ntdsextract2

本工具旨在替代由 @csababarta 提供的 https://github.com/csababarta/ntdsxtract/。

为什么你要写一个已经存在并且正在工作的工具呢？

1. ntdsxtract 使用 Python 2.7，这使得它在现代系统上难以使用
2. 很久没有更新了（最后的提交是 2016 年 2 月），这表明 Csaba 目前有其他事情要做。没关系。但 Windows 确实 在变化，因此分析 Windows 系统的工具必须适应。由于我不喜欢 Csaba 做出的某些架构决策，我开始了自己的开发。

安装

cargo install ntdsextract2

使用方法

USAGE:
    ntdsextract2 [OPTIONS] <NTDS_FILE> <SUBCOMMAND>

ARGS:
    <NTDS_FILE>    name of the file to analyze

OPTIONS:
    -h, --help       Print help information
    -q, --quiet      Less output per occurrence
    -v, --verbose    More output per occurrence
    -V, --version    Print version information

SUBCOMMANDS:
    computer    display computer accounts
    entry       display one single entry from the directory information tree
    group       Display groups
    help        Print this message or the help of the given subcommand(s)
    search      search for entries whose values match to some regular expression
    timeline    create a timeline (in bodyfile format)
    tree        display the directory information tree
    types       list all defined types
    user        Display user accounts

搜索条目

USAGE:
    ntdsextract2 <NTDS_FILE> search [OPTIONS] <REGEX>

ARGS:
    <REGEX>    regular expression to match against

OPTIONS:
    -h, --help           Print help information
    -i, --ignore-case    case-insensitive search (ignore case)
    -q, --quiet          Less output per occurrence
    -v, --verbose        More output per occurrence

显示单个条目

USAGE:
    ntdsextract2 <NTDS_FILE> entry [OPTIONS] <ENTRY_ID>

ARGS:
    <ENTRY_ID>    id of the entry to show

OPTIONS:
    -h, --help       Print help information
    -q, --quiet      Less output per occurrence
        --sid        search for SID instead for NTDS.DIT entry id. <ENTRY_ID> will be interpreted as
                     RID, wich is the last part of the SID; e.g. 500 will return the Administrator
                     account
    -v, --verbose    More output per occurrence

显示 AD 的树状结构

USAGE:
    ntdsextract2 <NTDS_FILE> tree [OPTIONS]

OPTIONS:
    -h, --help                     Print help information
        --max-depth <MAX_DEPTH>    maximum recursion depth [default: 4]
    -q, --quiet                    Less output per occurrence
    -v, --verbose                  More output per occurrence

创建时间线

USAGE:
    ntdsextract2 <NTDS_FILE> timeline [OPTIONS]

OPTIONS:
        --all-objects    show objects of any type (this might be a lot)
    -h, --help           Print help information
    -q, --quiet          Less output per occurrence
    -v, --verbose        More output per occurrence

枚举 ...

... 用户

USAGE:
    ntdsextract2 <NTDS_FILE> user [OPTIONS]

OPTIONS:
    -A, --show-all           show all non-empty values. This option is ignored when CSV-Output is
                             selected
    -F, --format <FORMAT>    Output format [default: csv] [possible values: csv, json, json-lines]
    -h, --help               Print help information
    -q, --quiet              Less output per occurrence
    -v, --verbose            More output per occurrence

... 组

USAGE:
    ntdsextract2 <NTDS_FILE> group [OPTIONS]

OPTIONS:
    -A, --show-all           show all non-empty values. This option is ignored when CSV-Output is
                             selected
    -F, --format <FORMAT>    Output format [default: csv] [possible values: csv, json, json-lines]
    -h, --help               Print help information
    -q, --quiet              Less output per occurrence
    -v, --verbose            More output per occurrence

... 计算机

USAGE:
    ntdsextract2 <NTDS_FILE> computer [OPTIONS]

OPTIONS:
    -A, --show-all           show all non-empty values. This option is ignored when CSV-Output is
                             selected
    -F, --format <FORMAT>    Output format [default: csv] [possible values: csv, json, json-lines]
    -h, --help               Print help information
    -q, --quiet              Less output per occurrence
    -v, --verbose            More output per occurrence

... 类型

USAGE:
    ntdsextract2 <NTDS_FILE> types [OPTIONS]

OPTIONS:
    -F, --format <FORMAT>    Output format [default: csv] [possible values: csv, json, json-lines]
    -h, --help               Print help information
    -q, --quiet              Less output per occurrence
    -v, --verbose            More output per occurrence