408 lines
13 KiB
Python
408 lines
13 KiB
Python
# tests/forensics/test_metadata.py
|
|
# {{{ imports
|
|
import os
|
|
import sys
|
|
import stat
|
|
from pathlib import Path
|
|
import pytest
|
|
from ctf.forensics import get_metadata
|
|
from ctf.utils import active_categories
|
|
# }}}
|
|
|
|
# Define the persistent test environment path
|
|
TEST_ENV = Path("tests/env")
|
|
|
|
# {{{ test_active_categories_static
|
|
def test_active_categories_static():
|
|
"""Verifies active_categories using the pre-created 'comp1' folder."""
|
|
comp_dir = TEST_ENV / "comp1"
|
|
comp_dir.mkdir(parents=True, exist_ok=True)
|
|
(comp_dir / "web").mkdir(exist_ok=True)
|
|
(comp_dir / "pwn").mkdir(exist_ok=True)
|
|
|
|
cats = active_categories(comp_dir)
|
|
cat_names = [c.name for c in cats]
|
|
|
|
assert "web" in cat_names
|
|
assert "pwn" in cat_names
|
|
# }}}
|
|
|
|
# {{{ test_inspect_permissions
|
|
def test_inspect_permissions():
|
|
"""
|
|
Task 1: POSIX Permissions.
|
|
Verifies that the parsed octal and symbolic representation of permissions
|
|
matches Python's native os.stat mode decoding.
|
|
"""
|
|
test_file = TEST_ENV / "perm_test.bin"
|
|
with open(test_file, "wb") as f:
|
|
f.write(b"data")
|
|
|
|
# Set permissions explicitly to 0o755 (rwxr-xr-x)
|
|
test_file.chmod(0o755)
|
|
|
|
meta = get_metadata(test_file)
|
|
|
|
# Assert correct octal format
|
|
assert meta.permissions_octal == "0o755"
|
|
# Assert correct symbolic format (standard file type prefix '-')
|
|
assert meta.permissions_symbolic == "-rwxr-xr-x"
|
|
|
|
# Change permissions to 0o644 (rw-r--r--)
|
|
test_file.chmod(0o644)
|
|
meta_new = get_metadata(test_file)
|
|
assert meta_new.permissions_octal == "0o644"
|
|
assert meta_new.permissions_symbolic == "-rw-r--r--"
|
|
# }}}
|
|
|
|
# {{{ test_inspect_ownership
|
|
def test_inspect_ownership():
|
|
"""
|
|
Task 2: Ownership Identity.
|
|
Verifies that numeric UID/GID and resolved username/groupname match.
|
|
"""
|
|
test_file = TEST_ENV / "owner_test.bin"
|
|
with open(test_file, "wb") as f:
|
|
f.write(b"data")
|
|
|
|
stat_info = test_file.stat()
|
|
meta = get_metadata(test_file)
|
|
|
|
assert meta.owner_uid == stat_info.st_uid
|
|
assert meta.owner_gid == stat_info.st_gid
|
|
|
|
# On Unix, verify that user and group strings are resolved
|
|
if sys.platform != "win32":
|
|
import pwd
|
|
import grp
|
|
expected_user = pwd.getpwuid(stat_info.st_uid).pw_name
|
|
expected_group = grp.getgrgid(stat_info.st_gid).gr_name
|
|
assert meta.owner_username == expected_user
|
|
assert meta.owner_groupname == expected_group
|
|
else:
|
|
# Fallback for Windows
|
|
assert isinstance(meta.owner_username, str)
|
|
assert isinstance(meta.owner_groupname, str)
|
|
# }}}
|
|
|
|
# {{{ test_inspect_allocation
|
|
def test_inspect_allocation():
|
|
"""
|
|
Task 3: Allocation Metrics.
|
|
Verifies apparent file size matches size_bytes, and allocated_size
|
|
corresponds to st_blocks * 512 bytes.
|
|
"""
|
|
test_file = TEST_ENV / "alloc_test.bin"
|
|
with open(test_file, "wb") as f:
|
|
f.write(b"A" * 1234)
|
|
|
|
stat_info = test_file.stat()
|
|
meta = get_metadata(test_file)
|
|
|
|
assert meta.size == 1234
|
|
|
|
# st_blocks is Unix-specific. On other platforms, fallback to size on disk
|
|
if hasattr(stat_info, "st_blocks"):
|
|
expected_blocks_size = stat_info.st_blocks * 512
|
|
assert meta.allocated_size == expected_blocks_size
|
|
else:
|
|
assert meta.allocated_size >= 1234
|
|
# }}}
|
|
|
|
# {{{ test_inspect_hard_links
|
|
def test_inspect_hard_links():
|
|
"""
|
|
Task 4: Hard Link Count.
