dissect.target 3.25.dev52__tar.gz → 3.25.dev56__tar.gz

{dissect_target-3.25.dev52 → dissect_target-3.25.dev56}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev52
+Version: 3.25.dev56
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{dissect_target-3.25.dev52 → dissect_target-3.25.dev56}/dissect/target/helpers/fsutil.py

@@ -563,14 +563,20 @@ def open_decompress(
     if magic[:2] == b"\x1f\x8b":
         return gzip.open(file, mode, encoding=encoding, errors=errors, newline=newline)
 
-    if HAS_XZ and magic[:5] == b"\xfd7zXZ":
+    if magic[:5] == b"\xfd7zXZ":
+        if not HAS_XZ:
+            raise RuntimeError("lzma compression detected, but missing optional python module")
         return lzma.open(file, mode, encoding=encoding, errors=errors, newline=newline)
 
-    if HAS_BZ2 and magic[:3] == b"BZh" and 0x31 <= magic[3] <= 0x39:
+    if magic[:3] == b"BZh" and 0x31 <= magic[3] <= 0x39:
         # In a valid bz2 header the 4th byte is in the range b'1' ... b'9'.
+        if not HAS_BZ2:
+            raise RuntimeError("bz2 compression detected, but missing optional python module")
         return bz2.open(file, mode, encoding=encoding, errors=errors, newline=newline)
 
-    if HAS_ZSTD and magic[:4] in [b"\xfd\x2f\xb5\x28", b"\x28\xb5\x2f\xfd"]:
+    if magic[:4] in [b"\xfd\x2f\xb5\x28", b"\x28\xb5\x2f\xfd"]:
+        if not HAS_ZSTD:
+            raise RuntimeError("zstd compression detected, but missing optional python module")
         return zstd.open(file, mode=mode, encoding=encoding, errors=errors, newline=newline)
 
     if path:

{dissect_target-3.25.dev52 → dissect_target-3.25.dev56}/dissect/target/plugins/os/unix/linux/proc.py

@@ -472,9 +472,10 @@ class ProcProcess:
     def _parse_environ(self) -> Iterator[Environ]:
         """Internal function to parse entries in ``/proc/[pid]/environ``."""
         # entries in /proc/<pid>/environ are null-terminated
-        lines = self.get("environ").read_text().split("\x00")
+        if not (environ_path := self.get("environ")).exists():
+            return
 
-        for line in lines:
+        for line in environ_path.read_text().split("\x00"):
             if line == "":
                 # Skip empty line
                 continue

{dissect_target-3.25.dev52 → dissect_target-3.25.dev56}/dissect/target/plugins/os/windows/_os.py

@@ -16,7 +16,7 @@ if TYPE_CHECKING:
     from typing_extensions import Self
 
     from dissect.target.filesystem import Filesystem
-    from dissect.target.plugins.os.windows.credential.sam import SamRecord
+    from dissect.target.plugins.os.windows.sam import SamRecord
     from dissect.target.target import Target
 
 ARCH_MAP = {

{dissect_target-3.25.dev52 → dissect_target-3.25.dev56}/dissect/target/plugins/os/windows/ad/ntds.py

@@ -8,7 +8,7 @@ from dissect.database.ese.ntds import NTDS
 
 from dissect.target.helpers.record import TargetRecordDescriptor
 from dissect.target.plugin import Plugin, UnsupportedPluginError, export, internal
-from dissect.target.plugins.os.windows.credential.sam import des_decrypt
+from dissect.target.plugins.os.windows.sam import des_decrypt
 
 if TYPE_CHECKING:
     from collections.abc import Iterator

dissect_target-3.25.dev56/dissect/target/plugins/os/windows/credential/credential.py

@@ -0,0 +1,7 @@
+from __future__ import annotations
+
+from dissect.target.plugin import NamespacePlugin
+
+
+class WindowsCredentialPlugin(NamespacePlugin):
+    __namespace__ = "credential"

{dissect_target-3.25.dev52 → dissect_target-3.25.dev56}/dissect/target/plugins/os/windows/credential/credhist.py

