Releases · fox-it/dissect

26 Sep 15:19

pyrco

3.9

5411f06

Release dissect 3.9 (#38)

Highlights

Misc changes:

dissect.cstruct has a new and vastly improved expression parser
Support for various RAID formats and LVM variants
Volatile directories are now mounted when running on a local target
Add support for decrypting and using System DPAPI secrets on Windows

New loaders:

Add a new SMB loader and filesystem to use an SMB share as target

New plugins:

cPanel lastlogin files
Symantic Secure Endpoint
Windows 10 notifications from appdb.dat file
multiple plugins for volatile Linux artifacts (sockets, processes)
Linux modules and lsmod plugin

Updated plugins

IPv6 adresses in UTMP logs are now interpreted correctly
ufw firewall configuration support added to the Linux firewall plugin

Acquire changes:

Add collection of OSX DHCP settings and application's Info.plist paths
Improved collection of Linux volatile paths (/proc & /sys)
Add collection of paths related to Windows memoy
IIS artefacts are now collected by default in the "full" profile

Contributors

Thanks to our contributors for making this release possible:

@0x49736b
@cobyge
@idem-s1n
@JSCU-CNI
@OlafHaalstra
@Paradoxis
@RGlintmeijer
@sMezaOrellana
@Zawadidone

Full Changelogs

Contributors

OlafHaalstra, Paradoxis, and 7 other contributors

Assets 2

14 Aug 14:58

Miauwkeru

3.8.1

6320ef1

Release dissect 3.8.1

Highlights

Fixed issue in registry plugin where the root key could not be fetched, which impacted the regf plugin and target-regf.
Add a OSPlugin for citrix netscalers

Full Changelogs

Assets 2

10 Aug 12:52

Miauwkeru

3.8

c8483bc

Release dissect 3.8

Highlights

New plugins:

Generic:
- OpenVPN configuration plugin for client and server configuration
OSX:
- User plugin, which shows all the users on osx machines
- IPs plugin, allows the ips to work on osx targets

Updated plugins:

ETL: Now decompresses compressed buffers
Unix services: Improved the systemd service parsing

Loader:

DirLoader: functions with directories made using acquire
MultiRawLoader: Allows you to load multiple disks into one target.
This has to be a + separated string containing absolute or relative path to the disks. (/path/to/disk1+/path/to/disk2)

Misc changes/fixes:

Target-shell
- Use enter <path> to open a target inside of another target.
- No duplicate files when saving a directory using the save command.
Registry improvements: Allows for globbing through the windows registry

Contributors

Thanks to our contributors for making this release possible:

@cobyge
@nrhtr
@JSCU-CNI
@sMezaOrellana
@sulonl
@Zawadidone

Full Changelogs

Contributors

nrhtr, cobyge, and 4 other contributors

Assets 2

06 Jul 09:29

pyrco

3.7

b165378

Release dissect 3.7 (#33)

Highlights

Windows plugin additions and improvements:
- at.exe jobs are now emitted by the tasks plugin.
- Tasks from AD Group Policy Objects are now emitted by the tasks plugin.
  - Tasks within a ScheduledTask.xml file are not parsed when nested in a <ScheduledTask> element. This will be supported in the next release.
- A new AppX debug information plugin appxdebugkeys is added.
- The Windows defender plugin can now also emit exclusions.
- amcache now returns the proper arp created install records.
- A new shophos plugin supporting Sophos Home and Sophos Hitman has been added.
Linux plugin additions and improvements:
- A new systemd journal plugin is added.
Loader additions and improvements:
- The LogLoader can now handle IIS logs.
Misc improvements:
- Cleaner handling of KeyboardInterrups and OSErrors in the various target tools.
- Compatibility for TargetPath and FilesystemEntry with Python 3.11.4.
- The LZO decompressor now handles bitstream compressed data properly.
- target-info now handles time zones properly for older Windows versions.

