Final version

modules/post/windows/gather/ntds_location.rb

@@ -29,8 +29,23 @@ class Metasploit3 < Msf::Post
   end
 
   def run
-    working_dir = registry_getvaldata("HKLM\\SYSTEM\\CurrentControlSet\\services\\NTDS\\Parameters","DSA Working Directory").to_s
-    
+    # Find the NTDS.DIT location in the registry
+    ntds = registry_getvaldata("HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters","DSA Database file").to_s 
+    if !ntds
+        print_error("Unable to find the NTDS.DIT location.")
+        return
+    end
+
+    if file?(ntds)
+        f = client.fs.file.stat(ntds)
+        print_line("NTDS.DIT is located at: #{ntds}")
+        print_line("      Size: #{f.size} bytes") 
+        print_line("   Created: #{f.ctime}") 
+        print_line("  Modified: #{f.mtime}") 
+        print_line("  Accessed: #{f.atime}") 
+    else
+        print_error("NTDS.DIT is reportedly located at '#{ntds}' but the file does not appear to exist")
+    end
   end
 
 end