Thursday, February 22, 2018

Powershell: Convert JtR Formatted Text file to Hashcat LM or NTLM

I said on my recent post about cracking domain passwords with hashcat, that you could probably convert from JtR Format using Powershell.  By JtR format, I mean username:uid:lm hash:ntlm hash on each line in a text file.  Someone corrected me and stated that this is pwdump format.  I learn new things every day.  They also cleared up a misunderstanding about how the LM hashes work.  Thanks again, loyal reader!

Update:  Someone stated that there is a switch/flag to so that JtR/pwdump formatted hashes could be used in hashcat.  Does anyone happen to know what that switch/flag is?  I haven't had luck finding it.

I think that I've written a script that may convert JtR formatted files to hash cat lm or ntlm.

#The following hash means that the lm hash is blank.  This occurs because the password is 
#longer than 14 characters.
$blanklmhash = "aad3b435b51404eeaad3b435b51404ee"
#Create arrays to hold the lm hashes, ntlm hashes, and ntlm hashes with lm hashes.
$lmhashes = @()
$ntlmhashes = @()
$ntlmhasheswlm = @()
#Get the JtR formatted hashes from a text file.
$hasheslist = Get-Content hashes.txt

#For each JtR formatted hash in the hashes list, do the following

ForEach($JtRhash in $hasheslist){
    #Split the JtRhash into an array of four pieces.  Element [0] of the array is the username.  
    #Element[1] of the array is the uid.  Element [2] of the array is the lm hash.  Element [3] of 
    #the array is the ntlm hash.
    $JtRhashArray = $JtRhash.split(':')
    #if the LM hash is that blank hash in the hashes file, it means that LM is either disabled or
    #the password is greater than 14 digits.  LM can't handle more than 14 digits.  So, add 
    #the LM hashes that are not that blank password to the $lmhashes array.  Add their ntlm 
    #counterparts to the ntlmhasheswlm array.  I'm doing this because the lm cracked
    #passwords are uppercase because of how lm works.  These lm hashes can be used as
    #a dictionary/rules attack against their ntlm counterparts - making it faster to crack the
    #ntlm passwords associated with them.
    If (!($JtRhashArray[2] -eq $blanklmhash)){
        $lmhashes += $JtRhashArray[0] + ":" + JtRhashArray[2]
        $ntlmhasheswlm += $JtRhashArray[0] + ":" + JtRhashArray[3]
    }
    #otherwise, add the password to the $ntlmhashes array.
    Else{
        $ntlmhashes += $JtRhashArray[0] + ":" + JtRhashArray[3]
    }
}
#output the lm hashes, ntlm hashes, and ntlm hashes with lm hashes to files.
$lmhashes | Out-File lmhashes.txt
$ntlmhashes | Out-File ntlmhashes.txt
$ntlmhasheswlm | Out-File ntlmhasheswlm.txt

No comments:

Post a Comment