Penetration Testing: Re: PWDUMP Parser

[Chris Brenton <cbrenton () chrisbrenton org>]

On Tue, 2004-07-06 at 12:00, Mike Anderson wrote:
> I have a rather large pwdump file (over 3000 accounts)
> that I am working with.  I need to extract
> approximately 200 user names/hash pairs from it. 
> Other than using notepad/word to do a find/search then
> copy and paste, does anyone know of a "pwdump parser"
> that is out there? I envision inputting a user name
> (or list of user names) and then having it return the
> user name and hash pair in a text file.
Grep is your friend. You can download a free copy for Windows from
multiple places on the net. Something like:

grep -i jsmith pwdump_output.txt >> parsed.txt

should do the trick. Then just run the command over and over replacing
the account name as appropriate. 

I'm not sure of the exact syntax on the Windows side, but on UNIX you
could automate this with a simple shell script. Create a file that has
one user account per line in a file, and assuming the file is named
user.lst, just do a:

while read USERS ; do
grep -i $USERS pwdump_output.txt >> parsed.txt
done < user.lst

HTH,
Chris