ntdissector 是一款用于解析 NTDS 数据库记录的工具。 记录以 JSON 格式导出，并可按照对象类别进行过滤。
通过提供 SYSTEM 配置单元或十六进制格式的正确 bootkey，相应列上的加密层将被移除。
更多信息请参阅以下博客文章：
$ python3 -m pip install [--user] ./ntdissector
$ ntdissector -h
usage: ntdissector [-h] [-system SYSTEM] -ntds NTDS [-bootKey BOOTKEY] [-outputdir OUTPUTDIR] [-cachedir CACHEDIR] [-f FILTER] [-filters] [-limit LIMIT] [-cn] [-debug] [-verbose]
[-silent] [-ts] [-w WORKERS] [-nocache] [-dryRun]
NTDS Dissector
optional arguments:
-h, --help show this help message and exit
-V, --version Display version info
Files:
-system SYSTEM SYSTEM hive to parse
-ntds NTDS NTDS file to parse
-bootKey BOOTKEY Force bootkey (skips the SYSTEM hive parsing)
-outputdir OUTPUTDIR Base output directory
(Default: /home/mehdie/.ntdissector/out/)
-cachedir CACHEDIR Base cache directory
(Default: /home/mehdie/.ntdissector/.cache/)
Filter options:
-f FILTER, --filter FILTER
Filter object classes, 'all' to dump everything.
Use -filters to get a list of available object classes
Default: [user, secret, group, domainDNS].
-filters Print all classes available for filtering
-limit LIMIT Dump a specific number of objects then stop
Display options:
-cn Toggle CN naming output (Default: LDAP naming)
-debug Turn DEBUG output ON
-verbose Turn INFO output ON
-silent Silent
-ts Adds a timestamp to every logging output
-keepDel Keeps deleted records
Miscellaneous:
-w WORKERS, -workers WORKERS
Number of workers (default: 5)
-nocache Disable cache
-dryRun Launch in dry run mode, ignores cache files
Examples:
> Dump users, groups and domain backup keys
$ ntdissector -ntds NTDS.dit -system SYSTEM -outputdir /tmp/ntdissector/ -ts -f user,group,secret
> Dump all records from the database
$ ntdissector -ntds NTDS.dit -system SYSTEM -outputdir /tmp/ntdissector/ -ts -f all
> Dump user objects and include deleted records
$ ntdissector -ntds NTDS.dit -system SYSTEM -outputdir /tmp/ntdissector/ -ts -f user -keepDel
> List object classes available to filter records
$ ntdissector -ntds NTDS.dit -filters
首次运行时，该工具会自动构建对象类别和属性的架构。这两个架构会缓存在本地，以便在下次运行时跳过此步骤。
默认目录：
~/.ntdissector/.cache/[hash]~/.ntdissector/out/[hash]/[object-class-name].json