dissect.target 3.9.dev11__py3-none-any.whl → 3.9.dev13__py3-none-any.whl

dissect/target/loaders/targetd.py

@@ -140,3 +140,4 @@ if TARGETD_AVAILABLE:
         targetd.easy_connect_remoting(remoting, link, caller.peers)
         func = getattr(targetd.rpcs, targetd.command)
         caller.output = list(func())
+        targetd.close()

dissect/target/plugins/{os/windows → apps/shell}/powershell.py

@@ -1,30 +1,34 @@
-from flow.record.fieldtypes import uri
-
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
 from dissect.target.helpers.record import create_extended_descriptor
 from dissect.target.plugin import Plugin, export
 
 ConsoleHostHistoryRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
-    "filesystem/windows/powershell/history",
+    "powershell/history",
     [
-        ("datetime", "last_modified"),
+        ("datetime", "mtime"),
         ("string", "command"),
-        ("uri", "path"),
+        ("path", "source"),
     ],
 )
 
 
 class PowerShellHistoryPlugin(Plugin):
+    PATHS = [
+        "AppData/Roaming/Microsoft/Windows/PowerShell/psreadline",
+        ".local/share/powershell/PSReadLine",
+    ]
+
     def __init__(self, target):
         super().__init__(target)
+
         self._history = []
+
         for user_details in target.user_details.all_with_home():
-            history_path = user_details.home_path.joinpath(
-                "AppData/Roaming/Microsoft/Windows/PowerShell/psreadline/consolehost_history.txt"
-            )
-            if history_path.exists():
-                self._history.append((user_details.user, history_path))
+            for ps_path in self.PATHS:
+                history_path = user_details.home_path.joinpath(ps_path)
+                for history_file in history_path.glob("*_history.txt"):
+                    self._history.append((user_details.user, history_file))
 
     def check_compatible(self):
         if not self._history:
@@ -35,21 +39,27 @@ class PowerShellHistoryPlugin(Plugin):
         """Return PowerShell command history for all users.
 
         The PowerShell ConsoleHost_history.txt file contains information about the commands executed with PowerShell in
-        a terminal. No data is recorded from terminal-less PowerShell sessions.
+        a terminal. No data is recorded from terminal-less PowerShell sessions. Commands are saved to disk after the process has completed.
+        PSReadLine does not save commands containing 'password', 'asplaintext', 'token', 'apikey' or 'secret'.
 
         References:
             - https://0xdf.gitlab.io/2018/11/08/powershell-history-file.html
-        """
-        for user, path in self._history:
-            for line in path.open("r"):
+            - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_history?view=powershell-7.3#order-of-commands-in-the-history
+            - https://learn.microsoft.com/en-us/powershell/module/psreadline/about/about_psreadline?view=powershell-7.3#command-history
+        """  # noqa E501
+
+        for user, _path in self._history:
+            file_mtime = _path.stat().st_mtime
+
+            for line in _path.open("r"):
                 line = line.strip()
                 if not line:
                     continue
 
                 yield ConsoleHostHistoryRecord(
-                    last_modified=path.stat().st_mtime,
+                    mtime=file_mtime,
                     command=line,
-                    path=uri.from_windows(str(path)),
+                    source=_path,
                     _target=self.target,
                     _user=user,
                 )

{dissect.target-3.9.dev11.dist-info → dissect.target-3.9.dev13.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.9.dev11
+Version: 3.9.dev13
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.9.dev11.dist-info → dissect.target-3.9.dev13.dist-info}/RECORD

