sandbox-cli 0.2.47__tar.gz → 0.2.49__tar.gz

{sandbox_cli-0.2.47 → sandbox_cli-0.2.49}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sandbox-cli
-Version: 0.2.47
+Version: 0.2.49
 Summary: Command line tool for interaction with sandboxes
 Project-URL: Homepage, https://github.com/Security-Experts-Community/sandbox-cli
 Project-URL: Documentation, https://security-experts-community.github.io/sandbox-cli
@@ -11,16 +11,16 @@ License-Expression: MIT
 License-File: LICENSE
 License-File: NOTICE
 Requires-Python: >=3.11
-Requires-Dist: aiofiles>=24.1.0
-Requires-Dist: asyncssh>=2.21.1
+Requires-Dist: aiofiles>=25.1.0
+Requires-Dist: asyncssh>=2.22.0
 Requires-Dist: colorama>=0.4.6
-Requires-Dist: cryptography>=46.0.2
-Requires-Dist: cyclopts>=4.2.5
+Requires-Dist: cryptography>=46.0.5
+Requires-Dist: cyclopts>=4.10.2
 Requires-Dist: docker>=7.1.0
-Requires-Dist: ptsandbox>=5.0.8
+Requires-Dist: ptsandbox>=5.0.11
 Requires-Dist: pyzipper>=0.3.6
-Requires-Dist: rich>=14.1.0
-Requires-Dist: zstandard>=0.23.0
+Requires-Dist: rich>=14.3.3
+Requires-Dist: zstandard>=0.25.0
 Description-Content-Type: text/markdown
 
 ![Image](https://raw.githubusercontent.com/Security-Experts-Community/sandbox-cli/refs/heads/main/docs/assets/logo_with_text.svg)

{sandbox_cli-0.2.47 → sandbox_cli-0.2.49}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sandbox-cli"
-version = "0.2.47"
+version = "0.2.49"
 description = "Command line tool for interaction with sandboxes"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -8,16 +8,16 @@ license = "MIT"
 license-files = ["LICENSE", "NOTICE"]
 authors = [{ name = "Alexey Kolesnikov" }]
 dependencies = [
-  "aiofiles>=24.1.0",
-  "asyncssh>=2.21.1",
+  "aiofiles>=25.1.0",
+  "asyncssh>=2.22.0",
   "colorama>=0.4.6",
-  "cryptography>=46.0.2",
-  "cyclopts>=4.2.5",
+  "cryptography>=46.0.5",
+  "cyclopts>=4.10.2",
   "docker>=7.1.0",
-  "ptsandbox>=5.0.8",
+  "ptsandbox>=5.0.11",
   "pyzipper>=0.3.6",
-  "rich>=14.1.0",
-  "zstandard>=0.23.0",
+  "rich>=14.3.3",
+  "zstandard>=0.25.0",
 ]
 
 [project.urls]

{sandbox_cli-0.2.47 → sandbox_cli-0.2.49}/sandbox_cli/cli/downloader.py

@@ -161,13 +161,31 @@ async def download_command(
             group="Download options",
         ),
     ] = False,
+    amsi: Annotated[
+        bool,
+        Parameter(
+            name=["--amsi", "-am"],
+            help="Download amsi-dumps",
+            negative="",
+            group="Download options",
+        ),
+    ] = False,
+    dex: Annotated[
+        bool,
+        Parameter(
+            name=["--dex", "-dx"],
+            help="Download dex-dumps",
+            negative="",
+            group="Download options",
+        ),
+    ] = False,
     query: Annotated[
         str | None,
         Parameter(
             name=["--query", "-q"],
             help="Query for searching tasks (leave empty for last tasks)",
             group="Search",
-        )
+        ),
     ] = None,
     count: Annotated[
         int,
@@ -175,7 +193,7 @@ async def download_command(
             name=["--count", "-c"],
             help="How many tasks find and download",
             group="Search",
-        )
+        ),
     ] = 20,
 ) -> None:
     """
@@ -206,6 +224,8 @@ async def download_command(
         logs: bool = False,
         procdumps: bool = False,
         video: bool = False,
+        amsi: bool = False,
+        dex: bool = False,
         progress: Progress | None = None,
     ) -> None:
         await download(
@@ -219,6 +239,8 @@ async def download_command(
             crashdumps=crashdumps,
             procdumps=procdumps,
             video=video,
+            amsi=amsi,
+            dex=dex,
             logs=logs,
             decompress=decompress,
             progress=progress,
@@ -266,6 +288,8 @@ async def download_command(
                 crashdumps=crashdumps,
                 procdumps=procdumps,
                 video=video,
+                amsi=amsi,
+                dex=dex,
                 logs=logs,
                 decompress=decompress,
                 progress=progress,
@@ -304,6 +328,7 @@ async def download_command(
     # clear last line
     sys.stdout.write("\033[F\033[K")
 
