dissect.target 3.9.dev11__tar.gz → 3.9.dev13__tar.gz

{dissect.target-3.9.dev11/dissect.target.egg-info → dissect.target-3.9.dev13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.9.dev11
+Version: 3.9.dev13
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.9.dev11 → dissect.target-3.9.dev13}/dissect/target/loaders/targetd.py

@@ -140,3 +140,4 @@ if TARGETD_AVAILABLE:
         targetd.easy_connect_remoting(remoting, link, caller.peers)
         func = getattr(targetd.rpcs, targetd.command)
         caller.output = list(func())
+        targetd.close()

{dissect.target-3.9.dev11/dissect/target/plugins/os/windows → dissect.target-3.9.dev13/dissect/target/plugins/apps/shell}/powershell.py

@@ -1,30 +1,34 @@
-from flow.record.fieldtypes import uri
-
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
 from dissect.target.helpers.record import create_extended_descriptor
 from dissect.target.plugin import Plugin, export
 
 ConsoleHostHistoryRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
-    "filesystem/windows/powershell/history",
+    "powershell/history",
     [
-        ("datetime", "last_modified"),
+        ("datetime", "mtime"),
         ("string", "command"),
-        ("uri", "path"),
+        ("path", "source"),
     ],
 )
 
 
 class PowerShellHistoryPlugin(Plugin):
+    PATHS = [
+        "AppData/Roaming/Microsoft/Windows/PowerShell/psreadline",
+        ".local/share/powershell/PSReadLine",
+    ]
+
     def __init__(self, target):
         super().__init__(target)
+
         self._history = []
+
         for user_details in target.user_details.all_with_home():
-            history_path = user_details.home_path.joinpath(
-                "AppData/Roaming/Microsoft/Windows/PowerShell/psreadline/consolehost_history.txt"
-            )
-            if history_path.exists():
-                self._history.append((user_details.user, history_path))
+            for ps_path in self.PATHS:
+                history_path = user_details.home_path.joinpath(ps_path)
+                for history_file in history_path.glob("*_history.txt"):
+                    self._history.append((user_details.user, history_file))
 
     def check_compatible(self):
         if not self._history:
@@ -35,21 +39,27 @@ class PowerShellHistoryPlugin(Plugin):
         """Return PowerShell command history for all users.
 
         The PowerShell ConsoleHost_history.txt file contains information about the commands executed with PowerShell in
-        a terminal. No data is recorded from terminal-less PowerShell sessions.
+        a terminal. No data is recorded from terminal-less PowerShell sessions. Commands are saved to disk after the process has completed.
+        PSReadLine does not save commands containing 'password', 'asplaintext', 'token', 'apikey' or 'secret'.
 
         References:
             - https://0xdf.gitlab.io/2018/11/08/powershell-history-file.html
-        """
-        for user, path in self._history:
-            for line in path.open("r"):
+            - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_history?view=powershell-7.3#order-of-commands-in-the-history
+            - https://learn.microsoft.com/en-us/powershell/module/psreadline/about/about_psreadline?view=powershell-7.3#command-history
+        """  # noqa E501
+
+        for user, _path in self._history:
+            file_mtime = _path.stat().st_mtime
+
+            for line in _path.open("r"):
                 line = line.strip()
                 if not line:
                     continue
 
                 yield ConsoleHostHistoryRecord(
-                    last_modified=path.stat().st_mtime,
+                    mtime=file_mtime,
                     command=line,
-                    path=uri.from_windows(str(path)),
+                    source=_path,
                     _target=self.target,
                     _user=user,
                 )

{dissect.target-3.9.dev11 → dissect.target-3.9.dev13/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.9.dev11
+Version: 3.9.dev13
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.9.dev11 → dissect.target-3.9.dev13}/dissect.target.egg-info/SOURCES.txt

@@ -100,6 +100,8 @@ dissect/target/plugins/apps/remoteaccess/__init__.py
 dissect/target/plugins/apps/remoteaccess/anydesk.py
 dissect/target/plugins/apps/remoteaccess/remoteaccess.py
 dissect/target/plugins/apps/remoteaccess/teamviewer.py
+dissect/target/plugins/apps/shell/__init__.py
+dissect/target/plugins/apps/shell/powershell.py
 dissect/target/plugins/apps/vpns/__init__.py
 dissect/target/plugins/apps/vpns/wireguard.py
 dissect/target/plugins/apps/webservers/__init__.py
@@ -208,7 +210,6 @@ dissect/target/plugins/os/windows/generic.py
 dissect/target/plugins/os/windows/lnk.py
 dissect/target/plugins/os/windows/locale.py
 dissect/target/plugins/os/windows/notifications.py
-dissect/target/plugins/os/windows/powershell.py
 dissect/target/plugins/os/windows/prefetch.py
 dissect/target/plugins/os/windows/recyclebin.py
 dissect/target/plugins/os/windows/registry.py
@@ -303,6 +304,7 @@ tests/test_plugins_apps_av_trendmicro.py
 tests/test_plugins_apps_containers_docker.py
 tests/test_plugins_apps_remoteaccess_anydesk.py
 tests/test_plugins_apps_remoteaccess_teamviewer.py
+tests/test_plugins_apps_shell_powershell.py
 tests/test_plugins_apps_vpns_wireguard.py
 tests/test_plugins_apps_webservers_apache.py
 tests/test_plugins_apps_webservers_caddy.py
@@ -461,6 +463,7 @@ tests/data/plugins/os/unix/linux/suse/zypp/history.1.gz
 tests/data/plugins/os/unix/services/initd.sh
 tests/data/plugins/os/unix/services/systemd.service
 tests/data/plugins/os/unix/services/systemd2.service
+tests/data/plugins/os/windows/powershell/ConsoleHost_history.txt
 tests/data/plugins/os/windows/tasks/MapsToastTask
 tests/data/ual/Current.mdb
 tests/data/ual/SystemIdentity.mdb

dissect.target-3.9.dev13/tests/data/plugins/os/windows/powershell/ConsoleHost_history.txt

@@ -0,0 +1,4 @@
+Write-Host "Hello World!"
+Get-Service | Where-Object {$_.Status -eq "Running"}
+Get-ComputerInfo -Property "*version"
+exit

dissect.target-3.9.dev13/tests/test_plugins_apps_shell_powershell.py

@@ -0,0 +1,35 @@
+import pytest
+
+from dissect.target.plugins.apps.shell.powershell import PowerShellHistoryPlugin
+
+from ._utils import absolute_path
+
+
+@pytest.mark.parametrize(
+    "target,fs,target_file",
+    [
+        (
+            "target_win_users",
+            "fs_win",
+            "users/John/AppData/Roaming/Microsoft/Windows/PowerShell/psreadline/ConsoleHost_history.txt",
+        ),
+        ("target_unix_users", "fs_unix", "/root/.local/share/powershell/PSReadLine/ConsoleHost_history.txt"),
+    ],
+)
+def test_plugins_os_windows_powershell(target, fs, target_file, request):
+    fs = request.getfixturevalue(fs)
+    target = request.getfixturevalue(target)
+
+    history_file = absolute_path("data/plugins/os/windows/powershell/ConsoleHost_history.txt")
+    fs.map_file(target_file, history_file)
+
+    if target_file.startswith("users/"):
+        target_file = target_file.replace("users/", "C:/Users/")
+
+    target.add_plugin(PowerShellHistoryPlugin)
+
+    records = list(target.powershell_history())
+
+    assert len(records) == 4
+    assert records[0].command == 'Write-Host "Hello World!"'
+    assert str(records[0].source) == target_file