dissect.target.loaders.smb
#
Module Contents#
Classes#
Use remote SMB servers as targets. |
|
Provides registry access for Windows targets. |
|
Base class for registry hives. |
|
Base class for registry keys. |
|
Base class for registry values. |
- class dissect.target.loaders.smb.SmbLoader(path: pathlib.Path | str, **kwargs)#
Bases:
dissect.target.loader.Loader
Use remote SMB servers as targets.
This loader maps SMB shares from a remote SMB server as filesystems. It makes use of Impacket’s
SMBConnection
class to connect to the remote server and enumerate all available shares. The shares are then mapped as filesystems in the target. You can use the following examples to connect to a guest.Connect as guest (you’re probably not going to get very far with this one):
smb://10.10.128.3
Connect as administrator using NTLM password authentication:
smb://administrator:Dissect123!@10.10.128.3
Connect as administrator using NTLM pass-the-hash authentication:
smb://administrator@10.10.128.3?hash=3c19c73ccd2bbcb84c592321caa4b1be
Connect using a Kerberos authentication:
smb://administrator@infected.dissect.lab?kerberos=true&ip=10.10.128.3&ticket=administrator.ccache&dc=dc01.dissect.lab&dc-ip=10.10.10.10
You can also use the following environment variables instead:
SMB_TARGET_IP
SMB_TARGET_HOST
SMB_DOMAIN
SMB_USERNAME
SMB_PASSWORD
SMB_KERBEROS_TICKET (or KRB5CCNAME)
SMB_KERBEROS_DC
SMB_KERBEROS_DC_IP
SMB_KERBEROS_AES_KEY
When using environment variables, you can invoke this loader using an empty
smb://
URI.- MACHINE_NAME = 'DISSECT-TARGET'#
- EMPTY_NT = '31d6cfe0d16ae931b73c59d7e0c089c0'#
- EMPTY_LM = 'aad3b435b51404eeaad3b435b51404ee'#
- static detect(path: pathlib.Path) bool #
This loader can only be activated with the URI-scheme
smb://<ip>
.
- map(target: dissect.target.Target) None #
Map all target filesystems (network shares) from the SMB connection.
- class dissect.target.loaders.smb.SmbRegistry(target: dissect.target.Target, conn: impacket.smbconnection.SMBConnection)#
Bases:
dissect.target.plugins.os.windows.registry.RegistryPlugin
Provides registry access for Windows targets.
Acts much the same to how the registry works on a live Windows machine. Hives are correctly mapped under e.g. HKLMSOFTWARE.
Internal functions only.
- __register__ = False#
- check_compatible() bool #
Perform a compatibility check with the target.
This function should return
None
if the plugin is compatible with the current target (self.target
). For example, check if a certain file exists. Otherwise it should raise anUnsupportedPluginError
.- Raises:
UnsupportedPluginError – If the plugin could not be loaded.
- __del__() None #
- class dissect.target.loaders.smb.SmbRegistryHive(winreg: impacket.dcerpc.v5.rpcrt.DCERPC_v5, name: str, handle: int)#
Bases:
dissect.target.helpers.regutil.RegistryHive
Base class for registry hives.
- key(key: str) SmbRegistryKey #
Retrieve a registry key from a specific path.
- Parameters:
key – A path to a registry key within this hive.
- Raises:
RegistryKeyNotFoundError – If the registry key could not be found.
- class dissect.target.loaders.smb.SmbRegistryKey(hive: SmbRegistryHive, path: str)#
Bases:
dissect.target.helpers.regutil.RegistryKey
Base class for registry keys.
- Parameters:
hive – The registry hive to which this registry key belongs.
- property name: str#
Returns the name of this key.
- property path: str#
Returns the path of this key.
- property timestamp: datetime.datetime#
Returns the last modified timestamp of this key.
- hive: SmbRegistryHive#
- handle() int #
- subkey(subkey: str) SmbRegistryKey #
Returns a specific subkey from this key.
- Parameters:
subkey – The name of the subkey to retrieve.
- Raises:
RegistryKeyNotFoundError – If this key has no subkey with the requested name.
- subkeys() list[SmbRegistryKey] #
Returns a list of subkeys from this key.
- value(value: str) str #
Returns a specific value from this key.
- Parameters:
value – The name of the value to retrieve.
- Raises:
RegistryValueNotFoundError – If this key has no value with the requested name.
- values() list[SmbRegistryValue] #
Returns a list of all the values from this key.
- class dissect.target.loaders.smb.SmbRegistryValue(hive: str, name: str, data: bytes, type: int)#
Bases:
dissect.target.helpers.regutil.RegistryValue
Base class for registry values.
- Parameters:
hive – The registry hive to which this registry value belongs.
- property name: str#
Returns the name of this value.
- property value: str#
Returns the value of this value.
- property type: str#
Returns the type of this value.