|
|
Verifies that the hard link count changes when files are linked.
|
|
"""
|
|
test_file = TEST_ENV / "link_test.bin"
|
|
with open(test_file, "wb") as f:
|
|
f.write(b"link")
|
|
|
|
meta_single = get_metadata(test_file)
|
|
assert meta_single.hard_links == 1
|
|
|
|
# Create a hard link
|
|
link_file = TEST_ENV / "link_test_hard.bin"
|
|
if link_file.exists():
|
|
link_file.unlink()
|
|
|
|
try:
|
|
os.link(str(test_file), str(link_file))
|
|
meta_linked = get_metadata(test_file)
|
|
assert meta_linked.hard_links == 2
|
|
finally:
|
|
if link_file.exists():
|
|
link_file.unlink()
|
|
# }}}
|
|
|
|
# {{{ test_inspect_inode_device
|
|
def test_inspect_inode_device():
|
|
"""
|
|
Task 5: Inode & Device Identifiers.
|
|
Verifies that the unique Inode number and Device ID match os.stat results.
|
|
"""
|
|
test_file = TEST_ENV / "inode_test.bin"
|
|
with open(test_file, "wb") as f:
|
|
f.write(b"data")
|
|
|
|
stat_info = test_file.stat()
|
|
meta = get_metadata(test_file)
|
|
|
|
assert meta.inode == stat_info.st_ino
|
|
assert meta.device == stat_info.st_dev
|
|
# }}}
|
|
|
|
# {{{ test_inspect_extended_attributes
|
|
def test_inspect_extended_attributes():
|
|
"""
|
|
Task 6: Extended Attributes (xattr).
|
|
Checks that user-defined extended attributes can be retrieved if supported
|
|
by the platform and filesystem.
|
|
"""
|
|
test_file = TEST_ENV / "xattr_test.bin"
|
|
with open(test_file, "wb") as f:
|
|
f.write(b"data")
|
|
|
|
has_xattr_support = False
|
|
if sys.platform in ("linux", "darwin"):
|
|
try:
|
|
os.setxattr(str(test_file), "user.ctf_flag", b"FLAG{filesystem_metadata_ftw}")
|
|
has_xattr_support = True
|
|
except (OSError, AttributeError):
|
|
pass
|
|
|
|
meta = get_metadata(test_file)
|
|
|
|
if has_xattr_support:
|
|
assert "user.ctf_flag" in meta.extended_attributes
|
|
assert meta.extended_attributes["user.ctf_flag"] == "FLAG{filesystem_metadata_ftw}"
|
|
else:
|
|
assert isinstance(meta.extended_attributes, dict)
|
|
# }}}
|
|
|
|
# {{{ test_pure_exif_parsing
|
|
def test_pure_exif_parsing():
|
|
"""
|
|
Verifies that get_metadata successfully parses EXIF fields from a mock PNG.
|
|
"""
|
|
import struct
|
|
tiff_data = (
|
|
b"II\x2a\x00\x08\x00\x00\x00"
|
|
b"\x02\x00"
|
|
b"\x0f\x01\x02\x00\x05\x00\x00\x00\x26\x00\x00\x00"
|
|
b"\x10\x01\x02\x00\x06\x00\x00\x00\x2b\x00\x00\x00"
|
|
b"\x00\x00\x00\x00"
|
|
b"TEST\x00"
|
|
b"MODEL\x00"
|
|
)
|
|
png_header = b"\x89PNG\r\n\x1a\n"
|
|
exif_chunk_type = b"eXIf"
|
|
exif_chunk_len = struct.pack(">I", len(tiff_data))
|
|
exif_chunk_crc = b"\x00\x00\x00\x00"
|
|
|
|
mock_png = png_header + exif_chunk_len + exif_chunk_type + tiff_data + exif_chunk_crc
|
|
|
|
test_file = TEST_ENV / "mock_exif_image.png"
|
|
with open(test_file, "wb") as f:
|
|
f.write(mock_png)
|
|
|
|
meta = get_metadata(test_file)
|
|
assert meta.exif_data.get("Make") == "TEST"
|
|
assert meta.exif_data.get("Model") == "MODEL"
|
|
# }}}
|
|
|
|
# {{{ test_jpeg_comment_extraction
|
|
def test_jpeg_comment_extraction():
|
|
"""
|
|
Verifies that get_metadata successfully parses a JPEG comment (COM marker).