@@ -13,7 +13,8 @@ from dissect.target.helpers import keychain
 from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
 from dissect.target.helpers.logging import get_logger
 from dissect.target.helpers.record import create_extended_descriptor
-from dissect.target.plugin import Plugin, export
+from dissect.target.plugin import export
+from dissect.target.plugins.os.windows.credential.credential import WindowsCredentialPlugin
 from dissect.target.plugins.os.windows.dpapi.crypto import (
     CipherAlgorithm,
     HashAlgorithm,
@@ -156,7 +157,7 @@ class CredHistFile:
             password_hash = entry.sha1
 
 
-class CredHistPlugin(Plugin):
+class CredHistPlugin(WindowsCredentialPlugin):
     """Windows CREDHIST file parser.
 
     Windows XP:         ``C:\\Documents and Settings\\username\\Application Data\\Microsoft\\Protect\\CREDHIST``
@@ -166,6 +167,8 @@ class CredHistPlugin(Plugin):
         - https://www.passcape.com/index.php?section=docsys&cmd=details&id=28#41
     """
 
+    __namespace__ = "credhist"
+
     def __init__(self, target: Target):
         super().__init__(target)
         self.files = list(self._find_files())
@@ -198,6 +201,9 @@ class CredHistPlugin(Plugin):
             for password in passwords:
                 credhist.decrypt(hashlib.sha1(password.encode("utf-16-le")).digest())
 
+            if not credhist.entries:
+                self.target.log.warning("File has no credhist entries: %s", path)
+
             for entry in credhist.entries:
                 yield CredHistRecord(
                     guid=entry.guid,

dissect_target-3.25.dev56/dissect/target/plugins/os/windows/credential/defaultpassword.py

@@ -0,0 +1,92 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.cstruct import cstruct
+
+from dissect.target.exceptions import RegistryKeyNotFoundError, UnsupportedPluginError
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import export
+from dissect.target.plugins.os.windows.credential.credential import WindowsCredentialPlugin
+from dissect.target.plugins.os.windows.lsa import LSAPlugin
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+defaultpassword_def = """
+struct DefaultPassword {
+    DWORD   length;
+    char    flags[4*3];
+    WCHAR   data[length/2];
+    // char    checksum_or_guid[0x10];
+};
+"""
+
+c_defaultpassword = cstruct().load(defaultpassword_def)
+
+DefaultPasswordRecord = TargetRecordDescriptor(
+    "windows/credential/default_password",
+    [
+        ("datetime", "ts_mtime"),
+        ("string", "default_password"),
+        ("path", "source"),
+    ],
+)
+
+
+class DefaultPasswordPlugin(WindowsCredentialPlugin):
+    """Windows LSA DefaultPassword plugin."""
+
+    __namespace__ = "defaultpassword"
+
+    def check_compatible(self) -> None:
+        if not self.target.has_function("lsa"):
+            raise UnsupportedPluginError("LSA plugin not available on target")
+
+    @export(record=DefaultPasswordRecord)
+    def defaultpassword(self) -> Iterator[DefaultPasswordRecord]:
+        """Yield decrypted Windows LSA DefaultPassword records.
+
+        Extracts decrypted ``DefaultPassword`` values from the LSA.
+
+        References:
+            - https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon
+        """
+
+        # Search for DefaultPassword values in the LSA
+        for secret in ["DefaultPassword", "DefaultPassword_OldVal"]:
+            if default_pass := self.target.lsa._secrets.get(secret):
+                # Ignore irrelevant DefaultPassword references
+                if "TBAL_{".encode("utf-16-le") in default_pass:
+                    continue
+
+                ts = None
+                try:
+                    ts = self.target.registry.key(
+                        f"{LSAPlugin.SECURITY_POLICY_KEY}\\Secrets\\{secret.replace('_OldVal', '')}"
+                    ).ts
+                except RegistryKeyNotFoundError:
+                    pass
+
+                if default_pass.startswith(b"\x00" * 16) and len(default_pass) == 32:
+                    yield DefaultPasswordRecord(
+                        ts_mtime=ts,
+                        default_password=default_pass[16:32].hex(),
+                        source=f"HKLM\\SECURITY\\Policy\\Secrets\\{secret}",
+                        _target=self.target,
+                    )
+                    continue
+
+                try:
+                    value = c_defaultpassword.DefaultPassword(default_pass).data
+                except Exception as e:
+                    self.target.log.warning("Failed to parse LSA %s value (%r): %s", secret, default_pass, e)
+                    self.target.log.debug("", exc_info=e)
+                    continue
+
+                yield DefaultPasswordRecord(
+                    ts_mtime=ts,
+                    default_password=value,
+                    source=f"HKLM\\SECURITY\\Policy\\Secrets\\{secret}",
+                    _target=self.target,
+                )

