From 474e8e69166b4edc1e230dd4f6504a541a52d546 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 12 Mar 2025 12:31:26 -0500 Subject: [PATCH] #1471 - add deprecated plugins in old location --- .../framework/plugins/windows/amcache.py | 23 ++++++++++++++++++ .../framework/plugins/windows/cachedump.py | 23 ++++++++++++++++++ .../framework/plugins/windows/hashdump.py | 23 ++++++++++++++++++ .../framework/plugins/windows/lsadump.py | 23 ++++++++++++++++++ .../plugins/windows/scheduled_tasks.py | 24 +++++++++++++++++++ 5 files changed, 116 insertions(+) create mode 100644 volatility3/framework/plugins/windows/amcache.py create mode 100644 volatility3/framework/plugins/windows/cachedump.py create mode 100644 volatility3/framework/plugins/windows/hashdump.py create mode 100644 volatility3/framework/plugins/windows/lsadump.py create mode 100644 volatility3/framework/plugins/windows/scheduled_tasks.py diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py new file mode 100644 index 000000000..65ef041db --- /dev/null +++ b/volatility3/framework/plugins/windows/amcache.py @@ -0,0 +1,23 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import amcache + +vollog = logging.getLogger(__name__) + + +class Amcache(amcache.Amcache): + """Extract information on executed applications from the AmCache (deprecated).""" + + _required_framework_version = (2, 0, 0) + _version = (2, 0, 0) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.amcache.Amcache" + ) + ) + return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py new file mode 100644 index 000000000..73ab7c87b --- /dev/null +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -0,0 +1,23 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import cachedump + +vollog = logging.getLogger(__name__) + + +class Cachedump(cachedump.Cachedump): + """Dumps lsa secrets from memory (deprecated)""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 2) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.cachedump.Cachedump" + ) + ) + return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py new file mode 100644 index 000000000..c875dda50 --- /dev/null +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -0,0 +1,23 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import hashdump + +vollog = logging.getLogger(__name__) + + +class Hashdump(hashdump.Hashdump): + """Dumps user hashes from memory (deprecated)""" + + _required_framework_version = (2, 0, 0) + _version = (1, 1, 1) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.hashdump.Hashdump" + ) + ) + return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py new file mode 100644 index 000000000..65e58cc25 --- /dev/null +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -0,0 +1,23 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import lsadump + +vollog = logging.getLogger(__name__) + + +class Lsadump(lsadump.Lsadump): + """Dumps lsa secrets from memory (deprecated)""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 1) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.lsadump.Lsadump" + ) + ) + return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py new file mode 100644 index 000000000..4b32f6be7 --- /dev/null +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -0,0 +1,24 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import scheduled_tasks + +vollog = logging.getLogger(__name__) + + +class ScheduledTasks(scheduled_tasks.ScheduledTasks): + """Decodes scheduled task information from the Windows registry, including \ +information about triggers, actions, run times, and creation times (deprecated).""" + + _required_framework_version = (2, 11, 0) + _version = (2, 0, 0) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.scheduled_tasks.ScheduledTasks" + ) + ) + return super().__getattr__(*args, **kwargs)