Penetration Testing: Re: PWDUMP Parser

["J. Theriault" <administrator () maginetworks com>]

Mike Anderson wrote:
> Already did some googling on this subject to no avail,
> so I thought I would start here for an answer.
>
> I have a rather large pwdump file (over 3000 accounts)
> that I am working with.  I need to extract
> approximately 200 user names/hash pairs from it. 
> Other than using notepad/word to do a find/search then
> copy and paste, does anyone know of a "pwdump parser"
> that is out there? I envision inputting a user name
> (or list of user names) and then having it return the
> user name and hash pair in a text file.
>
> Thanks..
>
> =====
> Mike Anderson
> mike_and () yahoo com

Hello, Mike;

If you have cygwin or a *NIX system available:
"grep (username) (filename)"

Or, to make it easier;
Create a file containing the following one line and put it in the same 
directory as a copy of the pwdump file you want to search through:
grep $1 <pwdump filename> >> output.txt

Save it, make it executable (with "chmod 700 <filename>"), and run it 
with the username. It will search for the line with that username and 
hash and add it to a new line of the output file.
(assuming it's saved as "example" and username we want is anything 
starting with "1")
[Administrator () belthaserv:~]
$ ./example 1
[Administrator () belthaserv:~]
$ cat output.txt
123
12
1
[Administrator () belthaserv:~]
$ ./example 1
[Administrator () belthaserv:~]
$ cat output.txt
123
12
1
123
12
1

Hope that helps,



J. Theriault
administrator () maginetworks com