|
|
"""
|
|
import struct
|
|
comment_text = b"picoCTF{test_comment_flag}"
|
|
comment_len = len(comment_text) + 2
|
|
mock_jpeg = (
|
|
b"\xff\xd8"
|
|
b"\xff\xfe"
|
|
+ struct.pack(">H", comment_len)
|
|
+ comment_text
|
|
+ b"\xff\xd9"
|
|
)
|
|
|
|
test_file = TEST_ENV / "mock_comment.jpg"
|
|
with open(test_file, "wb") as f:
|
|
f.write(mock_jpeg)
|
|
|
|
meta = get_metadata(test_file)
|
|
assert meta.comment == "picoCTF{test_comment_flag}"
|
|
# }}}
|
|
|
|
# {{{ test_adobe_xmp_extraction
|
|
def test_adobe_xmp_extraction():
|
|
"""
|
|
Verifies that get_metadata successfully parses XMP fields (like license resource).
|
|
"""
|
|
import struct
|
|
xmp_xml = (
|
|
b"<x:xmpmeta xmlns:x='adobe:ns:meta/'>\n"
|
|
b"<rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>\n"
|
|
b" <rdf:Description rdf:about='' xmlns:cc='http://creativecommons.org/ns#'>\n"
|
|
b" <cc:license rdf:resource='cGljb0NURnt0ZXN0X3htcF9mbGFnfQ=='/>\n"
|
|
b" </rdf:Description>\n"
|
|
b"</rdf:RDF>\n"
|
|
b"</x:xmpmeta>"
|
|
)
|
|
xmp_prefix = b"http://ns.adobe.com/xap/1.0/\x00"
|
|
app1_payload = xmp_prefix + xmp_xml
|
|
app1_len = len(app1_payload) + 2
|
|
mock_jpeg = (
|
|
b"\xff\xd8"
|
|
b"\xff\xe1"
|
|
+ struct.pack(">H", app1_len)
|
|
+ app1_payload
|
|
+ b"\xff\xd9"
|
|
)
|
|
|
|
test_file = TEST_ENV / "mock_xmp.jpg"
|
|
with open(test_file, "wb") as f:
|
|
f.write(mock_jpeg)
|
|
|
|
meta = get_metadata(test_file)
|
|
assert meta.exif_data.get("cc:license") == "cGljb0NURnt0ZXN0X3htcF9mbGFnfQ=="
|
|
# }}}
|
|
|
|
# {{{ test_jpeg_physical_parsing
|
|
def test_jpeg_physical_parsing():
|
|
"""
|
|
Verifies that get_metadata successfully parses JPEG physical parameters (JFIF & SOF).
|
|
"""
|
|
import struct
|
|
app0_payload = b"JFIF\x00\x01\x02\x01\x00\x48\x00\x48\x00\x00"
|
|
app0_block = b"\xff\xe0" + struct.pack(">H", len(app0_payload) + 2) + app0_payload
|
|
|
|
sof_payload = b"\x08\x03\xe8\x05\xdc\x03\x01\x11\x00\x02\x11\x01\x03\x11\x01"
|
|
sof_block = b"\xff\xc0" + struct.pack(">H", len(sof_payload) + 2) + sof_payload
|
|
|
|
mock_jpeg = b"\xff\xd8" + app0_block + sof_block + b"\xff\xd9"
|
|
|
|
test_file = TEST_ENV / "mock_physical.jpg"
|
|
with open(test_file, "wb") as f:
|
|
f.write(mock_jpeg)
|
|
|
|
meta = get_metadata(test_file)
|
|
assert meta.physical_data.get("JFIF Version") == "1.02"
|
|
assert meta.physical_data.get("Image Size") == "1500x1000"
|
|
assert meta.physical_data.get("Megapixels") == "1.5"
|
|
assert meta.physical_data.get("Encoding Process") == "Baseline DCT, Huffman coding"
|
|
# }}}
|
|
|
|
# {{{ test_jpeg_iptc_parsing
|
|
def test_jpeg_iptc_parsing():
|
|
"""
|
|
Verifies that get_metadata successfully parses JPEG IPTC metadata from APP13.
|
|
"""
|
|
import struct
|
|
iptc_ds = b"\x1c\x02\x74\x00\x0ePicoCTF Rights"
|
|
|
|
irb_id = b"\x04\x04"
|
|
irb_name = b"\x00\x00"
|
|
irb_size = struct.pack(">I", len(iptc_ds))
|
|
irb_block = b"8BIM" + irb_id + irb_name + irb_size + iptc_ds
|
|
|
|
app13_payload = b"Photoshop 3.0\x00" + irb_block
|
|
app13_block = b"\xff\xed" + struct.pack(">H", len(app13_payload) + 2) + app13_payload
|
|
|
|
mock_jpeg = b"\xff\xd8" + app13_block + b"\xff\xd9"
|
|
|
|
test_file = TEST_ENV / "mock_iptc.jpg"
|
|
with open(test_file, "wb") as f:
|
|
f.write(mock_jpeg)
|
|
|
|
meta = get_metadata(test_file)
|
|
assert meta.exif_data.get("CopyrightNotice") == "PicoCTF Rights"
|
|
# }}}
|
|
|
|
# {{{ test_png_text_chunks_decompression
|
|
def test_png_text_chunks_decompression():
|
|
"""
|
|
Verifies that get_metadata successfully parses tEXt and compressed zTXt chunks.
