$ show MichaelGrafnetter/DSInternals
DSInternals is a comprehensive .NET library and PowerShell module for Active Directory security auditing, forensic analysis, and offline/in-place manipulation of AD databases. It provides the ability to extract password hashes (NT, LM, Kerberos), decrypt DPAPI backup keys, recover LAPS and gMSA secrets, parse FIDO2/Windows Hello key credentials, and query DNS zones and signing keys. The library supports multiple access modes: offline via ESENT/ISAM (ntds.dit), online via RPC replication (DRSR), LDAP/ADSI, and SAM/LSA native APIs. The PowerShell module exposes over 50 cmdlets organized into logical groups (ADDB, ADRepl, ADSI, LSA, SAM, Hash, Encryption). The codebase is heavily oriented toward reverse-engineering of Microsoft's internal AD structures and protocols, with extensive unit tests using real-world binary vectors. While the primary use case is security auditing (e.g., penetration testing, incident response), the library also provides utilities for password quality testing, domain controller recovery, and offline account modifications. The architecture is modular, with clear separation between common data models, data store access, replication, and PowerShell cmdlets, making it a robust toolkit for Windows domain administrators and security professionals.
The LLM identified 5 files worth highlighting for reuse:
A self-contained RFC 4514 Distinguished Name parser that handles escaped characters, OID-based RDN attributes, and hex-encoded values. It is used throughout the codebase for DN parsing and can be extracted into any .NET project needing AD/LDAP DN manipulation without any internal dependencies.
A utility class that performs fast binary search on a sorted text file stream (e.g., HIBP password hash files). It reads lines efficiently by seeking to file positions, making it reusable for any sorted text file lookup scenario. Demonstrates non-obvious file I/O optimization without external dependencies.
A caching decorator for IKdsRootKeyResolver that implements positive and negative caching with configurable TTL and lazy preloading. It is a well-encapsulated pattern that can be extracted and reused for any resolver interface requiring caching, with thread-safe operations and minimal coupling.
A bidirectional map between compressed OID integers (ATTRTYP) and their string representations, used for AD schema attribute resolution. It is self-contained, fully tested, and can be reused in any project that needs to translate between OID bytes and human-readable names, especially in LDAP/AD contexts.
A custom IEqualityComparer<byte[]> for comparing hash blobs using constant-time comparison to prevent timing attacks. It is a small, isolated utility that demonstrates security-conscious design and can be dropped into any project requiring secure byte array equality checks.