averroes / ptscripts Goto Github PK

What will reproduce the problem?
1. Run dshashes with datatable, linkable and system have to extract password 
hashes 

What is the expected output? What do you see instead?
Expected to run and print hashes. 
Exception raised. dsInitDatabase and dsInitLinks require 2 arguments in the 
latest version of ntdsxtract (dsESEFile and workdir). 

What version of the product are you using? On what operating system?
Ntdsxtract v1.2beta
Raspbian 

Please provide any additional information below.
Quick fix that worked for me:
db = dsInitDatabase(sys.argv[1], ".")
dl = dsInitLinks(sys.argv[2], ".")

What steps will reproduce the problem?
1. Use vssadmin to get a particular VSC id. Note that the id uses lower-case 
letters.
2. Pass that id to vssown.vbs /delete as the id argument. Notice that 
vssown.vbs does not try to delete the snapshot.


What is the expected output? What do you see instead?
The expected behavior is that vssown.vbs attempts to delete the shadow copy. 
Instead it does nothing.


What version of the product are you using? On what operating system?
The trunk release on code.google.com

Please provide any additional information below.

Here's the original code in the "delete" section:
  Case "/delete"
    id = args.Item(1)
    Set colItems = objWMIService.ExecQuery("Select * From Win32_ShadowCopy")
    For Each objItem in colItems
      if objItem.ID = id Then
        Wscript.Echo "[*] Attempting to delete shadow copy with ID: " & id
        errResult = objItem.Delete_
      ElseIf id = "*" Then
        Wscript.Echo "[*] Attempting to delete shadow copy " & objItem.DeviceObject & "."
        errResult = objItem.Delete_
      End If
    Next
    wscript.Quit(errResult)


Here's my patched version:
  Case "/delete"
    id = UCase(args.Item(1))
    Set colItems = objWMIService.ExecQuery("Select * From Win32_ShadowCopy")
    For Each objItem in colItems
        if UCase(objItem.ID) = id Then
        Wscript.Echo "[*] Attempting to delete shadow copy with ID: " & id
        errResult = objItem.Delete_
      ElseIf id = "*" Then
        Wscript.Echo "[*] Attempting to delete shadow copy " & objItem.DeviceObject & "."
        errResult = objItem.Delete_
      End If
    Next
    wscript.Quit(errResult)