dissect.database 1.1.dev12__tar.gz → 1.1.dev14__tar.gz

{dissect_database-1.1.dev12/dissect.database.egg-info → dissect_database-1.1.dev14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.database
-Version: 1.1.dev12
+Version: 1.1.dev14
 Summary: A Dissect module implementing parsers for various database formats, including Berkeley DB, Microsofts Extensible Storage Engine (ESE) and SQLite3
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: Apache-2.0
@@ -53,6 +53,17 @@ This module is also automatically installed if you install the `dissect` package
 
 ## Tools
 
+Some CLI tools related to specific databases exists. These tools allow you to dump or inspect database content.
+
+| Commands           | Description                                                                                                                                                       |
+|--------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `dissect-ntds`     | Windows NTDS (Active Directory database).                                                                                                                         |
+| `dissect-ual`      | Windows [User Access Logging](https://learn.microsoft.com/en-us/windows-server/administration/user-access-logging/get-started-with-user-access-logging) database. |
+| `dissect-sru`      | Windows System Resources And Usage Monitor database.                                                                                                              |
+| `dissect-certlog`  | Windows [AD CS database](https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/active-directory-certificate-services-overview) database.                |
+| `dissect-rpm`      | [Red Hat Package Manager](https://rpm.org/) database.                                                                                                             |
+| `dissect-impacket` | Impacket compatibility shim for `secretsdump.py`.                                                                                                                 |
+
 ### Impacket compatibility shim for secretsdump.py
 
 Impacket does not ([yet](https://github.com/fortra/impacket/pull/1452)) have native support for `dissect.database`,
@@ -60,7 +71,7 @@ so in the meantime a compatibility shim is provided. To use this shim, simply in
 instructions above, and execute `secretsdump.py` like so:
 
 ```bash
-python -m dissect.database.ese.tools.impacket /path/to/impacket/examples/secretsdump.py -h
+dissect-impacket /path/to/impacket/examples/secretsdump.py -h
 ```
 
 Impacket `secretsdump.py` will now use `dissect.database` for parsing the `NTDS.dit` file, resulting in a significant performance improvement!

{dissect_database-1.1.dev12 → dissect_database-1.1.dev14}/README.md

@@ -20,6 +20,17 @@ This module is also automatically installed if you install the `dissect` package
 
 ## Tools
 
+Some CLI tools related to specific databases exists. These tools allow you to dump or inspect database content.
+
+| Commands           | Description                                                                                                                                                       |
+|--------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `dissect-ntds`     | Windows NTDS (Active Directory database).                                                                                                                         |
+| `dissect-ual`      | Windows [User Access Logging](https://learn.microsoft.com/en-us/windows-server/administration/user-access-logging/get-started-with-user-access-logging) database. |
+| `dissect-sru`      | Windows System Resources And Usage Monitor database.                                                                                                              |
+| `dissect-certlog`  | Windows [AD CS database](https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/active-directory-certificate-services-overview) database.                |
+| `dissect-rpm`      | [Red Hat Package Manager](https://rpm.org/) database.                                                                                                             |
+| `dissect-impacket` | Impacket compatibility shim for `secretsdump.py`.                                                                                                                 |
+
 ### Impacket compatibility shim for secretsdump.py
 
 Impacket does not ([yet](https://github.com/fortra/impacket/pull/1452)) have native support for `dissect.database`,
@@ -27,7 +38,7 @@ so in the meantime a compatibility shim is provided. To use this shim, simply in
 instructions above, and execute `secretsdump.py` like so:
 
 ```bash
-python -m dissect.database.ese.tools.impacket /path/to/impacket/examples/secretsdump.py -h
+dissect-impacket /path/to/impacket/examples/secretsdump.py -h
 ```
 
 Impacket `secretsdump.py` will now use `dissect.database` for parsing the `NTDS.dit` file, resulting in a significant performance improvement!

{dissect_database-1.1.dev12 → dissect_database-1.1.dev14}/dissect/database/ese/ntds/objects/object.py

@@ -147,6 +147,11 @@ class Object:
         """Return the object's name."""
         return self.get("name")
 
+    @property
+    def cn(self) -> str | None:
+        """Return the object's Common Name (CN)."""
+        return self.get("cn")
+
     @property
     def object_category(self) -> str | None:
         """Return the object's objectCategory."""

