sandbox-cli 0.2.32__tar.gz → 0.2.34__tar.gz

{sandbox_cli-0.2.32 → sandbox_cli-0.2.34}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sandbox-cli
-Version: 0.2.32
+Version: 0.2.34
 Summary: Command line tool for interaction with sandboxes
 Project-URL: Homepage, https://github.com/Security-Experts-Community/sandbox-cli
 Project-URL: Documentation, https://security-experts-community.github.io/sandbox-cli
@@ -12,13 +12,13 @@ License-File: LICENSE
 License-File: NOTICE
 Requires-Python: >=3.11
 Requires-Dist: aiofiles>=24.1.0
-Requires-Dist: asyncssh>=2.20.0
-Requires-Dist: cryptography>=44.0.2
-Requires-Dist: cyclopts>=3.16.0
+Requires-Dist: asyncssh>=2.21.0
+Requires-Dist: cryptography>=45.0.4
+Requires-Dist: cyclopts>=3.22.5
 Requires-Dist: docker>=7.1.0
-Requires-Dist: ptsandbox>=5.0.4
+Requires-Dist: ptsandbox>=5.0.6
 Requires-Dist: pyzipper>=0.3.6
-Requires-Dist: rich>=14.0.0
+Requires-Dist: rich>=14.1.0
 Requires-Dist: zstandard>=0.23.0
 Description-Content-Type: text/markdown
 

{sandbox_cli-0.2.32 → sandbox_cli-0.2.34}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sandbox-cli"
-version = "0.2.32"
+version = "0.2.34"
 description = "Command line tool for interaction with sandboxes"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -9,13 +9,13 @@ license-files = ["LICENSE", "NOTICE"]
 authors = [{ name = "Alexey Kolesnikov" }]
 dependencies = [
   "aiofiles>=24.1.0",
-  "asyncssh>=2.20.0",
-  "cryptography>=44.0.2",
-  "cyclopts>=3.16.0",
+  "asyncssh>=2.21.0",
+  "cryptography>=45.0.4",
+  "cyclopts>=3.22.5",
   "docker>=7.1.0",
-  "ptsandbox>=5.0.4",
+  "ptsandbox>=5.0.6",
   "pyzipper>=0.3.6",
-  "rich>=14.0.0",
+  "rich>=14.1.0",
   "zstandard>=0.23.0",
 ]
 

{sandbox_cli-0.2.32 → sandbox_cli-0.2.34}/sandbox_cli/cli/downloader.py

@@ -1,4 +1,5 @@
 import asyncio
+import os
 from collections.abc import Coroutine
 from http import HTTPStatus
 from pathlib import Path
@@ -9,10 +10,11 @@ from uuid import UUID
 import aiofiles
 import aiohttp
 import aiohttp.client_exceptions
+import orjson
 from cyclopts import Parameter
 from ptsandbox import Sandbox
 from ptsandbox.models import Artifact, SandboxBaseTaskResponse
-from rich.progress import Progress, SpinnerColumn, TextColumn, TimeElapsedColumn
+from rich.progress import Progress, SpinnerColumn, TaskID, TextColumn, TimeElapsedColumn
 
 from sandbox_cli.console import console
 from sandbox_cli.internal.config import settings
@@ -51,20 +53,19 @@ async def download_command(
         Parameter(
             help="Links to tasks or task ids",
             negative="",
-            required=True,
         ),
-    ],
+    ] = [],
     /,
     *,
     key: Annotated[
         str,
         Parameter(
             name=["--key", "-k"],
-            help=f"The key to access the sandbox **{'**,**'.join(x.name for x in settings.sandbox_keys)}**",
+            help=f"The key to access the sandbox **{'**,**'.join(x.name.get_secret_value() for x in settings.sandbox_keys)}**",
             validator=validate_key,
             group="Sandbox",
         ),
-    ] = settings.sandbox_keys[0].name,
+    ] = settings.sandbox_keys[0].name.get_secret_value(),
     out_dir: Annotated[
         Path,
         Parameter(
@@ -127,7 +128,7 @@ async def download_command(
     crashdumps: Annotated[
         bool,
         Parameter(
-            name=["--crashdumps", "-c"],
+            name=["--crashdumps", "-C"],
             help="Download crashdumps (maybe be more 1GB)",
             negative="",
             group="Download options",
@@ -160,11 +161,35 @@ async def download_command(
             group="Download options",
         ),
     ] = False,
+    query: Annotated[
+        str | None,
+        Parameter(
+            name=["--query", "-q"],
+            help="Query for searching tasks (leave empty for last tasks)",
+            group="Search",
+        )
+    ] = None,
+    count: Annotated[
+        int,
+        Parameter(
+            name=["--count", "-c"],
+            help="How many tasks find and download",
+            group="Search",
+        )
+    ] = 20,
 ) -> None:
     """
     Download any artifact from the sandbox.
     """
 
