES.new(samkey, AES.MODE_CBC, sh.salt).decrypt(sh_hash)[:16]
 
-    return d1.decrypt(obfkey[:8]) + d2.decrypt(obfkey[8:])
+    return des_decrypt(obfkey, rid)
 
 
 class SamPlugin(Plugin):

{dissect_target-3.25.dev51 → dissect_target-3.25.dev54}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev51
+Version: 3.25.dev54
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later
@@ -23,7 +23,7 @@ License-File: LICENSE
 License-File: COPYRIGHT
 Requires-Dist: defusedxml
 Requires-Dist: dissect.cstruct<5,>=4
-Requires-Dist: dissect.database<2,>=1.1.dev3
+Requires-Dist: dissect.database<2,>=1.1.dev4
 Requires-Dist: dissect.eventlog<4,>=3
 Requires-Dist: dissect.evidence<4,>=3.13.dev3
 Requires-Dist: dissect.hypervisor<4,>=3.21.dev3
@@ -70,7 +70,7 @@ Requires-Dist: dissect.cim[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.clfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.cramfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.cstruct<5.0.dev,>=4.0.dev; extra == "dev"
-Requires-Dist: dissect.database[dev]<2.0.dev,>=1.1.dev3; extra == "dev"
+Requires-Dist: dissect.database[dev]<2.0.dev,>=1.1.dev8; extra == "dev"
 Requires-Dist: dissect.etl[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.eventlog[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.evidence[dev]<4.0.dev,>=3.13.dev2; extra == "dev"

{dissect_target-3.25.dev51 → dissect_target-3.25.dev54}/dissect.target.egg-info/SOURCES.txt

@@ -370,6 +370,7 @@ dissect/target/plugins/os/windows/generic.py
 dissect/target/plugins/os/windows/jumplist.py
 dissect/target/plugins/os/windows/lnk.py
 dissect/target/plugins/os/windows/locale.py
+dissect/target/plugins/os/windows/lsa.py
 dissect/target/plugins/os/windows/network.py
 dissect/target/plugins/os/windows/notifications.py
 dissect/target/plugins/os/windows/prefetch.py
@@ -377,6 +378,7 @@ dissect/target/plugins/os/windows/productkey.py
 dissect/target/plugins/os/windows/rdpcache.py
 dissect/target/plugins/os/windows/recyclebin.py
 dissect/target/plugins/os/windows/registry.py
+dissect/target/plugins/os/windows/sam.py
 dissect/target/plugins/os/windows/search.py
 dissect/target/plugins/os/windows/services.py
 dissect/target/plugins/os/windows/sru.py
@@ -386,10 +388,13 @@ dissect/target/plugins/os/windows/thumbcache.py
 dissect/target/plugins/os/windows/ual.py
 dissect/target/plugins/os/windows/wer.py
 dissect/target/plugins/os/windows/wua_history.py
+dissect/target/plugins/os/windows/ad/__init__.py
+dissect/target/plugins/os/windows/ad/ntds.py
 dissect/target/plugins/os/windows/credential/__init__.py
+dissect/target/plugins/os/windows/credential/credential.py
 dissect/target/plugins/os/windows/credential/credhist.py
-dissect/target/plugins/os/windows/credential/lsa.py
-dissect/target/plugins/os/windows/credential/sam.py
+dissect/target/plugins/os/windows/credential/defaultpassword.py
+dissect/target/plugins/os/windows/credential/winlogon.py
 dissect/target/plugins/os/windows/defender/__init__.py
 dissect/target/plugins/os/windows/defender/_plugin.py
 dissect/target/plugins/os/windows/defender/mplog.py
@@ -768,6 +773,7 @@ tests/plugins/os/windows/test_generic.py
 tests/plugins/os/windows/test_jumplist.py
 tests/plugins/os/windows/test_lnk.py
 tests/plugins/os/windows/test_locale.py
+tests/plugins/os/windows/test_lsa.py
 tests/plugins/os/windows/test_mru.py
 tests/plugins/os/windows/test_network.py
 tests/plugins/os/windows/test_notifications.py
@@ -776,6 +782,7 @@ tests/plugins/os/windows/test_productkey.py
 tests/plugins/os/windows/test_rdpcache.py
 tests/plugins/os/windows/test_recyclebin.py
 tests/plugins/os/windows/test_registry.py
+tests/plugins/os/windows/test_sam.py
 tests/plugins/os/windows/test_search.py
 tests/plugins/os/windows/test_shimcache.py
 tests/plugins/os/windows/test_sru.py
@@ -785,10 +792,12 @@ tests/plugins/os/windows/test_thumbcache.py
 tests/plugins/os/windows/test_ual.py
 tests/plugins/os/windows/test_wer.py
 tests/plugins/os/windows/test_wua_history.py
+tests/plugins/os/windows/ad/__init__.py
+tests/plugins/os/windows/ad/test_ntds.py
 tests/plugins/os/windows/credential/__init__.py
 tests/plugins/os/windows/credential/test_credhist.py
-tests/plugins/os/windows/credential/test_lsa.py
-tests/plugins/os/windows/credential/test_sam.py
+tests/plugins/os/windows/credential/test_defaultpassword.py
+tests/plugins/os/windows/credential/test_winlogon.py
 tests/plugins/os/windows/dpapi/__init__.py
 tests/plugins/os/windows/dpapi/test_dpapi.py
 tests/plugins/os/windows/dpapi/keyprovider/__init__.py