dissect_target-3.25.dev56/dissect/target/plugins/os/windows/credential/winlogon.py

@@ -0,0 +1,53 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.target.exceptions import RegistryValueNotFoundError, UnsupportedPluginError
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import export
+from dissect.target.plugins.os.windows.credential.credential import WindowsCredentialPlugin
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+WinlogonRecord = TargetRecordDescriptor(
+    "windows/credential/winlogon",
+    [
+        ("datetime", "ts_mtime"),
+        ("string", "password"),
+        ("path", "source"),
+    ],
+)
+
+
+class WinlogonPlugin(WindowsCredentialPlugin):
+    """Windows Winlogon plugin."""
+
+    __namespace__ = "winlogon"
+
+    WINLOGON_KEY = "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"
+
+    def check_compatible(self) -> None:
+        if not self.target.has_function("registry"):
+            raise UnsupportedPluginError("Windows registry plugin not available on target")
+
+    @export(record=WinlogonRecord)
+    def winlogon(self) -> Iterator[WinlogonRecord]:
+        """Yield Windows Winlogon DefaultPassword strings.
+
+        Extracts plaintext ``DefaultPassword`` values from the ``Winlogon`` registry.
+
+        References:
+            - https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon
+        """
+
+        for key in self.target.registry.keys(self.WINLOGON_KEY):
+            try:
+                yield WinlogonRecord(
+                    ts_mtime=key.ts,
+                    password=key.value("DefaultPassword").value,
+                    source=self.WINLOGON_KEY,
+                    _target=self.target,
+                )
+            except RegistryValueNotFoundError:  # noqa: PERF203
+                pass

{dissect_target-3.25.dev52 → dissect_target-3.25.dev56}/dissect/target/plugins/os/windows/dpapi/keyprovider/credhist.py

@@ -24,6 +24,6 @@ class CredHistKeyProviderPlugin(KeyProviderPlugin):
     @export(output="yield")
     def keys(self) -> Iterator[tuple[str, str]]:
         """Yield Windows CREDHIST SHA1 hashes."""
-        for credhist in self.target.credhist():
+        for credhist in self.target.credential.credhist():
             if value := credhist.sha1:
                 yield self.__namespace__, value

dissect_target-3.25.dev56/dissect/target/plugins/os/windows/dpapi/keyprovider/defaultpassword/lsa.py

@@ -0,0 +1,29 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.plugin import export
+from dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.defaultpassword import (
+    DefaultPasswordKeyProvider,
+)
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+
+class LSADefaultPasswordKeyProviderPlugin(DefaultPasswordKeyProvider):
+    """Windows LSA DefaultPassword key provider plugin."""
+
+    __namespace__ = "dpapi.keyprovider.defaultpassword.lsa"
+
+    def check_compatible(self) -> None:
+        if not self.target.has_function("lsa"):
+            raise UnsupportedPluginError("LSA plugin not available on target")
+
+    @export(output="yield")
+    def keys(self) -> Iterator[tuple[str, str]]:
+        """Yield Windows LSA DefaultPassword strings."""
+
+        for record in self.target.credential.defaultpassword():
+            yield self.__namespace__, record.default_password

{dissect_target-3.25.dev52 → dissect_target-3.25.dev56}/dissect/target/plugins/os/windows/dpapi/keyprovider/defaultpassword/winlogon.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-from dissect.target.exceptions import RegistryValueNotFoundError, UnsupportedPluginError
+from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.plugin import export
 from dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.defaultpassword import (
     DefaultPasswordKeyProvider,
@@ -23,16 +23,7 @@ class WinlogonDefaultPasswordKeyProviderPlugin(DefaultPasswordKeyProvider):
 
     @export(output="yield")
     def keys(self) -> Iterator[tuple[str, str]]:
-        """Yield Windows Winlogon DefaultPassword strings.
+        """Yield Windows Winlogon DefaultPassword strings."""
 
