ntdsextract2 0.10.0

Display contents of Active Directory database files (ntds.dit)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85

use std::{io::Cursor, fmt::Display};

use anyhow::{anyhow, ensure, Result};
use byteorder::{ReadBytesExt, BigEndian, LittleEndian};
use libesedb::Value;
use serde::Serialize;

use crate::esedb_utils::FromValue;

/// 
/// https://devblogs.microsoft.com/oldnewthing/20040315-00/?p=40253
#[derive(PartialEq)]
pub(crate) struct Sid {
  revision: u8,
  authority: u64,
  numbers: Vec<u32>,
}

impl Sid {
  pub fn get_rid(&self) -> &u32 {
    self.numbers.last().unwrap()
  }
}

impl TryFrom<&Vec<u8>> for Sid {
    type Error = anyhow::Error;

    fn try_from(val: &Vec<u8>) -> Result<Self, Self::Error> {
      let mut rdr = Cursor::new(val);
      let revision = rdr.read_u8()?;
      let number_of_dashes = rdr.read_u8()?;
      let authority = rdr.read_u48::<BigEndian>()?;

      //log::debug!("authority: {:012x}", authority);

      let mut numbers = vec![];
      for _i in 0..number_of_dashes - 1 {
          numbers.push(rdr.read_u32::<LittleEndian>()?);
      }
      numbers.push(rdr.read_u32::<BigEndian>()?);
      ensure!(! numbers.is_empty(), "invalid SID format");

      Ok(Self {
        revision,
        authority,
        numbers
      })
    }
}

impl Display for Sid {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
      let numbers = self.numbers
      .iter()
      .map(|n| format!("{n}"))
      .collect::<Vec<String>>()
      .join("-");

      let revision = &self.revision;
      let authority = &self.authority;
      write!(f, "S-{revision}-{authority}-{numbers}")
    }
}

impl FromValue for Sid {
  fn from_value_opt(value: &Value, attrib_name: &str) -> Result<Option<Sid>> {
      match value {
          Value::Binary(val) | Value::LargeBinary(val) => Ok(Some(Sid::try_from(val)?)),
          Value::Null(()) => Ok(None),
          _ => Err(anyhow!(
              "invalid value detected: {:?} in field {}",
              value,
              attrib_name
          )),
      }
  }
}

impl Serialize for Sid {
    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
    where
        S: serde::Serializer {
        serializer.serialize_str(&format!("{self}"))
    }
}