diff --git a/dissect/target/plugins/os/windows/network.py b/dissect/target/plugins/os/windows/network.py index d7c39ede8..8e268c017 100644 --- a/dissect/target/plugins/os/windows/network.py +++ b/dissect/target/plugins/os/windows/network.py @@ -1,5 +1,6 @@ from __future__ import annotations +import re from enum import IntEnum from functools import lru_cache from typing import Iterator @@ -224,11 +225,13 @@ def _try_value(subkey: RegistryKey, value: str) -> str | list | None: return None -def _get_config_value(key: RegistryKey, name: str) -> set: +def _get_config_value(key: RegistryKey, name: str, sep: str | None = None) -> set: value = _try_value(key, name) if not value or value in ("", "0.0.0.0", None, [], ["0.0.0.0"]): return set() - + if sep and isinstance(value, str): + re_sep = "|".join(map(re.escape, sep)) + value = re.split(re_sep, value) if isinstance(value, list): return set(value) @@ -355,11 +358,11 @@ def _extract_network_device_config(self, interface_id: str) -> list[dict[str, se dhcp_config["ip"].update(_get_config_value(key, "DhcpIPAddress")) dhcp_config["subnetmask"].update(_get_config_value(key, "DhcpSubnetMask")) dhcp_config["search_domain"].update(_get_config_value(key, "DhcpDomain")) - dhcp_config["dns"].update(_get_config_value(key, "DhcpNameServer")) + dhcp_config["dns"].update(_get_config_value(key, "DhcpNameServer", " ,")) # Extract static configuration from the registry static_config["gateway"].update(_get_config_value(key, "DefaultGateway")) - static_config["dns"].update(_get_config_value(key, "NameServer")) + static_config["dns"].update(_get_config_value(key, "NameServer", " ,")) static_config["search_domain"].update(_get_config_value(key, "Domain")) static_config["ip"].update(_get_config_value(key, "IPAddress")) static_config["subnetmask"].update(_get_config_value(key, "SubnetMask")) diff --git a/tests/plugins/os/windows/test_network.py b/tests/plugins/os/windows/test_network.py index a9237fcdf..5a7898dec 100644 --- a/tests/plugins/os/windows/test_network.py +++ b/tests/plugins/os/windows/test_network.py @@ -257,7 +257,7 @@ def test_windows_network_none( "DhcpIPAddress": "192.168.0.10", "IPAddress": "10.0.0.10", "DhcpNameServer": "192.168.0.2", - "NameServer": "10.0.0.2", + "NameServer": "10.0.0.2 10.0.0.3", "SubnetMask": "255.255.255.0", "DhcpSubnetMask": "255.255.255.0", "VlanID": 10, @@ -285,7 +285,7 @@ def test_windows_network_none( }, { "ip": ["10.0.0.10"], - "dns": ["10.0.0.2"], + "dns": ["10.0.0.2", "10.0.0.3"], "gateway": ["10.0.0.1"], "mac": ["FE:EE:EE:EE:EE:ED"], "subnetmask": ["255.255.255.0"], @@ -346,8 +346,8 @@ def test_network_dhcp_and_static( gateways.update(interface.gateway) macs.update(interface.mac) - assert interface.ip == expected["ip"] - assert interface.dns == expected["dns"] + assert sorted(map(str, interface.ip)) == expected["ip"] + assert sorted(map(str, interface.dns)) == expected["dns"] assert interface.gateway == expected["gateway"] assert interface.mac == expected["mac"] assert interface.network == expected["network"]