-        Extracts plaintext ``DefaultPassword`` values from the ``Winlogon`` registry.
-
-        References:
-            - https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon
-        """
-
-        for key in self.target.registry.keys("HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"):
-            try:
-                yield self.__namespace__, key.value("DefaultPassword").value
-            except RegistryValueNotFoundError:  # noqa: PERF203
-                pass
+        for record in self.target.credential.winlogon():
+            yield self.__namespace__, record.password

{dissect_target-3.25.dev52 → dissect_target-3.25.dev56}/dissect/target/tools/shell.py

@@ -804,6 +804,7 @@ class TargetCli(TargetCmd):
 
         if not path.exists():
             print(f"ls: cannot access {path}: No such file or directory")
+            return False
 
         # Disable color if output is redirected to a file
         use_color = False

{dissect_target-3.25.dev52 → dissect_target-3.25.dev56}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev52
+Version: 3.25.dev56
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{dissect_target-3.25.dev52 → dissect_target-3.25.dev56}/dissect.target.egg-info/SOURCES.txt

@@ -370,6 +370,7 @@ dissect/target/plugins/os/windows/generic.py
 dissect/target/plugins/os/windows/jumplist.py
 dissect/target/plugins/os/windows/lnk.py
 dissect/target/plugins/os/windows/locale.py
+dissect/target/plugins/os/windows/lsa.py
 dissect/target/plugins/os/windows/network.py
 dissect/target/plugins/os/windows/notifications.py
 dissect/target/plugins/os/windows/prefetch.py
@@ -377,6 +378,7 @@ dissect/target/plugins/os/windows/productkey.py
 dissect/target/plugins/os/windows/rdpcache.py
 dissect/target/plugins/os/windows/recyclebin.py
 dissect/target/plugins/os/windows/registry.py
+dissect/target/plugins/os/windows/sam.py
 dissect/target/plugins/os/windows/search.py
 dissect/target/plugins/os/windows/services.py
 dissect/target/plugins/os/windows/sru.py
@@ -389,9 +391,10 @@ dissect/target/plugins/os/windows/wua_history.py
 dissect/target/plugins/os/windows/ad/__init__.py
 dissect/target/plugins/os/windows/ad/ntds.py
 dissect/target/plugins/os/windows/credential/__init__.py
+dissect/target/plugins/os/windows/credential/credential.py
 dissect/target/plugins/os/windows/credential/credhist.py
-dissect/target/plugins/os/windows/credential/lsa.py
-dissect/target/plugins/os/windows/credential/sam.py
+dissect/target/plugins/os/windows/credential/defaultpassword.py
+dissect/target/plugins/os/windows/credential/winlogon.py
 dissect/target/plugins/os/windows/defender/__init__.py
 dissect/target/plugins/os/windows/defender/_plugin.py
 dissect/target/plugins/os/windows/defender/mplog.py
@@ -770,6 +773,7 @@ tests/plugins/os/windows/test_generic.py
 tests/plugins/os/windows/test_jumplist.py
 tests/plugins/os/windows/test_lnk.py
 tests/plugins/os/windows/test_locale.py
+tests/plugins/os/windows/test_lsa.py
 tests/plugins/os/windows/test_mru.py
 tests/plugins/os/windows/test_network.py
 tests/plugins/os/windows/test_notifications.py
@@ -778,6 +782,7 @@ tests/plugins/os/windows/test_productkey.py
 tests/plugins/os/windows/test_rdpcache.py
 tests/plugins/os/windows/test_recyclebin.py
 tests/plugins/os/windows/test_registry.py
+tests/plugins/os/windows/test_sam.py
 tests/plugins/os/windows/test_search.py
 tests/plugins/os/windows/test_shimcache.py
 tests/plugins/os/windows/test_sru.py
@@ -791,8 +796,8 @@ tests/plugins/os/windows/ad/__init__.py
 tests/plugins/os/windows/ad/test_ntds.py
 tests/plugins/os/windows/credential/__init__.py
 tests/plugins/os/windows/credential/test_credhist.py
-tests/plugins/os/windows/credential/test_lsa.py
-tests/plugins/os/windows/credential/test_sam.py
+tests/plugins/os/windows/credential/test_defaultpassword.py
+tests/plugins/os/windows/credential/test_winlogon.py
 tests/plugins/os/windows/dpapi/__init__.py
 tests/plugins/os/windows/dpapi/test_dpapi.py
 tests/plugins/os/windows/dpapi/keyprovider/__init__.py

