dissect.database 1.2.dev6__py3-none-any.whl → 1.2.dev7__py3-none-any.whl

dissect/database/ese/ntds/database.py

@@ -6,18 +6,18 @@ from typing import TYPE_CHECKING, BinaryIO
 
 from dissect.database.ese.ese import ESE
 from dissect.database.ese.exception import KeyNotFoundError
-from dissect.database.ese.ntds.objects import DomainDNS, Object
+from dissect.database.ese.ntds.objects import Object
 from dissect.database.ese.ntds.pek import PEK
 from dissect.database.ese.ntds.query import Query
 from dissect.database.ese.ntds.schema import Schema
 from dissect.database.ese.ntds.sd import SecurityDescriptor
-from dissect.database.ese.ntds.util import DN, SearchFlags, encode_value
+from dissect.database.ese.ntds.util import DN, DatabaseFlags, SearchFlags, encode_value
 
 if TYPE_CHECKING:
     from collections.abc import Iterator
 
     from dissect.database.ese.index import Index
-    from dissect.database.ese.ntds.objects import DMD, NTDSDSA, Top
+    from dissect.database.ese.ntds.objects import DMD, NTDSDSA, DomainDNS, Server, Top
 
 
 class Database:
@@ -34,78 +34,91 @@ class Database:
         self.link = LinkTable(self)
         self.sd = SecurityDescriptorTable(self)
 
-        self.data.schema.load(self)
-
-
-class DataTable:
-    """Represents the ``datatable`` in the NTDS database."""
-
-    def __init__(self, db: Database):
-        self.db = db
-        self.table = self.db.ese.table("datatable")
-        self.hiddentable = self.db.ese.table("hiddentable")
+        self.hiddentable = self.ese.table("hiddentable")
         self.hiddeninfo = next(self.hiddentable.records(), None)
 
-        self.schema = Schema()
-
-        # Cache frequently used and "expensive" methods
-        self.get = lru_cache(4096)(self.get)
-        self._make_dn = lru_cache(4096)(self._make_dn)
-
-    def dsa(self) -> NTDSDSA:
-        """Return the Directory System Agent (DSA) object."""
-        if not self.hiddeninfo:
-            raise ValueError("No hiddentable information available")
-        return self.get(self.hiddeninfo.get("dsa_col"))
-
-    def dmd(self) -> DMD:
-        """Return the Directory Management Domain (DMD) object, a.k.a. the schema container."""
-        if not self.hiddeninfo:
-            raise ValueError("No hiddentable information available")
-        return self.get(self.dsa().get("dMDLocation", raw=True))
-
-    def root(self) -> Top:
-        """Return the top-level object in the NTDS database."""
-        if (root := next(self.children_of(0), None)) is None:
-            raise ValueError("No root object found")
-        return root
+        self.data.schema.load(self)
 
-    def root_domain(self) -> DomainDNS | None:
-        """Return the root domain object in the NTDS database. For AD LDS, this will return ``None``."""
-        stack = [self.root()]
-        while stack:
-            if (obj := stack.pop()).is_deleted:
-                continue
+        # Clear the cache of the data table to avoid caching results before the schema is loaded
+        self.data.get.cache_clear()
+        self.data._make_dn.cache_clear()
 
-            if isinstance(obj, DomainDNS) and obj.is_head_of_naming_context:
-                return obj
+    @cached_property
+    def flags(self) -> DatabaseFlags | None:
+        """Return the database flags."""
+        if self.hiddeninfo is None:
+            return None
 
-            stack.extend(obj.children())
+        result = DatabaseFlags(0)
+        flags = self.hiddeninfo.get("flags_col")
+        for idx, member in enumerate(DatabaseFlags.__members__.values()):
+            if flags[idx] == ord(b"1"):
+                result = member if result is None else result | member
 
-        return None
+        return result
 
     @cached_property
     def pek(self) -> PEK | None:
         """Return the PEK."""
-        if (root_domain := self.root_domain()) is None:
+        if (domain := self.domain()) is None:
             # Maybe this is an AD LDS database
-            if (root_pek := self.root().get("pekList")) is None:
+            if (root_pek := self.data.root().get("pekList")) is None:
                 # It's not
                 return None
 
