Penetration Testing: Re: PWDUMP Parser

[H Carvey <keydet89 () yahoo com>]

In-Reply-To: <20040706160054.38308.qmail () web40907 mail yahoo com>

> Already did some googling on this subject to no avail,
> so I thought I would start here for an answer.
>
> I have a rather large pwdump file (over 3000 accounts)
> that I am working with.  I need to extract
> approximately 200 user names/hash pairs from it. 
> Other than using notepad/word to do a find/search then
> copy and paste, does anyone know of a "pwdump parser"
> that is out there? I envision inputting a user name
> (or list of user names) and then having it return the
> user name and hash pair in a text file.
A quick Perl script would do it for you...the below script takes a username as an arguement and dumps the username/hash 
pair to a file.

#! c:\perl\bin\perl.exe
use strict;
my $userfile = shift || die "You must enter a filename.\n";
my @users;
if (-e $userfile) {
  open(FH,$userfile) || die "Could not open $userfile: $!\n";
  while(<FH>) {
    chomp;
    push(@users,$_);
  }
  close(FH);
}
else {
  die "Could not find $userfile.\n";
}

# Now we have a list populated by usernames.

my $pwdumpfile = "path_to_pwdump_file";
my $outfile = "path_to_textfile";
my @hashlist;
open(FH,$pwdumpfile) || die "Could not open $pwdumpfile: $!\n";
foreach my $line (<FH>) {
  chomp $line;
  foreach my $user (@userlist) {
    push(@hashlist,$line) if ($line =~ m/^$user/i);
  }
}
close(FH);

# now, dump list of usernames/hashes to a file
open(FH,">>$outfile") || die "Could not open $outfile for writing: $!\n";
foreach (@hashlist) {
  print FH $_."\n";
}
close(FH);

HTH