@@ -70,7 +70,7 @@ dissect/target/loaders/res.py,sha256=2IAm-f83fvMUeK5J0g5jNVy2-24k8qKYijimcFvZ47I
 dissect/target/loaders/tanium.py,sha256=L_OH9bhjbzoGgYwRsQNGJzg9h2JCnfor4e5Ftg_nPVk,1533
 dissect/target/loaders/tar.py,sha256=55chcbh9CDTczSmSPJ3O1FrfpXaZTTPL28Oqih8rPOA,2998
 dissect/target/loaders/target.py,sha256=mfkNz586eHb1PuzbwrvRPf9CcoPDLm5wPGFT1_rMH5s,662
-dissect/target/loaders/targetd.py,sha256=9Lxbl5GN4MuOStzgJ-QlbCQGLrDLJdyka5onjvliFoY,4407
+dissect/target/loaders/targetd.py,sha256=SD3AvzvHHcsoishoLaTBfFiMUliJjmfQeCrXzhWucD4,4431
 dissect/target/loaders/vb.py,sha256=CnQcn7bAkMzIB1y-lWLtPPXdIVsyeDaT6hTZEurjkV4,2072
 dissect/target/loaders/vbox.py,sha256=bOxsUiJ0IKx2GETs12FJkYChXBVatSkvWdLmhR5XPZc,691
 dissect/target/loaders/velociraptor.py,sha256=X-nks-V1QpuEfzDgI0_MPu_Fi--a4BEL6g8dDn_3lHU,2555
@@ -88,6 +88,8 @@ dissect/target/plugins/apps/remoteaccess/__init__.py,sha256=47DEQpj8HBSa-_TImW-5
 dissect/target/plugins/apps/remoteaccess/anydesk.py,sha256=eifgJ308gosLSh7cQhjJFuoubI0Z6fNDryFg7u-0ZAM,2518
 dissect/target/plugins/apps/remoteaccess/remoteaccess.py,sha256=hC77FCcsfYkHi50mQPDI9pfKpDslMA_sM5AeIOqdaQo,2482
 dissect/target/plugins/apps/remoteaccess/teamviewer.py,sha256=pdk-ELQtR1xpIw38FXm_DZOiald5w1gZznx8ngR-7gk,2571
+dissect/target/plugins/apps/shell/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+dissect/target/plugins/apps/shell/powershell.py,sha256=qLWlKC6qpbVVLM-uuevzdowEeWmLnuEF04pJw0Ukwxk,2633
 dissect/target/plugins/apps/vpns/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/target/plugins/apps/vpns/wireguard.py,sha256=LpGwbABhrViMVUJ-QWS1leLHyjwVtIMIp-dzkvarE0c,5773
 dissect/target/plugins/apps/webservers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -196,7 +198,6 @@ dissect/target/plugins/os/windows/generic.py,sha256=qkTzP5cvzDKUASbVlUU5vb3b102m
 dissect/target/plugins/os/windows/lnk.py,sha256=AMP_SiJnNzBmosjKMCstQcn2ah0w7MyXeEm_L8YBc4g,7802
 dissect/target/plugins/os/windows/locale.py,sha256=YlRqFteHGSE-A21flbCKP1jXUTgyXKzaqBEiiQVLFUs,2191
 dissect/target/plugins/os/windows/notifications.py,sha256=tBgZKnDCXWFtz7chHIo5cKQf2swcTTB3MMcecfTZ-4w,4773
-dissect/target/plugins/os/windows/powershell.py,sha256=dsaFb-_vsMZ4aWCUyMKSnUqMmyXaPh0IrOeCxpgehcg,2086
 dissect/target/plugins/os/windows/prefetch.py,sha256=favUyI5Pywi8Ho8fUye3gnXcM9BqEIMhFcSa1idQQBg,10304
 dissect/target/plugins/os/windows/recyclebin.py,sha256=aqp1kc8A6k5UTt6ebycuejPd0QJwNIX1xIu21M0CUGU,4926
 dissect/target/plugins/os/windows/registry.py,sha256=gIKbUTejfcCVz-5vcOrCPbYRLuieNV5BMo891_4_X3A,10034
@@ -255,10 +256,10 @@ dissect/target/volumes/bde.py,sha256=gYGg5yF9MNARwNzEkrEfZmKkxyZW4rhLkpdnPJCbhGk
 dissect/target/volumes/disk.py,sha256=95grSsPt1BLVpKwTclwQYzPFGKTkFFqapIk0RoGWf38,968
 dissect/target/volumes/lvm.py,sha256=zXAfszxNR6tOGrKAtAa_E-JhjI-sXQyR4VYLXD-kqCw,1616
 dissect/target/volumes/vmfs.py,sha256=mlAJ8278tYaoRjk1u6tFFlCaDQUrVu5ZZE4ikiFvxi8,1707
-dissect.target-3.9.dev11.dist-info/COPYRIGHT,sha256=m-9ih2RVhMiXHI2bf_oNSSgHgkeIvaYRVfKTwFbnJPA,301
-dissect.target-3.9.dev11.dist-info/LICENSE,sha256=DZak_2itbUtvHzD3E7GNUYSRK6jdOJ-GqncQ2weavLA,34523
-dissect.target-3.9.dev11.dist-info/METADATA,sha256=mgoRU0nLOB5rfLcOHMWdIxDfluIXR_4dHWoHuVx0NVU,9752
-dissect.target-3.9.dev11.dist-info/WHEEL,sha256=pkctZYzUS4AYVn6dJ-7367OJZivF2e8RA9b_ZBjif18,92
-dissect.target-3.9.dev11.dist-info/entry_points.txt,sha256=tvFPa-Ap-gakjaPwRc6Fl6mxHzxEZ_arAVU-IUYeo_s,447
-dissect.target-3.9.dev11.dist-info/top_level.txt,sha256=Mn-CQzEYsAbkxrUI0TnplHuXnGVKzxpDw_po_sXpvv4,8
-dissect.target-3.9.dev11.dist-info/RECORD,,
+dissect.target-3.9.dev13.dist-info/COPYRIGHT,sha256=m-9ih2RVhMiXHI2bf_oNSSgHgkeIvaYRVfKTwFbnJPA,301
+dissect.target-3.9.dev13.dist-info/LICENSE,sha256=DZak_2itbUtvHzD3E7GNUYSRK6jdOJ-GqncQ2weavLA,34523
+dissect.target-3.9.dev13.dist-info/METADATA,sha256=tRKFN5yNQjNPNEcQHlXh4GKIky9TOwb8So9tgbPAHOU,9752
+dissect.target-3.9.dev13.dist-info/WHEEL,sha256=pkctZYzUS4AYVn6dJ-7367OJZivF2e8RA9b_ZBjif18,92
+dissect.target-3.9.dev13.dist-info/entry_points.txt,sha256=tvFPa-Ap-gakjaPwRc6Fl6mxHzxEZ_arAVU-IUYeo_s,447
+dissect.target-3.9.dev13.dist-info/top_level.txt,sha256=Mn-CQzEYsAbkxrUI0TnplHuXnGVKzxpDw_po_sXpvv4,8
+dissect.target-3.9.dev13.dist-info/RECORD,,