I said on my recent post about cracking domain passwords with hashcat, that you could probably convert from JtR Format using Powershell. By JtR format, I mean username:uid:lm hash:ntlm hash on each line in a text file. Someone corrected me and stated that this is pwdump format. I learn new things every day. They also cleared up a misunderstanding about how the LM hashes work. Thanks again, loyal reader!
Update: Someone stated that there is a switch/flag to so that JtR/pwdump formatted hashes could be used in hashcat. Does anyone happen to know what that switch/flag is? I haven't had luck finding it.
I think that I've written a script that may convert JtR formatted files to hash cat lm or ntlm.
#The following hash means that the lm hash is blank. This occurs because the password is
#longer than 14 characters.
$blanklmhash = "aad3b435b51404eeaad3b435b51404ee"
#Create arrays to hold the lm hashes, ntlm hashes, and ntlm hashes with lm hashes.
$lmhashes = @()
$ntlmhashes = @()
$ntlmhasheswlm = @()
#Get the JtR formatted hashes from a text file.
$hasheslist = Get-Content hashes.txt
#For each JtR formatted hash in the hashes list, do the following
ForEach($JtRhash in $hasheslist){
#Split the JtRhash into an array of four pieces. Element [0] of the array is the username.
#Element[1] of the array is the uid. Element [2] of the array is the lm hash. Element [3] of
#the array is the ntlm hash.
$JtRhashArray = $JtRhash.split(':')
#if the LM hash is that blank hash in the hashes file, it means that LM is either disabled or
#the password is greater than 14 digits. LM can't handle more than 14 digits. So, add
#the LM hashes that are not that blank password to the $lmhashes array. Add their ntlm
#counterparts to the ntlmhasheswlm array. I'm doing this because the lm cracked
#passwords are uppercase because of how lm works. These lm hashes can be used as
#a dictionary/rules attack against their ntlm counterparts - making it faster to crack the
#ntlm passwords associated with them.
If (!($JtRhashArray[2] -eq $blanklmhash)){
$lmhashes += $JtRhashArray[0] + ":" + JtRhashArray[2]
$ntlmhasheswlm += $JtRhashArray[0] + ":" + JtRhashArray[3]
}
#otherwise, add the password to the $ntlmhashes array.
Else{
$ntlmhashes += $JtRhashArray[0] + ":" + JtRhashArray[3]
}
}
#output the lm hashes, ntlm hashes, and ntlm hashes with lm hashes to files.
$lmhashes | Out-File lmhashes.txt
$ntlmhashes | Out-File ntlmhashes.txt
$ntlmhasheswlm | Out-File ntlmhasheswlm.txt
No comments:
Post a Comment