{dissect_target-3.25.dev52 → dissect_target-3.25.dev56}/tests/conftest.py

@@ -236,7 +236,7 @@ def fs_linux_proc(fs_linux: VirtualFilesystem) -> VirtualFilesystem:
             "proc/1337",
             VirtualSymlink(fs, "/proc/1337/fd/4", "socket:[1337]"),
             "acquire\x00-p\x00full\x00--proc\x00",
-            "VAR=1",
+            "",
         ),
     )
     stat_files_data = (
@@ -253,7 +253,8 @@ def fs_linux_proc(fs_linux: VirtualFilesystem) -> VirtualFilesystem:
 
         fs.map_file_fh(dir + "/stat", BytesIO(stat_files_data[idx].encode()))
         fs.map_file_fh(dir + "/cmdline", BytesIO(cmdline.encode()))
-        fs.map_file_fh(dir + "/environ", BytesIO(environ.encode()))
+        if environ:
+            fs.map_file_fh(dir + "/environ", BytesIO(environ.encode()))
 
     # symlink acquire process to self
     fs.link("/proc/1337", "/proc/self")

{dissect_target-3.25.dev52 → dissect_target-3.25.dev56}/tests/helpers/test_fsutil.py

@@ -732,6 +732,27 @@ def test_open_decompress(file_name: str, compressor: Callable, content: bytes) -
     assert fsutil.open_decompress(fileobj=fh).read() == content
 
 
+@pytest.mark.parametrize(
+    ("compressor", "mock_bool_name"),
+    [
+        (fsutil.lzma.compress, "HAS_XZ"),
+        (fsutil.bz2.compress, "HAS_BZ2"),
+        (fsutil.zstd.compress, "HAS_ZSTD"),
+    ],
+)
+def test_open_decompress_missing_module(
+    compressor: Callable, mock_bool_name: str, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    vfs = VirtualFilesystem()
+    fh = io.BytesIO(compressor(b"hello world"))
+    vfs.map_file_fh("compressed_file", fh)
+
+    with monkeypatch.context() as m:
+        m.setattr(f"{fsutil.__name__}.{mock_bool_name}", False)
+        with pytest.raises(RuntimeError, match=r".* compression detected, but missing optional python module"):
+            fsutil.open_decompress(vfs.path("compressed_file"))
+
+
 def test_open_decompress_text_modes() -> None:
     vfs = VirtualFilesystem()
     vfs.map_file_fh("test", io.BytesIO(b"zomgbbq"))

{dissect_target-3.25.dev52 → dissect_target-3.25.dev56}/tests/plugins/apps/browser/test_chrome.py

@@ -11,13 +11,13 @@ from dissect.target.plugins.apps.browser.chrome import ChromePlugin
 from dissect.target.plugins.os.windows.dpapi.dpapi import DPAPIPlugin
 from tests._utils import absolute_path
 from tests.conftest import add_win_user
-from tests.plugins.os.windows.credential.test_lsa import (
+from tests.plugins.os.windows.test__os import map_version_value
+from tests.plugins.os.windows.test_lsa import (
     POLICY_KEY_PATH_NT6,
     map_lsa_polkey,
     map_lsa_secrets,
     map_lsa_system_keys,
 )
-from tests.plugins.os.windows.test__os import map_version_value
 
 if TYPE_CHECKING:
     from pytest_benchmark.fixture import BenchmarkFixture

{dissect_target-3.25.dev52 → dissect_target-3.25.dev56}/tests/plugins/os/unix/linux/test_environ.py