Contributors

Thanks to our contributors for making this release possible:

@cobyge
@JSCU-CNI
@Zawadidone

Full Changelogs

Contributors

cobyge, Zawadidone, and JSCU-CNI

Assets 2

25 May 09:21

pyrco

3.6

dd094b5

Release dissect 3.6 (#30)

Highlights

New filesystems:
- Parallels disk images
New plugins:
- Chromium based browser extensions
Updated/improved plugins:
- Unix auth: fix log parsing bug
- Unix services
- Unix network_managers: better IP parsing from logs
- Windows adpolicy: output info about Windows GPOs (Group Policy Objects)
- powershell: now also works on Linux
- firefox: look for files in more locations
Updated/improved loaders:
- ASDF
Filesystem fixes/improvements for:
- xfs
- ntfs
- extfs

Contributors

Thanks to our contributors for making this release possible:

@JSCU-CNI
@Zawadidone

Full Changelogs

Contributors

Zawadidone and JSCU-CNI

Assets 2

24 Mar 15:03

pyrco

3.5

8dbb141

3.5

Highlights

New plugins for parsing:
- Trend Micro Worry-Free AV and firewall logs
- McAfee AV and firewall logs (SQLite)
- Apt, yum and zypper package manager files
- NGINX, Apache and Caddy webserver logs
- Open handles acquired from Windows systems
Updated/improved plugins for:
- Extended zsh history files
- IP adresses on Unix systems
- the Unix audit.log plugin
- the SSH plugin now also exports public keys and outputs more information on private keys
Updated/improved loaders:
- Support for older type Hyper-V hypervisor configuration files
- Support UsnJrnl and Volume Shadow Copy's in the Velociraptor loader
- iTunes backup files
Add zcat & zless commands to target-shell, these commands will transparently decompress gzip and bzip2 compressed files.
target-shell properly displays alternate datastreams again.
A new tool target-info was added, which quickly displays some useful information about the target specified
Support for NTFS reparse points
Acquire was extended to also acquire:
- Windows PCA files
- Linux /proc and /sys filesystems
- McAfee SQLite AV and firewall logs

Contributors

Thanks to our contributors for making this release possible:

@JSCU-CNI
@MrYoranimo
@Zawadidone

Full Changelogs

Contributors

MrYoranimo, Zawadidone, and JSCU-CNI

Assets 3

10 Feb 13:04

pyrco

3.4

446a2df

3.4

Contributors

Thanks to our contributors for making this release possible:

@JSCU-CNI
@MrYoranimo
@skarnproject
@Zawadidone

Full Changelogs

Contributors

MrYoranimo, skarndev, and 2 other contributors

Assets 2

18 Jan 08:53

pyrco

3.3

7ea0635

3.3

Contributors

Thanks to our contributors for making this release possible:
@Ad-Blokker
@cobyge
@goosvorbook
@lesander
@Zawadidone

Full Changelogs

Contributors

lesander, Ad-Blokker, and 3 other contributors

Assets 2

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Highlights

Misc changes:

New loaders:

New plugins:

Updated plugins

Acquire changes:

Contributors

Full Changelogs

Contributors

Highlights

Full Changelogs

Highlights

New plugins:

Updated plugins:

Loader:

Misc changes/fixes:

Contributors

Full Changelogs

Contributors

Highlights

Contributors

Full Changelogs

Contributors

Highlights

Contributors

Full Changelogs

Contributors

Highlights

Contributors

Full Changelogs

Contributors

Contributors

Full Changelogs

Contributors

Contributors

Full Changelogs

Contributors

Releases: fox-it/dissect

Release dissect 3.9 (#38)

Highlights

Misc changes:

New loaders:

New plugins:

Updated plugins

Acquire changes:

Contributors

Full Changelogs

Contributors

Release dissect 3.8.1

Highlights

Full Changelogs

Release dissect 3.8

Highlights

New plugins:

Updated plugins:

Loader:

Misc changes/fixes:

Contributors

Full Changelogs

Contributors

Release dissect 3.7 (#33)

Highlights

Contributors

Full Changelogs

Contributors

Release dissect 3.6 (#30)

Highlights

Contributors

Full Changelogs

Contributors

3.5

Highlights

Contributors

Full Changelogs

Contributors

3.4

Contributors

Full Changelogs

Contributors

3.3

Contributors

Full Changelogs

Contributors