             # Lookup the schema pek and permutate the boot key
             # https://www.synacktiv.com/publications/using-ntdissector-to-extract-secrets-from-adam-ntds-files
-            schema_pek = self.lookup(objectClass="dMD").get("pekList")
+            schema_pek = self.dmd().get("pekList")
             boot_key = bytes(
                 [root_pek[i] for i in [2, 4, 25, 9, 7, 27, 5, 11]]
                 + [schema_pek[i] for i in [37, 2, 17, 36, 20, 11, 22, 7]]
             )
 
             # Lookup the actual PEK and unlock it
-            pek = PEK(self.lookup(objectClass="configuration").get("pekList"))
+            pek = PEK(self.dmd().parent().get("pekList"))
             pek.unlock(boot_key)
             return pek
-        return root_domain.pek
+
+        return domain.pek
+
+    def dsa(self) -> NTDSDSA:
+        """Return the Directory System Agent (DSA) object, a.k.a. the NTDS Settings object."""
+        if not self.hiddeninfo:
+            raise ValueError("No hiddentable information available")
+        return self.data.get(self.hiddeninfo.get("dsa_col"))
+
+    def dmd(self) -> DMD:
+        """Return the Directory Management Domain (DMD) object, a.k.a. the schema container."""
+        if not self.hiddeninfo:
+            raise ValueError("No hiddentable information available")
+        return self.data.get(self.dsa().get("dMDLocation", raw=True))
+
+    def dc(self) -> Server:
+        """Return the Domain Controller (DC) server object that corresponds to this NTDS database."""
+        return self.dsa().parent()
+
+    def domain(self) -> DomainDNS | None:
+        """Return the root domain object in the NTDS database. For AD LDS (ADAM), this will return ``None``."""
+        return self.dsa().domain()
+
+
+class DataTable:
+    """Represents the ``datatable`` in the NTDS database."""
+
+    def __init__(self, db: Database):
+        self.db = db
+        self.table = self.db.ese.table("datatable")
+        self.schema = Schema()
+
+        # Cache frequently used and "expensive" methods
+        self.get = lru_cache(4096)(self.get)
+        self._make_dn = lru_cache(4096)(self._make_dn)
+
+    def root(self) -> Top:
+        """Return the top-level object in the NTDS database."""
+        if (root := next(self.children_of(0), None)) is None:
+            raise ValueError("No root object found")
+        return root
 
     def walk(self) -> Iterator[Object]:
         """Walk through all objects in the NTDS database."""
@@ -201,8 +214,11 @@ class DataTable:
         cursor.seek([dnt])
 
         record = cursor.record()
-        while record is not None and record != end:
+        while record is not None:
             yield Object.from_record(self.db, record)
+            if record == end:
+                break
+
             record = cursor.next()
 
     def _make_dn(self, dnt: int) -> DN:

dissect/database/ese/ntds/ntds.py

@@ -41,18 +41,18 @@ class NTDS:
     def __init__(self, fh: BinaryIO):
         self.db = Database(fh)
 
+    @property
+    def pek(self) -> PEK | None:
+        """Return the PEK associated with the root domain."""
+        return self.db.pek
+
     def root(self) -> Object:
         """Return the root object of the Active Directory."""
         return self.db.data.root()
 
-    def root_domain(self) -> DomainDNS | None:
+    def domain(self) -> DomainDNS | None:
         """Return the root domain object of the Active Directory."""
-        return self.db.data.root_domain()
-
-    @property
-    def pek(self) -> PEK | None:
-        """Return the PEK associated with the root domain."""
-        return self.db.data.pek
+        return self.db.domain()
 
     def walk(self) -> Iterator[Object]:
         """Walk through all objects in the NTDS database."""

dissect/database/ese/ntds/objects/ntdsdsa.py

@@ -7,7 +7,7 @@ from dissect.database.ese.ntds.objects.applicationsettings import ApplicationSet
 if TYPE_CHECKING:
     from collections.abc import Iterator
 