@@ -12,4 +12,4 @@ if TYPE_CHECKING:
 def test_environ(target_linux_users: Target, fs_linux_proc: VirtualFilesystem) -> None:
     target_linux_users.add_plugin(ProcPlugin)
     results = list(target_linux_users.environ())
-    assert len(results) == 4
+    assert len(results) == 3

{dissect_target-3.25.dev52 → dissect_target-3.25.dev56}/tests/plugins/os/windows/ad/test_ntds.py

@@ -8,7 +8,7 @@ from dissect.target.helpers.regutil import VirtualHive, VirtualKey, VirtualValue
 from dissect.target.plugins.os.windows.ad.ntds import DEFAULT_NT_HASH
 from tests._utils import absolute_path
 from tests.plugins.os.windows.credential.test_credhist import md4
-from tests.plugins.os.windows.credential.test_lsa import map_lsa_system_keys
+from tests.plugins.os.windows.test_lsa import map_lsa_system_keys
 
 if TYPE_CHECKING:
     from dissect.target.target import Target

{dissect_target-3.25.dev52 → dissect_target-3.25.dev56}/tests/plugins/os/windows/credential/test_credhist.py

@@ -64,7 +64,7 @@ def test_credhist_partial(target_win_users: Target, fs_win: VirtualFilesystem) -
         provider="user",
     )
 
-    results = list(target_win_users.credhist())
+    results = list(target_win_users.credential.credhist())
     assert len(results) == 3
     assert [result.nt for result in results] == [md4("user").hex(), md4("password").hex(), None]
 

dissect_target-3.25.dev56/tests/plugins/os/windows/credential/test_defaultpassword.py

@@ -0,0 +1,58 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+from unittest import mock
+
+import pytest
+
+from dissect.target.plugins.os.windows.credential.defaultpassword import DefaultPasswordPlugin
+from dissect.target.plugins.os.windows.lsa import LSAPlugin
+
+if TYPE_CHECKING:
+    from dissect.target.target import Target
+
+
+@pytest.mark.parametrize(
+    ("reg_key", "reg_value", "expected_value"),
+    [
+        pytest.param(
+            "DefaultPassword",
+            bytes.fromhex("00000000000000000000000000000000d41d8cd98f00b204e9800998ecf8427e"),
+            "d41d8cd98f00b204e9800998ecf8427e",
+            id="small",
+        ),
+        pytest.param(
+            "DefaultPassword_OldVal",
+            bytes.fromhex(
+                "10000000000000000000000000000000700061007300730077006f0072006400d41d8cd98f00b204e9800998ecf8427e"
+            ),
+            "password",
+            id="regular",
+        ),
+        pytest.param(
+            "DefaultPassword",
+            bytes.fromhex("10000000000000000000000000000000700061007300730077006f0072006400"),
+            "password",
+            id="no-trailer",
+        ),
+    ],
+)
+def test_windows_credential_defaultpassword_lsa(
+    target_win: Target, reg_key: str, reg_value: bytes, expected_value: str
+) -> None:
+    """Test if we can parse a DefaultPassword LSA entry."""
+
+    with mock.patch(
+        "dissect.target.plugins.os.windows.lsa.LSAPlugin._secrets",
+        new_callable=mock.PropertyMock,
+        return_value={reg_key: reg_value},
+    ):
+        target_win.add_plugin(LSAPlugin, check_compatible=False)
+        target_win.add_plugin(DefaultPasswordPlugin)
+
+        records = list(target_win.credential.defaultpassword())
+
+        assert len(records) == 1
+
+        assert records[0].default_password == expected_value
+        assert records[0].source == f"HKLM\\SECURITY\\Policy\\Secrets\\{reg_key}"