+
 def download_email(
     emails: Annotated[
         list[Path],

{sandbox_cli-0.2.47 → sandbox_cli-0.2.49}/sandbox_cli/cli/scanner/__init__.py

@@ -1,4 +1,5 @@
 import sys
+from collections import deque
 from collections.abc import Sequence
 from pathlib import Path
 from typing import Annotated, Any
@@ -51,6 +52,40 @@ def rules_path_resolver(_: Any, tokens: Sequence[Token]) -> Path | None:
     return path
 
 
+def files_path_resolver(files: list[Path]) -> list[Path] | None:
+    files_queue = deque(files)
+    files_for_analysis: set[Path] = set()
+
+    is_ok = True
+    while files_queue:
+        file = files_queue.popleft()
+
+        # process wildcards
+        if sys.platform == "win32" and "*" in str(file):
+            for f in Path.cwd().glob(str(file)):
+                if f.is_file():
+                    files_queue.append(f)
+            continue
+
+        file = file.expanduser().resolve()
+
+        if not file.exists():
+            console.error(f"{str(file)} doesn't exist")
+            is_ok = False
+
+        if file.is_dir():
+            files_for_analysis.update(file.glob("**/*"))
+            continue
+
+        files_for_analysis.add(file)
+
+    if len(files_for_analysis) == 0:
+        console.error("Nothing to scan")
+        is_ok = False
+
+    return list(files_for_analysis) if is_ok else None
+
+
 @scanner.command(name="re-scan")
 async def re_scan(
     traces: Annotated[
@@ -322,6 +357,24 @@ async def scan(
             group="Download options",
         ),
     ] = False,
+    amsi: Annotated[
+        bool,
+        Parameter(
+            name=["--amsi", "-am"],
+            help="Download amsi-dumps",
+            negative="",
+            group="Download options",
+        ),
+    ] = False,
+    dex: Annotated[
+        bool,
+        Parameter(
+            name=["--dex", "-dx"],
+            help="Download dex-dumps",
+            negative="",
+            group="Download options",
+        ),
+    ] = False,
     decompress: Annotated[
         bool,
         Parameter(
@@ -356,27 +409,9 @@ async def scan(
     if images is None:
         images = {settings.default_image}
 
-    # parse files options
-    is_ok = True
-    files_for_analysis: list[Path] = []
-    for file in files:
-        file = file.expanduser().resolve()
-
-        if not file.exists():
-            console.error(f"{str(file)} doesn't exists")
-            is_ok = False
-
-        if file.is_dir():
-            files_for_analysis.extend(file.glob("**/*"))
-            continue
+    files_for_analysis = files_path_resolver(files)
 
-        files_for_analysis.append(file)
-
-    if not is_ok:
-        sys.exit(1)
-
-    if len(files_for_analysis) == 0:
-        console.error("Nothing to scan")
+    if not files_for_analysis:
         sys.exit(1)
 
     await scan_internal(
@@ -401,6 +436,8 @@ async def scan(
         procdumps=procdumps,
         decompress=decompress,
         open_browser=open_browser,
+        amsi=amsi,
+        dex=dex,
     )
 
 
@@ -637,6 +674,15 @@ async def scan_new(
             negative="",
         ),
     ] = None,
+    file_type_as_ext: Annotated[
+        bool | None,
+        Parameter(
+            name=["--file-type-as-ext", "-fe"],
+            help="Use a file type as an extension for a file",
+            group="Sandbox Options",
+            negative="",
+        ),
+    ] = None,
     all: Annotated[
         bool,
         Parameter(
@@ -691,6 +737,24 @@ async def scan_new(
             group="Download options",
         ),
     ] = False,
+    amsi: Annotated[
+        bool,
+        Parameter(
+            name=["--amsi", "-am"],
+            help="Download amsi-dumps",
+            negative="",
+            group="Download options",
+        ),
+    ] = False,
+    dex: Annotated[
+        bool,
+        Parameter(
+            name=["--dex", "-dx"],
+            help="Download dex-dumps",
+            negative="",
+            group="Download options",
+        ),
+    ] = False,
     decompress: Annotated[
         bool,
         Parameter(
@@ -730,27 +794,9 @@ async def scan_new(
     if extra_files is None:
         extra_files = []
 
-    # parse files options
-    is_ok = True
-    files_for_analysis: list[Path] = []
-    for file in files:
-        file = file.expanduser().resolve()
-
-        if not file.exists():
-            console.error(f"{str(file)} doesn't exists")
-            is_ok = False
-
-        if file.is_dir():
-            files_for_analysis.extend(file.glob("**/*"))
-            continue
+    files_for_analysis = files_path_resolver(files)
 
-        files_for_analysis.append(file)
-
-    if not is_ok:
-        sys.exit(1)
-
-    if len(files_for_analysis) == 0:
-        console.error("Nothing to scan")
+    if not files_for_analysis:
         sys.exit(1)
 
     await scan_internal_advanced(
@@ -790,4 +836,7 @@ async def scan_new(
         open_browser=open_browser,
         preserve_filename=preserve_filename,
         outbound_connections=outbound_connections,
+        amsi=amsi,
+        dex=dex,
+        file_type_as_ext=file_type_as_ext,
     )