-    from dissect.database.ese.ntds.objects import Object
+    from dissect.database.ese.ntds.objects import DomainDNS, MSDSOptionalFeature, Object
 
 
 class NTDSDSA(ApplicationSettings):
@@ -19,6 +19,18 @@ class NTDSDSA(ApplicationSettings):
 
     __object_class__ = "nTDSDSA"
 
+    def domain(self) -> DomainDNS | None:
+        """Return the domain object associated with this NTDS DSA object, if any."""
+        self._assert_local()
+
+        return next(self.db.link.links(self.dnt, "msDS-HasDomainNCs"), None)
+
+    def features(self) -> Iterator[MSDSOptionalFeature]:
+        """Return the optional features that are enabled on this NTDS DSA object."""
+        self._assert_local()
+
+        yield from self.db.link.links(self.dnt, "msDS-EnabledFeature")
+
     def managed_by(self) -> Iterator[Object]:
         """Return the objects that manage this NTDS DSA object."""
         self._assert_local()

dissect/database/ese/ntds/objects/server.py

@@ -7,7 +7,7 @@ from dissect.database.ese.ntds.objects.top import Top
 if TYPE_CHECKING:
     from collections.abc import Iterator
 
-    from dissect.database.ese.ntds.objects import Object
+    from dissect.database.ese.ntds.objects import Computer, Object
 
 
 class Server(Top):
@@ -19,6 +19,12 @@ class Server(Top):
 
     __object_class__ = "server"
 
+    def computer(self) -> Computer | None:
+        """Return the computer object associated with this server, if any."""
+        self._assert_local()
+
+        return next(self.db.link.links(self.dnt, "serverReference"), None)
+
     def managed_by(self) -> Iterator[Object]:
         """Return the objects that manage this server."""
         self._assert_local()

dissect/database/ese/ntds/query.py

@@ -124,6 +124,7 @@ class Query:
         Yields:
             Records matching any condition in the OR operation.
         """
+        records = list(records) if records is not None else None
         for child in filter.children:
             yield from self._process_query(child, records=records)
 
@@ -186,8 +187,10 @@ def _process_wildcard_tail(index: Index, filter_value: str) -> Iterator[Record]:
 
     # Yield all records in range
     record = cursor.record()
-    while record is not None and record != end:
+    while record is not None:
         yield record
+        if record == end:
+            break
         record = cursor.next()
 
 

dissect/database/ese/ntds/schema.py

@@ -202,7 +202,7 @@ class Schema:
         # This _should_ have all the attribute and class schema entries
         # We used to perform an index search on objectClass (ATTc0, INDEX_00000000), but apparently
         # not all databases have this index
-        dmd = db.data.dmd()
+        dmd = db.dmd()
 
         # We bootstrapped these earlier
         attribute_schema = self.lookup_class(name="attributeSchema")
@@ -232,7 +232,7 @@ class Schema:
                 )
 
         # Load user-defined OID prefixes
-        if (prefix_map := db.data.dmd().get("prefixMap")) is not None:
+        if (prefix_map := dmd.get("prefixMap")) is not None:
             self._oid_idx_to_prefix_index.update(parse_prefix_map(prefix_map))
             # Rebuild the reverse index
             self._oid_prefix_to_idx_index = {prefix: idx for idx, prefix in self._oid_idx_to_prefix_index.items()}

dissect/database/ese/ntds/util.py

@@ -1,7 +1,7 @@
 from __future__ import annotations
 
 import struct
-from enum import IntEnum, IntFlag
+from enum import Flag, IntEnum, IntFlag, auto
 from typing import TYPE_CHECKING, Any
 from uuid import UUID
 
@@ -18,6 +18,23 @@ if TYPE_CHECKING:
     from dissect.database.ese.ntds.schema import AttributeEntry
 
