dissect.target 3.25.dev62__tar.gz → 3.25.dev64__tar.gz

{dissect_target-3.25.dev62 → dissect_target-3.25.dev64}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev62
+Version: 3.25.dev64
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

dissect_target-3.25.dev64/dissect/target/plugins/apps/browser/safari.py

@@ -0,0 +1,124 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.database.exception import Error as DBError
+from dissect.database.sqlite3 import SQLite3
+from dissect.util.ts import cocoatimestamp
+
+from dissect.target.exceptions import FileNotFoundError, UnsupportedPluginError
+from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
+from dissect.target.helpers.record import create_extended_descriptor
+from dissect.target.plugin import export
+from dissect.target.plugins.apps.browser.browser import (
+    GENERIC_HISTORY_RECORD_FIELDS,
+    BrowserPlugin,
+    try_idna,
+)
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+    from pathlib import Path
+
+    from dissect.target.plugins.general.users import UserDetails
+    from dissect.target.target import Target
+
+
+class SafariPlugin(BrowserPlugin):
+    """Safari browser plugin."""
+
+    __namespace__ = "safari"
+
+    DIRS = (
+        # macOS
+        "Library/Safari",
+    )
+
+    BrowserHistoryRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
+        "browser/safari/history", GENERIC_HISTORY_RECORD_FIELDS
+    )
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self.installs = list(self._find_installs())
+
+    def _find_installs(self) -> Iterator[tuple[UserDetails, Path]]:
+        for user_details in self.target.user_details.all_with_home():
+            for directory in self.DIRS:
+                install = user_details.home_path.joinpath(directory)
+                if install.is_dir():
+                    yield user_details, install
+
+    def check_compatible(self) -> None:
+        if not self.installs:
+            raise UnsupportedPluginError("No Safari directories found on target")
+
+    def _iter_db(self, filename: str) -> Iterator[tuple[UserDetails, Path, SQLite3]]:
+        for user_details, install in self.installs:
+            db_file = install.joinpath(filename)
+            try:
+                yield user_details, db_file, SQLite3(db_file)
+            except FileNotFoundError:
+                self.target.log.info("Could not find %s file: %s", filename, db_file)
+            except DBError as e:
+                self.target.log.warning("Could not open %s file: %s", filename, db_file)
+                self.target.log.debug("", exc_info=e)
+
+    @export(record=BrowserHistoryRecord)
+    def history(self) -> Iterator[BrowserHistoryRecord]:
+        """Return browser history records from Safari.
+
+        Yields BrowserHistoryRecord with the following fields:
+
+        .. code-block:: text
+
+            ts (datetime): Visit timestamp.
+            browser (string): The browser from which the records are generated from.
+            id (varint): Record ID.
+            url (uri): History URL.
+            title (string): Page title.
+            description (string): Page description.
+            host (string): Hostname.
+            visit_type (varint): Visit type.
+            visit_count (varint): Amount of visits.
+            hidden (boolean): Hidden value (synthesized visits).
+            typed (boolean): Typed value.
+            session (varint): Session value.
+            from_visit (varint): Record ID of the redirect source visit.
+            from_url (uri): URL of the redirect source visit.
+            source (path): The source file of the history record.
+        """
+        for user_details, db_file, db in self._iter_db("History.db"):
+            try:
+                items = {row.id: row for row in db.table("history_items").rows()}
+                visits = {}
+
+                for row in db.table("history_visits").rows():
+                    visits[row.id] = row
+                    item = items[row.history_item]
+
+                    from_visit = visits.get(row.redirect_source) if row.redirect_source else None
+                    from_item = items.get(from_visit.history_item) if from_visit else None
+
+                    yield self.BrowserHistoryRecord(
+                        ts=cocoatimestamp(row.visit_time),
+                        browser="safari",
+                        id=row.id,
+                        url=try_idna(item.url),
+                        title=row.title,
+                        description=None,
+                        host=item.domain_expansion,
+                        visit_type=None,
+                        visit_count=item.visit_count,
+                        hidden=bool(row.synthesized),
+                        typed=None,
+                        session=None,
+                        from_visit=row.redirect_source or None,
+                        from_url=try_idna(from_item.url) if from_item else None,
+                        source=db_file,
+                        _target=self.target,
+                        _user=user_details.user if user_details else None,
+                    )
+            except DBError as e:  # noqa: PERF203
+                self.target.log.warning("Error processing history file: %s", db_file)
+                self.target.log.debug("", exc_info=e)

{dissect_target-3.25.dev62 → dissect_target-3.25.dev64}/dissect/target/plugins/os/windows/ad/ntds.py

@@ -69,6 +69,18 @@ NtdsComputerRecord = TargetRecordDescriptor(
     ],
 )
 
+NtdsGPORecord = TargetRecordDescriptor(
+    "windows/ad/gpo",
+    [
+        ("string", "cn"),
+        ("string", "distinguished_name"),
+        ("string", "object_guid"),
+        ("string", "name"),
+        ("string", "display_name"),
+        ("datetime", "creation_time"),
+        ("datetime", "last_modified_time"),
+    ],
+)
 