+    progress = Progress(
+        SpinnerColumn(),
+        TextColumn("{task.description}"),
+        TimeElapsedColumn(),
+        console=console,
+        transient=True,
+    )
+
     async def worker(
         report: SandboxBaseTaskResponse.LongReport,
         sandbox: Sandbox,
@@ -197,39 +222,30 @@ async def download_command(
         )
 
         if unpack and out_dir.exists():
-            Unpack(out_dir).run()
-
-    progress = Progress(
-        SpinnerColumn(),
-        TextColumn("{task.description}"),
-        TimeElapsedColumn(),
-        console=console,
-        transient=True,
-    )
-
-    tasks: list[Coroutine[Any, Any, Artifact.EngineResult | None]] = []
+            # multiple images can be downloaded from the task
+            if not (out_dir / "events-correlated.log.gz").exists():
+                subfolders = [f.path for f in os.scandir(out_dir) if f.is_dir()]
+                for folder in subfolders:
+                    Unpack(Path(folder)).run()
+            else:
+                Unpack(out_dir).run()
 
-    for task in tasks_id:
-        sandbox, task_id = get_key_and_task(key, task)
-        if not sandbox or not task_id:
-            continue
+    async def create_task(sandbox: Sandbox, task_id: str) -> None:
+        progress_task_id = progress.add_task(description=rf"\[[green1]{task_id}[/]] fetching info", start=True)
 
         try:
             result = await sandbox.get_report(task_id=task_id)
         except aiohttp.client_exceptions.ClientResponseError as e:
             if e.status == HTTPStatus.NOT_FOUND:
-                console.warning(
-                    f"The report cannot be accessed from {task_id}.\n"
-                    "Read more about it in: https://security-experts-community.github.io/py-ptsandbox/usage/public-api/download-files/"
-                )
-            continue
+                console.warning(f"Not found information for {task_id}")
+            return
 
         if (report := result.get_long_report()) is None:
-            console.warning(
-                f"The report cannot be accessed from {task_id}.\n"
-                "Read more about it in: https://security-experts-community.github.io/py-ptsandbox/usage/public-api/download-files/"
-            )
-            continue
+            console.warning(f"Not found information for {task_id}")
+            return
+
+        progress.stop_task(task_id=progress_task_id)
+        progress.update(task_id=progress_task_id, visible=False)
 
         tasks.append(
             worker(
@@ -249,6 +265,30 @@ async def download_command(
             )
         )
 
+    tasks: list[Coroutine[Any, Any, Artifact.EngineResult | None]] = []
+
+    if query is not None:
+        sandbox = Sandbox(get_key_by_name(key_name=key))
+
+        limit = 40 if count > 40 else count
+        viewed, next_cursor = 0, ""
+
+        while viewed <= count:
+            response = await sandbox.get_tasks(query=query, limit=limit, next_cursor=next_cursor)
+
+            with progress:
+                await asyncio.gather(*(create_task(sandbox, task.id) for task in response.tasks))
+
+            viewed += limit
+            next_cursor = response.next_cursor
+
+    for task in tasks_id:
+        sandbox, task_id = get_key_and_task(key, task)
+        if not sandbox or not task_id:
+            continue
+
+        await create_task(sandbox, task_id)
+
     with progress:
         await asyncio.gather(*tasks)
 
@@ -273,11 +313,11 @@ def download_email(
         str,
         Parameter(
             name=["--key", "-k"],
-            help=f"The key to access the sandbox **{'**,**'.join(x.name for x in settings.sandbox_keys)}**",
+            help=f"The key to access the sandbox **{'**,**'.join(x.name.get_secret_value() for x in settings.sandbox_keys)}**",
             validator=validate_key,
             group="Sandbox",
         ),
-    ] = settings.sandbox_keys[0].name,
+    ] = settings.sandbox_keys[0].name.get_secret_value(),
 ) -> None:
     """
     Upload an email and get its headers.

