walkfs

$ target-query <path/to/target> -f walkfs

Details

Module	dissect.target.plugins.filesystem.walkfs.WalkFsPlugin
Output	records

Module documentation

Filesystem agnostic walkfs plugin.

Function documentation

Walk a target’s filesystem and return all filesystem entries.

References:

• https://man7.org/linux/man-pages/man2/lstat.2.html

• https://man7.org/linux/man-pages/man7/inode.7.html

• https://man7.org/linux/man-pages/man7/xattr.7.html

• https://man7.org/linux/man-pages/man2/execve.2.html

• https://steflan-security.com/linux-privilege-escalation-suid-binaries

• https://github.com/torvalds/linux/blob/master/include/uapi/linux/capability.h

Yields FilesystemRecords for every filesystem entry and CapabilityRecords if xattr security attributes were found in the filesystem entry and the --capability flag is set.

hostname (string): The target hostname.
domain (string): The target domain.
mtime (datetime): modified timestamp indicates the last time the contents of a file were modified.
atime (datetime): access timestamp indicates the last time a file was accessed.
ctime (datetime): changed timestamp indicates the last time metadata of a file was modified.
btime (datetime): birth timestamp indicates the time when a file was created.
ino (varint): number of the corresponding underlying filesystem inode.
path (path): path location of the entry.
size (filesize): size of the file in bytes on the filesystem.
mode (uint32): contains the file type and mode.
uid (uint32): the user id of the owner of the entry.
gid (uint32): the group id of the owner of the entry.
is_suid (boolean): denotes if the entry has the set-user-id bit set.
attr (string[]): list of key-value pair attributes separated by '='.
fs_types (string[]): list of filesystem type(s) of the entry.