tabledevil
1a4af6db30
Cargo-installs --locked from crates.io on rust:1.96-alpine3.21 with build-base + linux-headers + gettext-dev (libesedb's bundled C tree needs all three). Final image is ~26MB on alpine:3.21.
32 lines
1.4 KiB
Bash
Executable File
32 lines
1.4 KiB
Bash
Executable File
#!/bin/sh
|
|
# Banner on bare run; pass-through to ntdsextract2 otherwise.
|
|
if [ $# -eq 0 ]; then
|
|
cat >&2 <<'EOF'
|
|
============================================================
|
|
ntdsextract2 — Active Directory database analyser (Jan Starke)
|
|
------------------------------------------------------------
|
|
Mount your NTDS.DIT at /data, then pick a subcommand:
|
|
|
|
docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
|
|
user /data/ntds.dit # account list
|
|
docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
|
|
group /data/ntds.dit # group membership
|
|
docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
|
|
computer /data/ntds.dit # joined hosts
|
|
docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
|
|
timeline /data/ntds.dit > timeline.body # bodyfile for mactime
|
|
docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
|
|
tree /data/ntds.dit # DIT hierarchy
|
|
docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
|
|
search '<regex>' /data/ntds.dit # entry search
|
|
|
|
NTDS.DIT files are normally locked while AD runs — extract with
|
|
vshadow / volume shadow copy first; ntdsextract2 reads the offline
|
|
copy directly.
|
|
============================================================
|
|
EOF
|
|
ntdsextract2 --help 2>&1 | head -20 >&2
|
|
exit 64
|
|
fi
|
|
exec ntdsextract2 "$@"
|