{sandbox_cli-0.2.32 → sandbox_cli-0.2.34}/sandbox_cli/cli/images.py

@@ -15,11 +15,11 @@ async def get_images(
         str,
         Parameter(
             name=["--key", "-k"],
-            help=f"The key to access the sandbox **{'**,**'.join(x.name for x in settings.sandbox_keys)}**",
+            help=f"The key to access the sandbox **{'**,**'.join(x.name.get_secret_value() for x in settings.sandbox_keys)}**",
             validator=validate_key,
             group="Sandbox",
         ),
-    ] = settings.sandbox_keys[0].name,
+    ] = settings.sandbox_keys[0].name.get_secret_value(),
 ) -> None:
     """
     Get available images in the sandbox.

{sandbox_cli-0.2.32 → sandbox_cli-0.2.34}/sandbox_cli/cli/scanner/__init__.py

@@ -80,11 +80,11 @@ async def re_scan(
         str,
         Parameter(
             name=["--key", "-k"],
-            help=f"The key to access the sandbox **{'**,**'.join(x.name for x in settings.sandbox_keys)}**",
+            help=f"The key to access the sandbox **{'**,**'.join(x.name.get_secret_value() for x in settings.sandbox_keys)}**",
             validator=validate_key,
             group="Sandbox Options",
         ),
-    ] = settings.sandbox_keys[0].name,
+    ] = settings.sandbox_keys[0].name.get_secret_value(),
     is_local: Annotated[
         bool,
         Parameter(
@@ -118,6 +118,14 @@ async def re_scan(
             negative="",
         ),
     ] = False,
+    timeout: Annotated[
+        int,
+        Parameter(
+            name=["--timeout", "-t"],
+            help="Response waiting time (increase this value if large traces are scanned)",
+            validator=validators.Number(gt=0, lt=3600),
+        ),
+    ] = 300,
 ) -> None:
     """
     Send traces to re-scan.
@@ -146,6 +154,7 @@ async def re_scan(
         unpack=unpack,
         debug=debug,
         open_browser=open_browser,
+        timeout=timeout,
     )
 
 
@@ -189,11 +198,11 @@ async def scan(
         str,
         Parameter(
             name=["--key", "-k"],
-            help=f"The key to access the sandbox **{'**,**'.join(x.name for x in settings.sandbox_keys)}**",
+            help=f"The key to access the sandbox **{'**,**'.join(x.name.get_secret_value() for x in settings.sandbox_keys)}**",
             validator=validate_key,
             group="Sandbox Options",
         ),
-    ] = settings.sandbox_keys[0].name,
+    ] = settings.sandbox_keys[0].name.get_secret_value(),
     is_local: Annotated[
         bool,
         Parameter(
@@ -435,11 +444,11 @@ async def scan_new(
         str,
         Parameter(
             name=["--key", "-k"],
-            help=f"The key to access the sandbox **{'**,**'.join(x.name for x in settings.sandbox_keys)}**",
+            help=f"The key to access the sandbox **{'**,**'.join(x.name.get_secret_value() for x in settings.sandbox_keys)}**",
             validator=validate_key,
             group="Sandbox Options",
         ),
-    ] = settings.sandbox_keys[0].name,
+    ] = settings.sandbox_keys[0].name.get_secret_value(),
     is_local: Annotated[
         bool,
         Parameter(

{sandbox_cli-0.2.32 → sandbox_cli-0.2.34}/sandbox_cli/internal/helpers.py

@@ -13,7 +13,7 @@ from sandbox_cli.models.sandbox_arguments import SandboxArguments
 
 def get_key_by_name(key_name: str) -> SandboxKey:
     for sandbox_key in settings.sandbox_keys:
-        if sandbox_key.name == key_name:
+        if sandbox_key.name.get_secret_value() == key_name:
             return sandbox_key
     raise KeyError()
 
@@ -30,8 +30,9 @@ def validate_key(_: Any, value: Any) -> None:
     try:
         get_key_by_name(value)
     except KeyError:
+        available = "', '".join(x.name.get_secret_value() for x in settings.sandbox_keys)
         console.error(
-            f'Key "{value}" doesn\'t exists in config. Available keys: "{'","'.join(x.name for x in settings.sandbox_keys)}"'
+            f'Key "{value}" doesn\'t exist in config. Available keys: "{available}"'
         )
         sys.exit(1)
 
@@ -78,11 +79,11 @@ def save_scan_arguments(out_dir: Path, scan_args: SandboxArguments) -> None:
 
 
 def open_link(link: str) -> None:
-    if settings.browser != None:
+    if settings.browser is not None:
         webbrowser.register("new_default_browser", None, webbrowser.GenericBrowser([settings.browser.path, *settings.browser.args]), preferred=True)
         if not webbrowser.open(link):
             console.error("Can't open link in the specified browser. Please check browser path and args.")
         return
-    
+
     if not webbrowser.open_new_tab(link):
         console.error("Can't open link in the default browser. Try adding path and args for your browser to the config file.")