dissect_target-3.25.dev56/tests/plugins/os/windows/credential/test_winlogon.py

@@ -0,0 +1,28 @@
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from typing import TYPE_CHECKING
+
+from dissect.target.helpers.regutil import VirtualKey
+from dissect.target.plugins.os.windows.credential.winlogon import WinlogonPlugin
+
+if TYPE_CHECKING:
+    from dissect.target.helpers.regutil import VirtualHive
+    from dissect.target.target import Target
+
+
+def test_windows_credential_winlogon(target_win: Target, hive_hklm: VirtualHive) -> None:
+    """Test if we can find a Winlogon DefaultPassword entry in the registry."""
+
+    winlogon_path = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"
+    winlogon_key = VirtualKey(hive_hklm, winlogon_path)
+    winlogon_key.timestamp = datetime(2025, 12, 31, 13, 37, 0, tzinfo=timezone.utc)
+    winlogon_key.add_value("DefaultPassword", "password")
+    hive_hklm.map_key(winlogon_path, winlogon_key)
+
+    target_win.add_plugin(WinlogonPlugin)
+
+    record = next(target_win.winlogon())
+
+    assert record.ts_mtime == datetime(2025, 12, 31, 13, 37, 0, tzinfo=timezone.utc)
+    assert record.password == "password"

{dissect_target-3.25.dev52 → dissect_target-3.25.dev56}/tests/plugins/os/windows/dpapi/test_dpapi.py

@@ -16,14 +16,14 @@ from dissect.target.plugins.os.windows.dpapi.crypto import (
 from dissect.target.plugins.os.windows.dpapi.dpapi import DPAPIBlob, DPAPIPlugin, MasterKeyFile
 from tests._utils import absolute_path
 from tests.conftest import add_win_user
-from tests.plugins.os.windows.credential.test_lsa import (
+from tests.plugins.os.windows.test__os import map_version_value
+from tests.plugins.os.windows.test_lsa import (
     POLICY_KEY_PATH_NT5,
     POLICY_KEY_PATH_NT6,
     map_lsa_polkey,
     map_lsa_secrets,
     map_lsa_system_keys,
 )
-from tests.plugins.os.windows.test__os import map_version_value
 
 if TYPE_CHECKING:
     from dissect.target.filesystem import VirtualFilesystem

{dissect_target-3.25.dev52/tests/plugins/os/windows/credential → dissect_target-3.25.dev56/tests/plugins/os/windows}/test_lsa.py

@@ -4,7 +4,7 @@ from datetime import datetime, timezone
 from typing import TYPE_CHECKING
 
 from dissect.target.helpers.regutil import VirtualHive, VirtualKey
-from dissect.target.plugins.os.windows.credential.lsa import LSAPlugin
+from dissect.target.plugins.os.windows.lsa import LSAPlugin
 from tests.plugins.os.windows.test__os import map_version_value
 
 if TYPE_CHECKING:

{dissect_target-3.25.dev52/tests/plugins/os/windows/credential → dissect_target-3.25.dev56/tests/plugins/os/windows}/test_sam.py

@@ -6,7 +6,7 @@ import pytest
 from flow.record.fieldtypes import datetime as dt
 
 from dissect.target.helpers.regutil import VirtualHive, VirtualKey
-from tests.plugins.os.windows.credential.test_lsa import map_lsa_system_keys
+from tests.plugins.os.windows.test_lsa import map_lsa_system_keys
 
 if TYPE_CHECKING:
     from dissect.target.target import Target
@@ -14,7 +14,7 @@ if TYPE_CHECKING:
 try:
     from Crypto.Hash import MD4
 
-    from dissect.target.plugins.os.windows.credential.sam import SamPlugin
+    from dissect.target.plugins.os.windows.sam import SamPlugin
 
     HAS_CRYPTO = True
 except ImportError:

{dissect_target-3.25.dev52 → dissect_target-3.25.dev56}/tests/tools/test_query.py

@@ -331,7 +331,7 @@ def test_list_json(capsys: pytest.CaptureFixture, monkeypatch: pytest.MonkeyPatc
         "output": "record",
         "arguments": [],
         "alias": False,
-        "path": "os.windows.credential.sam.sam",
+        "path": "os.windows.sam.sam",
     }
 
     # plugin with arguments