{dissect_database-1.1.dev12 → dissect_database-1.1.dev14}/dissect/database/ese/ntds/objects/top.py

@@ -14,3 +14,8 @@ class Top(Object):
 
     def __repr_body__(self) -> str:
         return f"name={self.name!r}"
+
+    @property
+    def display_name(self) -> str | None:
+        """Return the displayName for this object."""
+        return self.get("displayName")

dissect_database-1.1.dev14/dissect/database/ese/ntds/tools/ntds.py

@@ -0,0 +1,28 @@
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+
+from dissect.database.ese.ntds import NTDS
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description="dissect.database.ese.ntds NTDS parser")
+    parser.add_argument("input", help="NTDS database to read")
+    parser.add_argument("-c", "--objectClass", help="show only objects of this class", required=True)
+    parser.add_argument("-j", "--json", action="store_true", default=False, help="output in JSON format")
+    args = parser.parse_args()
+
+    with Path(args.input).open("rb") as fh:
+        ntds = NTDS(fh)
+
+        for record in ntds.search(objectClass=args.objectClass):
+            if args.json:
+                print(json.dumps(record.as_dict(), default=str))
+            else:
+                print(record)
+
+
+if __name__ == "__main__":
+    main()

{dissect_database-1.1.dev12 → dissect_database-1.1.dev14}/dissect/database/ese/tools/sru.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import argparse
+import json
 from pathlib import Path
 from typing import TYPE_CHECKING, BinaryIO
 
@@ -148,24 +149,32 @@ class Entry:
         column_values = serialise_record_column_values(self.record)
         return f"<Entry provider={self.table.name!r} {column_values}>"
 
+    def as_dict(self) -> dict:
+        ret = self.record.as_dict()
+        ret["provider"] = self.table.name
+        return ret
+
 
 def main() -> None:
     parser = argparse.ArgumentParser(description="dissect.database.ese SRU parser")
     parser.add_argument("input", help="SRU database to read")
     parser.add_argument("-p", "--provider", help="filter records from this provider")
+    parser.add_argument("-j", "--json", action="store_true", default=False, help="output in JSON format")
     args = parser.parse_args()
 
     with Path(args.input).open("rb") as fh:
         parser = SRU(fh)
 
         if args.provider in NAME_TO_GUID_MAP:
-            for e in parser.get_table_entries(table_name=args.provider):
-                print(e)
+            generator = parser.get_table_entries(table_name=args.provider)
         elif args.provider:
-            for e in parser.get_table_entries(table_guid=args.provider):
-                print(e)
+            generator = parser.get_table_entries(table_guid=args.provider)
         else:
-            for e in parser.entries():
+            generator = parser.entries()
+        for e in generator:
+            if args.json:
+                print(json.dumps(e.as_dict(), default=str))
+            else:
                 print(e)
 
 

{dissect_database-1.1.dev12 → dissect_database-1.1.dev14}/dissect/database/ese/tools/ual.py

@@ -1,6 +1,7 @@
 import argparse
 import datetime
 import ipaddress
+import json
 from collections.abc import Iterator
 from pathlib import Path
 from typing import BinaryIO
@@ -89,6 +90,7 @@ def convert_day_num_to_date(year: int, day_num: int) -> datetime.datetime:
 
 def main() -> None:
     parser = argparse.ArgumentParser(description="dissect.database.ese UAL parser")
+    parser.add_argument("-j", "--json", action="store_true", default=False, help="output in JSON format")
     parser.add_argument("input", help="UAL database to read")
     args = parser.parse_args()
 
@@ -100,7 +102,10 @@ def main() -> None:
                 continue
 
             for record in parser.get_table_records(table.name):
-                print(record)
+                if args.json:
+                    print(json.dumps(record, default=str))
+                else:
+                    print(record)
 
 
 if __name__ == "__main__":