{sandbox_cli-0.2.47 → sandbox_cli-0.2.49}/sandbox_cli/utils/downloader/__init__.py

@@ -25,8 +25,10 @@ semaphore = asyncio.Semaphore(value=16)
 # At first glance, it's counter-intuitive, but ArtifactType can contain not only predefined fields in it, but also newly added.
 # This usually happens when a new feature is released in the sandbox.
 _KNOWN_ARTIFACT_TYPES = {
+    ArtifactType.AMSI,
     ArtifactType.ARCHIVE,
     ArtifactType.COMPRESSED,
+    ArtifactType.DEX_DUMP,
     ArtifactType.EMAIL,
     ArtifactType.FILE,
     ArtifactType.PROCESS_DUMP,
@@ -122,6 +124,8 @@ async def download(
     logs: bool = False,
     procdumps: bool = False,
     video: bool = False,
+    amsi: bool = False,
+    dex: bool = False,
     progress: Progress | None = None,
     idx: str | None = None,
     image: str | None = None,
@@ -213,6 +217,20 @@ async def download(
                             decompress=decompress,
                         )
 
+                    if artifact.type == ArtifactType.AMSI and (amsi or all):
+                        add_task(
+                            output / "amsi",
+                            f"{artifact.file_info.sha256}.bin",
+                            artifact.file_info.file_uri,
+                        )
+
+                    if artifact.type == ArtifactType.DEX_DUMP and (dex or all):
+                        add_task(
+                            output / "dex",
+                            f"{artifact.file_info.sha256}.bin",
+                            artifact.file_info.file_uri,
+                        )
+
                     if all and artifact.type not in _KNOWN_ARTIFACT_TYPES:
                         add_task(
                             output / "other",

{sandbox_cli-0.2.47 → sandbox_cli-0.2.49}/sandbox_cli/utils/scanner/__init__.py

@@ -153,6 +153,8 @@ async def scan_internal(
     crashdumps: bool,
     procdumps: bool,
     decompress: bool,
+    amsi: bool,
+    dex: bool,
     open_browser: bool,
 ) -> None:
     key = get_key_by_name(key_name)
@@ -216,6 +218,8 @@ async def scan_internal(
             files=download_files,
             crashdumps=crashdumps,
             procdumps=procdumps,
+            amsi=amsi,
+            dex=dex,
             video=True,
             logs=True,
             decompress=decompress,

{sandbox_cli-0.2.47 → sandbox_cli-0.2.49}/sandbox_cli/utils/scanner/advanced.py

@@ -105,6 +105,7 @@ async def _prepare_sandbox_new_scan(
     skip_sample_run: bool,
     vnc_mode: VNCMode,
     outbound_connections: list[str] | None,
+    file_type_as_ext: bool | None,
 ) -> tuple[Sandbox, SandboxOptionsAdvanced, set[VMImage | str]]:
     sandbox = Sandbox(key=sandbox_key)
 
@@ -200,6 +201,10 @@ async def _prepare_sandbox_new_scan(
         progress.console.print(f"{console.INFO} Commandline: {custom_command}")
         sandbox_options.custom_command = custom_command
 
+    if file_type_as_ext is not None:
+        progress.console.print(f"{console.INFO} Using magic types from the sandbox")
+        sandbox_options.debug_options["file_type_as_ext"] = file_type_as_ext
+
     # add extra options
     sandbox_options.debug_options["allowed_outbound_connections"] = outbound_connections or []
     sandbox_options.procdump_new_processes_on_finish = not no_procdumps_on_finish
@@ -250,9 +255,12 @@ async def scan_internal_advanced(
     crashdumps: bool,
     procdumps: bool,
     decompress: bool,
+    amsi: bool,
+    dex: bool,
     open_browser: bool,
     preserve_filename: bool,
     outbound_connections: list[str] | None,
+    file_type_as_ext: bool | None,
 ) -> None:
     key = get_key_by_name(key_name)
     sandbox_sem = asyncio.Semaphore(value=key.max_workers)
@@ -365,6 +373,8 @@ async def scan_internal_advanced(
                 procdumps=procdumps,
                 progress=progress,
                 video=True,  # by default download video
+                amsi=amsi,
+                dex=dex,
                 idx=idx,
                 image=formatted_image,
                 link=formatted_link,
@@ -424,6 +434,7 @@ async def scan_internal_advanced(
             skip_sample_run=skip_sample_run,
             vnc_mode=vnc_mode,
             outbound_connections=outbound_connections,
+            file_type_as_ext=file_type_as_ext,
         )
         max_image_length = max(len(x) for x in images)
         for i, image_id in enumerate(images):