dissect.target.plugins.os.windows.env#

Module Contents#

Classes#

EnvironmentVariablePlugin

Plugin that provides access to global environment variables.

Attributes#

EnvironmentRecord

PathextRecord

EnvVarDetails

dissect.target.plugins.os.windows.env.EnvironmentRecord#
dissect.target.plugins.os.windows.env.PathextRecord#
dissect.target.plugins.os.windows.env.EnvVarDetails#
class dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin(target: dissect.target.Target)#

Bases: dissect.target.plugin.Plugin

Plugin that provides access to global environment variables.

Mostly used internally.

property env: collections.OrderedDict[str, str]#

Return a dict of all found system environment variables.

property pathext: Set[str]#

Return a list of all found path extensions.

VARIABLES#
USER_VARIABLES#
check_compatible() → None#

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

expand_env(path: str, user_sid: str | None = None) → str#
user_env(user_sid: str | None = None) → collections.OrderedDict[str, str]#

Return a dict of all found (user) environment variables.

If no ``user_sid` is provided, this function will return just the system environment variables.

environment_variables() → Iterator[EnvironmentRecord]#

Return all environment variables on a Windows system.

Environment variables are dynamic-named values that can affect the way processes are running on the system. Examples variables are PATH, HOME and TEMP. Adversaries may alter or create environment variables to exploit a system.

References

path_extensions() → Iterator[PathextRecord]#

Return all found path extensions.