 
+class DatabaseFlags(Flag):
+    """Database flags that are stored in the hiddentable.
+
+    The flags are weirdly stored as ``1``, ``0`` or ``\x00`` in a byte array.
+    To make parsing a bit easier, we use the index of each flag in this class as the character offset in the byte array.
+    """
+
+    AUXCLASS = auto()
+    SD_CONVERSION_REQUIRED = auto()
+    ROOT_GUID_UPDATED = auto()
+    ADAM = auto()
+    ASCII_INDICES_REBUILT = auto()
+    SHOW_IN_AB_ARRAY_REBUILD = auto()
+    UPDATE_NC_TYPE_REQUIRED = auto()
+    LINK_QUOTA_USN = auto()
+
+
 # https://learn.microsoft.com/en-us/windows/win32/adschema/a-instancetype
 class InstanceType(IntFlag):
     HeadOfNamingContext = 0x00000001
@@ -102,10 +119,10 @@ def _pek_decrypt(db: Database, value: bytes) -> bytes:
     Returns:
         The decrypted data blob, or the original value if the PEK is locked.
     """
-    if db.data.pek is None or not db.data.pek.unlocked:
+    if db.pek is None or not db.pek.unlocked:
         return value
 
-    return db.data.pek.decrypt(value)
+    return db.pek.decrypt(value)
 
 
 def _decode_supplemental_credentials(db: Database, value: bytes) -> dict[str, bytes] | bytes:
@@ -118,10 +135,10 @@ def _decode_supplemental_credentials(db: Database, value: bytes) -> dict[str, by
     Returns:
         A dictionary mapping credential types to their data blobs, or the original value if the PEK is locked.
     """
-    if db.data.pek is None or not db.data.pek.unlocked:
+    if db.pek is None or not db.pek.unlocked:
         return value
 
-    value = db.data.pek.decrypt(value)
+    value = db.pek.decrypt(value)
     header = c_ds.USER_PROPERTIES_HEADER(value)
 
     result = {}
@@ -222,12 +239,12 @@ def _decode_pwd_history(db: Database, value: list[bytes]) -> list[bytes]:
     Returns:
         A list of decrypted password hashes, or the original value if the PEK is locked.
     """
-    if db.data.pek is None or not db.data.pek.unlocked:
+    if db.pek is None or not db.pek.unlocked:
         return value
 
     result = []
     for buf in value:
-        buf = db.data.pek.decrypt(buf)
+        buf = db.pek.decrypt(buf)
         # The history attributes can contain multiple hashes concatenated together, so we need to split them up
         # NT and LM hashes are both 16 bytes long
         result.extend(buf[i : i + 16] for i in range(0, len(buf), 16))

{dissect_database-1.2.dev6.dist-info → dissect_database-1.2.dev7.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.database
-Version: 1.2.dev6
+Version: 1.2.dev7
 Summary: A Dissect module implementing parsers for various database formats, including Berkeley DB, Microsofts Extensible Storage Engine (ESE) and SQLite3
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: Apache-2.0

{dissect_database-1.2.dev6.dist-info → dissect_database-1.2.dev7.dist-info}/RECORD