|
|
"""
|
|
import zlib
|
|
import struct
|
|
|
|
text_data = b"Copyright\x00PicoCTF"
|
|
text_chunk = struct.pack(">I", len(text_data)) + b"tEXt" + text_data + b"\x00\x00\x00\x00"
|
|
|
|
deflated = zlib.compress(b"John Doe")
|
|
ztxt_data = b"Author\x00\x00" + deflated
|
|
ztxt_chunk = struct.pack(">I", len(ztxt_data)) + b"zTXt" + ztxt_data + b"\x00\x00\x00\x00"
|
|
|
|
png_data = b"\x89PNG\r\n\x1a\n" + text_chunk + ztxt_chunk + b"\x00\x00\x00\x00IEND\xaeB`\x82"
|
|
|
|
test_file = TEST_ENV / "mock_text_chunks.png"
|
|
with open(test_file, "wb") as f:
|
|
f.write(png_data)
|
|
|
|
meta = get_metadata(test_file)
|
|
assert meta.exif_data.get("Copyright") == "PicoCTF"
|
|
assert meta.exif_data.get("Author") == "John Doe"
|
|
# }}}
|
|
|
|
# {{{ test_gif_comment_parsing
|
|
def test_gif_comment_parsing():
|
|
"""
|
|
Verifies that get_metadata successfully parses GIF comment blocks.
|
|
"""
|
|
gif_data = (
|
|
b"GIF89a"
|
|
b"\x01\x00\x01\x00\x00\x00\x00"
|
|
b"\x21\xfe\x0aGIFComment\x00"
|
|
b"\x3b"
|
|
)
|
|
test_file = TEST_ENV / "mock_comment.gif"
|
|
with open(test_file, "wb") as f:
|
|
f.write(gif_data)
|
|
|
|
meta = get_metadata(test_file)
|
|
assert meta.comment == "GIFComment"
|
|
# }}}
|
|
|
|
# {{{ test_adobe_xmp_formatting
|
|
def test_adobe_xmp_formatting():
|
|
"""
|
|
Verifies that get_metadata parses rdf:Description attributes and formats other
|
|
attributes with ' | ' instead of '='.
|
|
"""
|
|
import struct
|
|
xmp_xml = (
|
|
b"<x:xmpmeta xmlns:x='adobe:ns:meta/'>\n"
|
|
b"<rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>\n"
|
|
b" <rdf:Description rdf:about='' xmlns:xmp='http://ns.adobe.com/xap/1.0/' xmlns:exif='http://ns.adobe.com/exif/1.0/'>\n"
|
|
b" <xmp:CreatorTool>Photoshop</xmp:CreatorTool>\n"
|
|
b" <exif:Flash exif:Fired='True' exif:Mode='1'/>\n"
|
|
b" <exif:EmptyAttr exif:Value=''/>\n"
|
|
b" </rdf:Description>\n"
|
|
b"</rdf:RDF>\n"
|
|
b"</x:xmpmeta>"
|
|
)
|
|
xmp_prefix = b"http://ns.adobe.com/xap/1.0/\x00"
|
|
app1_payload = xmp_prefix + xmp_xml
|
|
app1_len = len(app1_payload) + 2
|
|
mock_jpeg = (
|
|
b"\xff\xd8"
|
|
b"\xff\xe1"
|
|
+ struct.pack(">H", app1_len)
|
|
+ app1_payload
|
|
+ b"\xff\xd9"
|
|
)
|
|
|
|
test_file = TEST_ENV / "mock_xmp_formatting.jpg"
|
|
with open(test_file, "wb") as f:
|
|
f.write(mock_jpeg)
|
|
|
|
meta = get_metadata(test_file)
|
|
assert meta.exif_data.get("xmp:CreatorTool") == "Photoshop"
|
|
assert meta.exif_data.get("exif:Flash") == "exif:Fired | True, exif:Mode | 1"
|
|
assert meta.exif_data.get("exif:EmptyAttr") == "exif:Value"
|
|
assert "rdf:Description" not in meta.exif_data
|
|
# }}}
|