mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update Regripper samparse plugin

Browse Source 
Update regripper samparse plugin to get security questions/answers
This commit is contained in:
Mark McKinnon 2022-09-14 10:27:44 -04:00
parent ffd5dca3cd
commit c57d13a2d1
3 changed files with 3207 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3147
thirdparty/rr-full/JSON/PP.pm vendored Normal file
View File

File diff suppressed because it is too large Load Diff

42
thirdparty/rr-full/JSON/PP/Boolean.pm vendored Normal file
View File

@ -0,0 +1,42 @@
package JSON::PP::Boolean;
use strict;
require overload;
local $^W;
overload::import('overload',
"0+" => sub { ${$_[0]} },
"++" => sub { $_[0] = ${$_[0]} + 1 },
"--" => sub { $_[0] = ${$_[0]} - 1 },
fallback => 1,
);
$JSON::PP::Boolean::VERSION = '4.05';
1;
__END__
=head1 NAME
JSON::PP::Boolean - dummy module providing JSON::PP::Boolean
=head1 SYNOPSIS
# do not "use" yourself
=head1 DESCRIPTION
This module exists only to provide overload resolution for Storable and similar modules. See
L<JSON::PP> for more info about this class.
=head1 AUTHOR
This idea is from L<JSON::XS::Boolean> written by Marc Lehmann <schmorp[at]schmorp.de>
=head1 LICENSE
This library is free software; you can redistribute it and/or modify
it under the same terms as Perl itself.
=cut

18
thirdparty/rr-full/plugins/samparse.pl vendored
View File

@ -24,6 +24,7 @@
package samparse;
use strict;
use Encode::Unicode;
use JSON::PP;
my %config = (hive => "SAM",
hivemask => 2,
@ -131,6 +132,23 @@ sub pluginmain {
my $f = $f_value->get_data();
my %f_val = parseF($f);
eval {
my $reset_data_value = $u->get_value("ResetData");
my $reset_data = $reset_data_value->get_data();
my $reset_data_hash = decode_json($reset_data);
my $reset_data_question_1 = $reset_data_hash->{'questions'}[0];
my $reset_data_question_2 = $reset_data_hash->{'questions'}[1];
my $reset_data_question_3 = $reset_data_hash->{'questions'}[2];
my $question_1 = $reset_data_question_1->{'question'};
::rptMsg("Security Questions:");
::rptMsg(" Question 1 : ".$question_1);
::rptMsg(" Answer 1 : ".$reset_data_question_1->{'answer'});
::rptMsg(" Question 2 : ".$reset_data_question_2->{'question'});
::rptMsg(" Answer 2 : ".$reset_data_question_2->{'answer'});
::rptMsg(" Question 3 : ".$reset_data_question_3->{'question'});
::rptMsg(" Answer 3 : ".$reset_data_question_3->{'answer'});
};
my $lastlogin;
my $pwdreset;
my $pwdfail;