{dissect_database-1.1.dev12 → dissect_database-1.1.dev14/dissect.database.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.database
-Version: 1.1.dev12
+Version: 1.1.dev14
 Summary: A Dissect module implementing parsers for various database formats, including Berkeley DB, Microsofts Extensible Storage Engine (ESE) and SQLite3
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: Apache-2.0
@@ -53,6 +53,17 @@ This module is also automatically installed if you install the `dissect` package
 
 ## Tools
 
+Some CLI tools related to specific databases exists. These tools allow you to dump or inspect database content.
+
+| Commands           | Description                                                                                                                                                       |
+|--------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `dissect-ntds`     | Windows NTDS (Active Directory database).                                                                                                                         |
+| `dissect-ual`      | Windows [User Access Logging](https://learn.microsoft.com/en-us/windows-server/administration/user-access-logging/get-started-with-user-access-logging) database. |
+| `dissect-sru`      | Windows System Resources And Usage Monitor database.                                                                                                              |
+| `dissect-certlog`  | Windows [AD CS database](https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/active-directory-certificate-services-overview) database.                |
+| `dissect-rpm`      | [Red Hat Package Manager](https://rpm.org/) database.                                                                                                             |
+| `dissect-impacket` | Impacket compatibility shim for `secretsdump.py`.                                                                                                                 |
+
 ### Impacket compatibility shim for secretsdump.py
 
 Impacket does not ([yet](https://github.com/fortra/impacket/pull/1452)) have native support for `dissect.database`,
@@ -60,7 +71,7 @@ so in the meantime a compatibility shim is provided. To use this shim, simply in
 instructions above, and execute `secretsdump.py` like so:
 
 ```bash
-python -m dissect.database.ese.tools.impacket /path/to/impacket/examples/secretsdump.py -h
+dissect-impacket /path/to/impacket/examples/secretsdump.py -h
 ```
 
 Impacket `secretsdump.py` will now use `dissect.database` for parsing the `NTDS.dit` file, resulting in a significant performance improvement!

{dissect_database-1.1.dev12 → dissect_database-1.1.dev14}/dissect.database.egg-info/SOURCES.txt

@@ -7,6 +7,7 @@ tox.ini
 dissect.database.egg-info/PKG-INFO
 dissect.database.egg-info/SOURCES.txt
 dissect.database.egg-info/dependency_links.txt
+dissect.database.egg-info/entry_points.txt
 dissect.database.egg-info/requires.txt
 dissect.database.egg-info/top_level.txt
 dissect/database/__init__.py
@@ -152,6 +153,8 @@ dissect/database/ese/ntds/objects/subschema.py
 dissect/database/ese/ntds/objects/top.py
 dissect/database/ese/ntds/objects/trusteddomain.py
 dissect/database/ese/ntds/objects/user.py
+dissect/database/ese/ntds/tools/__init__.py
+dissect/database/ese/ntds/tools/ntds.py
 dissect/database/ese/tools/__init__.py
 dissect/database/ese/tools/certlog.py
 dissect/database/ese/tools/impacket.py

dissect_database-1.1.dev14/dissect.database.egg-info/entry_points.txt

@@ -0,0 +1,7 @@
+[console_scripts]
+dissect-certlog = dissect.database.ese.tools.certlog:main
+dissect-impacket = dissect.database.ese.tools.impacket:main
+dissect-ntds = dissect.database.ese.ntds.tools.ntds:main
+dissect-rpm = dissect.database.bsd.tools.rpm:main
+dissect-sru = dissect.database.ese.tools.sru:main
+dissect-ual = dissect.database.ese.tools.ual:main

{dissect_database-1.1.dev12 → dissect_database-1.1.dev14}/pyproject.toml

@@ -66,6 +66,14 @@ dev = [
     {include-group = "debug"},
 ]
 
+[project.scripts]
+dissect-ntds = "dissect.database.ese.ntds.tools.ntds:main"
+dissect-ual = "dissect.database.ese.tools.ual:main"
+dissect-sru = "dissect.database.ese.tools.sru:main"
+dissect-certlog = "dissect.database.ese.tools.certlog:main"
+dissect-rpm = "dissect.database.bsd.tools.rpm:main"
+dissect-impacket = "dissect.database.ese.tools.impacket:main"
+
 [tool.ruff]
 line-length = 120
 required-version = ">=0.13.1"