@@ -29,13 +29,13 @@ dissect/database/ese/ntds/c_pek.py,sha256=YU_rRpOEf8uB8OE6bGb25KIGm9e-yrn0tTItRC
 dissect/database/ese/ntds/c_pek.pyi,sha256=lHfhvHWABT1vLmknu66phOXsylgwzGIWVdbqDIZU5Qw,4683
 dissect/database/ese/ntds/c_sd.py,sha256=DYICZsWCBzj0OtvhO6vhzzVjK9YP6tzBCsgKgr0pc-k,4294
 dissect/database/ese/ntds/c_sd.pyi,sha256=7717Y0EBVu37Liu26rqsDWkLIdSCqWn9KK9svtniLqY,5279
-dissect/database/ese/ntds/database.py,sha256=rKHdbQObLp9vSV2gquGZ_RBnIY5Y-2hACIe_atTvxbY,16189
-dissect/database/ese/ntds/ntds.py,sha256=qvyDsjHs1WyGbDccOtO5XXcvlKH6rkMnaW6KRxd9264,5080
+dissect/database/ese/ntds/database.py,sha256=6T9JGxB0BD9JF9LP4DjWfozm7mPb5eiXP56Q6bGqKnk,16783
+dissect/database/ese/ntds/ntds.py,sha256=ffE_yOvmwDUXwuQSjCDcGagKXx3nUajAkxDr1HpJbHQ,5060
 dissect/database/ese/ntds/pek.py,sha256=BEmxO175T8QkGVvFQLN9MI9uDCcK4jztuZetbwbbYqU,4154
-dissect/database/ese/ntds/query.py,sha256=orTuXH5jXYUVUVL6PtD9rOcdfCKHjOS-D8RzUMEl0sk,7972
-dissect/database/ese/ntds/schema.py,sha256=1M0t5qDAcDOdY4MzAE5cLz4klDCTxrxa0Z9hIDFUCvw,16659
+dissect/database/ese/ntds/query.py,sha256=pDLLCVdrCRNq3ripvMDiyxXoFWsVJLwwsRMplRf7C9s,8063
+dissect/database/ese/ntds/schema.py,sha256=xxVL--RRBM8-IP12L86hrz-EEGLqXKAXpQZyOT_Vhn0,16644
 dissect/database/ese/ntds/sd.py,sha256=Y-oYnJPcLMDB_4X8TLEGtt-n_nC4HLA0WqIS8qYAwAs,5995
-dissect/database/ese/ntds/util.py,sha256=mx_b-_mIINR1Mn01rH7bR4CeY0gl0gnkD2gjeMeiAU8,18348
+dissect/database/ese/ntds/util.py,sha256=nuY7NRSlr5V5Jz2NIOEhe3hbzPjFLVQnprXa3swSl_M,18856
 dissect/database/ese/ntds/objects/__init__.py,sha256=3lI4f0SwILAY4zJRDVtJpe9YaxKspR-1kHXnhpw91e4,10739
 dissect/database/ese/ntds/objects/applicationsettings.py,sha256=j7UzmF8yxm3LR2lLnmGb7vFvUhYokCUOdhJXnk9xxzE,358
 dissect/database/ese/ntds/objects/attributeschema.py,sha256=0e_s5N5mnybxuufOEjGIVWlyuJkSgplz9LuIsaS2S38,342
@@ -111,7 +111,7 @@ dissect/database/ese/ntds/objects/mspki_privatekeyrecoveryagent.py,sha256=BA7NKZ
 dissect/database/ese/ntds/objects/msspp_activationobjectscontainer.py,sha256=l_OpFUHcRZ7LYvXAdfrDXSClX9f78Ca5UJPgNszo3ZE,405
 dissect/database/ese/ntds/objects/mstpm_informationobjectscontainer.py,sha256=84wqeKMwcShtr6uzgHoG6rMpk_3r22xe6BTvpt24pSg,404
 dissect/database/ese/ntds/objects/ntdsconnection.py,sha256=mWgzUTQ0o6Gsc6CsyBoakyXV5UejzTlsVp8j3vm10bw,341
-dissect/database/ese/ntds/objects/ntdsdsa.py,sha256=HJRbkL8vGeM0sjADYzxsUcfKCram7uR-nbyLejfuPaw,715
+dissect/database/ese/ntds/objects/ntdsdsa.py,sha256=pES4m9UCqxDI6sOQUjyp3Uc0alHN3pNGpr84L46L5ys,1226
 dissect/database/ese/ntds/objects/ntdsservice.py,sha256=mTdpd2tzm8OOiGm6rJN35_dyeWtvzPYI_rVDBZz0gNc,326
 dissect/database/ese/ntds/objects/ntdssitesettings.py,sha256=VNlke-Vgxjh0fzd5o2X-4fwCBrkEI1coR4oto5OenPo,709
 dissect/database/ese/ntds/objects/ntfrssettings.py,sha256=PwIKT6t_zRxfdacWuvzMfq_mIhj_wyIhHzORNcF2eOU,745