{sandbox_cli-0.2.32 → sandbox_cli-0.2.34}/sandbox_cli/utils/downloader/__init__.py

@@ -18,8 +18,9 @@ from rich.markup import escape
 from rich.progress import Progress, TaskID
 
 from sandbox_cli.console import console
+from sandbox_cli.internal.config import settings
 
-semaphore = asyncio.Semaphore(value=12)
+semaphore = asyncio.Semaphore(value=16)
 
 
 async def _save_artifact(
@@ -28,6 +29,7 @@ async def _save_artifact(
     out_dir: Path,
     path: Path,
     file_uri: str,
+    overwrite: bool = False,
     decompress: bool = False,
     progress: Progress | None = None,
     idx: str | None = None,
@@ -40,12 +42,14 @@ async def _save_artifact(
 
     # sanitize path
     path = out_dir / Path(str(path).replace(" ", "_"))
-    n = 1
-    while path.exists():
-        if not path.with_name(path.name + f"_{n}").exists():
-            path = path.with_name(path.name + f"_{n}")
-            break
-        n += 1
+    if not overwrite:
+        n = 1
+        while path.exists():
+            if not path.with_name(path.name + f"_{n}").exists():
+                path = path.with_name(path.name + f"_{n}")
+                break
+            n += 1
+
     path.parent.mkdir(exist_ok=True, parents=True)
     path.touch()
     task_id: TaskID = None  # type: ignore
@@ -107,7 +111,7 @@ async def download(
 ) -> None:
     tasks: list[Coroutine[Any, Any, None]] = []
 
-    def add_task(out_dir: Path, path: Path, file_uri: str, decompress: bool = False) -> None:
+    def add_task(out_dir: Path, path: Path, file_uri: str, decompress: bool = False, overwrite: bool = False) -> None:
         tasks.append(
             _save_artifact(
                 scan_id=report.scan_id,
@@ -120,66 +124,73 @@ async def download(
                 image=image,
                 link=link,
                 decompress=decompress,
+                overwrite=overwrite,
             )
         )
 
     for artifact in report.artifacts:
-        sandbox_result = artifact.find_sandbox_result()
-        if sandbox_result is None:
-            continue
+        for sandbox_result in artifact.get_sandbox_results():
+            if sandbox_result is None:
+                continue
 
-        if sandbox_result.details is None:
-            continue
+            if sandbox_result.details is None:
+                continue
 
-        if sandbox_result.details.sandbox is None:
-            continue
+            if sandbox_result.details.sandbox is None:
+                continue
 
-        for log in sandbox_result.details.sandbox.logs:
-            # download default logs by default
-            if (all or logs) and log.type in {
-                LogType.EVENT_CORRELATED,
-                LogType.EVENT_NORMALIZED,
-                LogType.EVENT_RAW,
-                LogType.NETWORK,
-            }:
-                add_task(out_dir, log.file_name, log.file_uri)
+            if sandbox_result.details.sandbox.image and (image_id := sandbox_result.details.sandbox.image.image_id):
+                output = out_dir / image_id
+            else:
+                output = out_dir
 
-            if (all or video) and log.type == LogType.SCREENSHOT:
-                add_task(out_dir, log.file_name, log.file_uri)
+            for log in sandbox_result.details.sandbox.logs:
+                # download default logs by default
+                if (all or logs) and log.type in {
+                    LogType.EVENT_CORRELATED,
+                    LogType.EVENT_NORMALIZED,
+                    LogType.EVENT_RAW,
+                    LogType.NETWORK,
+                }:
+                    add_task(output, log.file_name, log.file_uri, overwrite=True)
 
