Secretsdump doesn't dump NTDS.DIT hashes

[gitgotgitgotit]

When using secretsdump on Goad-Mini (game of active directory) the NTDS.DIT hashes are not dumped. It works with impacket's secretsdump.
It does dump the SAM and LSA secrets.

[*] Stopping service RemoteRegistry
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
[*] Cleaning up...
                           

[psycep]

Confirmed reproducible against a GOAD sevenkingdoms.local DC on current main: [*] Using the DRSUAPI method... followed immediately by [*] Cleaning up..., zero hashes extracted.

Root cause is in pkg/dcerpc/drsuapi/getncchanges.go. The current parser is hand-rolled with empirical byte offsets rather than a real NDR struct driver, and several structures (UPTODATE_VECTOR_V1_EXT vs V2_EXT cursor size, PROPERTY_META_DATA_EXT_VECTOR header alignment, DSNAME conformant-varying string header) are misaligned in ways that interact. Individual fixes compensate for one slice of the drift but shift it elsewhere rather than eliminate it, so the right fix is a proper NDR struct-driven rewrite.

That rewrite is in progress on a separate branch. A partial fix that correctly recovers Administrator, krbtgt, and every named user exists locally (17 of ~22 accounts on GOAD Mini) but isn't landing as the solution to this issue. Will link the PR here when ready.

[psycep]

Fixed in #16, please reopen if you still see empty output after rebuilding from main.