pkg ese

pkg/ese - ESE Database Parser

Parse Extensible Storage Engine databases, primarily for offline NTDS.dit analysis.

Functions

func Open(data []byte) (*Database, error)

Database Methods

func (db *Database) GetTable(name string) (*Table, error)

Table Methods

func (t *Table) OpenTable() error
func (t *Table) GetNextRecord() (*Record, error)
func (t *Table) Columns() []ColumnDef

Example: Read NTDS.dit

package main

import (
    "fmt"
    "os"
    "gopacket/pkg/ese"
)

func main() {
    data, _ := os.ReadFile("ntds.dit")
    db, err := ese.Open(data)
    if err != nil {
        fmt.Printf("[-] %v\n", err)
        return
    }

    table, _ := db.GetTable("datatable")
    table.OpenTable()

    for {
        record, err := table.GetNextRecord()
        if err != nil {
            break
        }
        // Extract ATTm590045 (sAMAccountName), ATTk589879 (ntHash), etc.
        _ = record
    }
}