 # NTDS Registry consts
 NTDS_PARAMETERS_REGISTRY_PATH = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters"
@@ -138,6 +150,22 @@ class NtdsPlugin(Plugin):
                 _target=self.target,
             )
 
+    @export(record=NtdsGPORecord)
+    def group_policies(self) -> Iterator[NtdsGPORecord]:
+        """Extract all group policy objects (GPO) NTDS.dit database."""
+
+        for gpo in self.ntds.group_policies():
+            yield NtdsGPORecord(
+                cn=gpo.cn,
+                distinguished_name=gpo.distinguished_name,
+                object_guid=gpo.guid,
+                name=gpo.name,
+                display_name=gpo.display_name,
+                creation_time=gpo.when_created,
+                last_modified_time=gpo.when_changed,
+                _target=self.target,
+            )
+
 
 def extract_user_info(user: User | Computer, target: Target) -> dict[str, Any]:
     """Extract generic information from a User or Computer account."""
@@ -158,7 +186,7 @@ def extract_user_info(user: User | Computer, target: Target) -> dict[str, Any]:
 
     # Extract supplemental credentials and yield records
     return {
-        "cn": user.get("cn"),
+        "cn": user.cn,
         "upn": user.get("userPrincipalName"),
         "sam_name": user.sam_account_name,
         "sam_type": user.sam_account_type.name,

{dissect_target-3.25.dev62 → dissect_target-3.25.dev64}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev62
+Version: 3.25.dev64
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{dissect_target-3.25.dev62 → dissect_target-3.25.dev64}/dissect.target.egg-info/SOURCES.txt

@@ -175,6 +175,7 @@ dissect/target/plugins/apps/browser/chromium.py
 dissect/target/plugins/apps/browser/edge.py
 dissect/target/plugins/apps/browser/firefox.py
 dissect/target/plugins/apps/browser/iexplore.py
+dissect/target/plugins/apps/browser/safari.py
 dissect/target/plugins/apps/chat/__init__.py
 dissect/target/plugins/apps/chat/chat.py
 dissect/target/plugins/apps/chat/msn.py
@@ -605,6 +606,7 @@ tests/plugins/apps/browser/test_chromium.py
 tests/plugins/apps/browser/test_edge.py
 tests/plugins/apps/browser/test_firefox.py
 tests/plugins/apps/browser/test_iexplore.py
+tests/plugins/apps/browser/test_safari.py
 tests/plugins/apps/chat/__init__.py
 tests/plugins/apps/chat/test_msn.py
 tests/plugins/apps/container/__init__.py

dissect_target-3.25.dev64/tests/plugins/apps/browser/test_safari.py

@@ -0,0 +1,54 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+import pytest
+from flow.record.fieldtypes import datetime as dt
+
+from dissect.target.plugins.apps.browser.safari import SafariPlugin
+from tests._utils import absolute_path
+
+if TYPE_CHECKING:
+    from dissect.target.filesystem import VirtualFilesystem
+    from dissect.target.target import Target
+
+
+@pytest.fixture
+def target_safari_mac(target_macos_users: Target, fs_macos: VirtualFilesystem) -> Target:
+    fs_macos.map_dir(
+        "/Users/dissect/Library/Safari/",
+        absolute_path("_data/plugins/apps/browser/safari/generic/"),
+    )
+    target_macos_users.add_plugin(SafariPlugin)
+    return target_macos_users
+
+
+def test_safari_history(target_safari_mac: Target) -> None:
+    records = list(target_safari_mac.safari.history())
+
+    assert len(records) == 5
+    assert {"safari"} == {r.browser for r in records}
+
+    # First visit: direct navigation to example.com
+    r = records[0]
+    assert r.ts == dt("2024-01-01T00:00:00+00:00")
+    assert r.url == "https://example.com/"
+    assert r.title == "Example Domain"
+    assert r.host == "example"
+    assert r.visit_count == 3
+    assert not r.hidden
+    assert r.from_visit is None
+    assert r.from_url is None
+
+    # Second visit: redirect from visit 1
+    r = records[1]
+    assert r.ts == dt("2024-01-01T00:01:00+00:00")
+    assert r.url == "https://example.com/page"
+    assert r.title == "Example Page"
+    assert r.from_visit == 1
+    assert r.from_url == "https://example.com/"
+
+    # Fifth visit: synthesized (hidden)
+    r = records[4]
+    assert r.hidden
+    assert r.title is None

{dissect_target-3.25.dev62 → dissect_target-3.25.dev64}/tests/plugins/os/windows/ad/test_ntds.py

@@ -89,3 +89,9 @@ def test_computers(target_win_ntds: Target) -> None:
             continue
 
         assert cn_to_ntlm_hash_mapping[result.cn] == result.nt
+
+
+def test_group_policies(target_win_ntds: Target) -> None:
+    results = list(target_win_ntds.ad.group_policies())
+
+    assert len(results) == 5