-            if (all or crashdumps) and log.file_name in {"crashdump.bin", "crashdump.metadata"}:
-                add_task(out_dir / "crashdumps", log.file_name, log.file_uri)
+                if (all or video) and log.type == LogType.SCREENSHOT:
+                    add_task(output, log.file_name, log.file_uri, overwrite=True)
 
-            if (all or debug) and log.type in {LogType.DEBUG, LogType.GRAPH}:
-                add_task(out_dir / "debug", log.file_name, log.file_uri)
+                if (all or crashdumps) and log.file_name in {"crashdump.bin", "crashdump.metadata"}:
+                    add_task(output / "crashdumps", log.file_name, log.file_uri)
 
-        if artifacts or files or procdumps or all:
-            if not sandbox_result.details:
-                continue
+                if (all or debug) and log.type in {LogType.DEBUG, LogType.GRAPH}:
+                    add_task(output / "debug", log.file_name, log.file_uri)
 
-            if not sandbox_result.details.sandbox:
-                continue
+            if artifacts or files or procdumps or all:
+                if not sandbox_result.details:
+                    continue
 
-            if not sandbox_result.details.sandbox.artifacts:
-                continue
+                if not sandbox_result.details.sandbox:
+                    continue
 
-            for artifact in sandbox_result.details.sandbox.artifacts:
-                if not artifact.file_info:
+                if not sandbox_result.details.sandbox.artifacts:
                     continue
 
-                if artifact.type == ArtifactType.FILE and (files or artifacts or all):
-                    add_task(
-                        out_dir / "artifacts",
-                        artifact.file_info.file_path.removeprefix("/"),
-                        artifact.file_info.file_uri,
-                    )
-                if artifact.type == ArtifactType.PROCESS_DUMP and (procdumps or artifacts or all):
-                    add_task(
-                        out_dir / "process_dump",
-                        artifact.file_info.details.process_dump.process_name.removeprefix("/"),  # type: ignore
-                        artifact.file_info.file_uri,
-                        decompress=decompress,
-                    )
+                for artifact in sandbox_result.details.sandbox.artifacts:
+                    if not artifact.file_info:
+                        continue
+
+                    if artifact.type == ArtifactType.FILE and (files or artifacts or all):
+                        add_task(
+                            output / "artifacts",
+                            artifact.file_info.file_path.removeprefix("/"),
+                            artifact.file_info.file_uri,
+                        )
+                    if artifact.type == ArtifactType.PROCESS_DUMP and (procdumps or artifacts or all):
+                        add_task(
+                            output / "process_dump",
+                            artifact.file_info.details.process_dump.process_name.removeprefix("/"),  # type: ignore
+                            artifact.file_info.file_uri,
+                            decompress=decompress,
+                        )
+
     if not tasks:
         console.info(f"Nothing to download from {report.scan_id}")
 

{sandbox_cli-0.2.32 → sandbox_cli-0.2.34}/sandbox_cli/utils/scanner/rescan.py

@@ -98,6 +98,7 @@ async def rescan_internal(
     unpack: bool,
     debug: bool,
     open_browser: bool,
+    timeout: int,
 ) -> None:
     key = get_key_by_name(key_name)
     sandbox_sem = asyncio.Semaphore(value=key.max_workers)
@@ -128,19 +129,13 @@ async def rescan_internal(
         async with sandbox_sem:
             task_id = progress.add_task(description="Creating task", idx=idx, url="...")
 
-            wait_time = (
-                round(sandbox_options.sandbox.analysis_duration * 1.5)
-                if sandbox_options.sandbox.analysis_duration > 70
-                else 70
-            )
-
             try:
                 rescan_result = await sandbox.create_rescan(
                     drakvuf_trace,
                     tcpdump_pcap,
                     options=sandbox_options,
                     rules=None,
-                    read_timeout=wait_time,
+                    read_timeout=timeout,
                 )
             except SandboxUploadException as e:
                 console.error(f"[yellow]{trace}[/] • an error occurred when uploading a file to the server • {e}")
@@ -162,7 +157,7 @@ async def rescan_internal(
                 description=f"Waiting for full report for [yellow]{trace.name}[/]",
                 url=formatted_link,
             )
-            if not (awaited_report := await sandbox.wait_for_report(rescan_result, wait_time)):
+            if not (awaited_report := await sandbox.wait_for_report(rescan_result, timeout)):
                 console.error(f"Rescan failed for [yellow]{trace.name}[/] • {formatted_link} • {rescan_result}")
                 progress.remove_task(task_id)
                 return