@@ -130,7 +130,7 @@ dissect/database/ese/ntds/objects/rrasadministrationdictionary.py,sha256=dzS3xag
 dissect/database/ese/ntds/objects/samserver.py,sha256=q32pI-Pjd1TOQle_LuR53rjZlDjCY2U2aAYCWjLEaDg,348
 dissect/database/ese/ntds/objects/secret.py,sha256=0278o0wpy3n5JmhYKFpNDy1MgNcHBbjX0aUYXxeCUlQ,3392
 dissect/database/ese/ntds/objects/securityobject.py,sha256=hR0a0wjyrLFtSMtRZOwPCYXpfuOCtNMhozK4bkzly-A,330
-dissect/database/ese/ntds/objects/server.py,sha256=oCbwfzW7TQm3nSWD4KuWVzhOYnZXFyq6NZ2KuVB2-Wc,652
+dissect/database/ese/ntds/objects/server.py,sha256=9swxb2s6vNTAPsL_mjQBjZNGft-pUvA2-zds1gKfYJ8,889
 dissect/database/ese/ntds/objects/serverscontainer.py,sha256=NnJ0M23RO-hsKd2vWcvViOMRV8psGJkwiaRC-ghmrk0,345
 dissect/database/ese/ntds/objects/site.py,sha256=Yj5lLgivDumOaS8QaTdsS0XZfQEkYr7loN9aUwxj_Y4,640
 dissect/database/ese/ntds/objects/sitelink.py,sha256=cNHis9jsxFPtxfiCfxd4klP495XfjcwrF507wduyADk,313
@@ -158,10 +158,10 @@ dissect/database/sqlite3/encryption/__init__.py,sha256=kJdFWXD9Z_O_QipC-_A9dlVfR
 dissect/database/sqlite3/encryption/sqlcipher/__init__.py,sha256=kJdFWXD9Z_O_QipC-_A9dlVfR6AOPSOoT8WBhpFbSsE,238
 dissect/database/sqlite3/encryption/sqlcipher/exception.py,sha256=GKNtzcnAKlWkvjLluruA8LfzCwjRRWubibbH8WM9l2o,121
 dissect/database/sqlite3/encryption/sqlcipher/sqlcipher.py,sha256=y_oJRKZqoJBeOQaBbniesZKm1sVTFvXZ466rJYZj2xE,11217
-dissect_database-1.2.dev6.dist-info/licenses/COPYRIGHT,sha256=pFH-OBYz6Xj23UB0Odz5IhoTR8nsTbJQNlCRV_wMaiE,317
-dissect_database-1.2.dev6.dist-info/licenses/LICENSE,sha256=PhUqiw6jAh2KbBdVRPBq_hfAvfcTBin7nZ3CK7NQbTM,11341
-dissect_database-1.2.dev6.dist-info/METADATA,sha256=IlCHaoEzTcjjhsI2Y79YVO5BZr2NSAxfhVLgxMBkrzw,5540
-dissect_database-1.2.dev6.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
-dissect_database-1.2.dev6.dist-info/entry_points.txt,sha256=ZVVKj3Nzjkgm1kBXGWyGNVUJzTbmVgivv9lgFcuLkpk,343
-dissect_database-1.2.dev6.dist-info/top_level.txt,sha256=Mn-CQzEYsAbkxrUI0TnplHuXnGVKzxpDw_po_sXpvv4,8
-dissect_database-1.2.dev6.dist-info/RECORD,,
+dissect_database-1.2.dev7.dist-info/licenses/COPYRIGHT,sha256=pFH-OBYz6Xj23UB0Odz5IhoTR8nsTbJQNlCRV_wMaiE,317
+dissect_database-1.2.dev7.dist-info/licenses/LICENSE,sha256=PhUqiw6jAh2KbBdVRPBq_hfAvfcTBin7nZ3CK7NQbTM,11341
+dissect_database-1.2.dev7.dist-info/METADATA,sha256=sHAOCCznUzKRwrx21qX2wt81eYmUmZ7_E78gmdUTPJA,5540
+dissect_database-1.2.dev7.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
+dissect_database-1.2.dev7.dist-info/entry_points.txt,sha256=ZVVKj3Nzjkgm1kBXGWyGNVUJzTbmVgivv9lgFcuLkpk,343
+dissect_database-1.2.dev7.dist-info/top_level.txt,sha256=Mn-CQzEYsAbkxrUI0TnplHuXnGVKzxpDw_po_sXpvv4,8
+dissect_database-1.2.dev7.dist-info/RECORD,,