Show all line information in cracked hashes

Show all line information in cracked hashes - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Show all line information in cracked hashes (/thread-11129.html)

Show all line information in cracked hashes - nameless - 11-18-2022

Hey,

so from an AD Dump, I've got the following information in a txt file, that I'm currently trying to crack with hashcat

Code:
domain\username:1476:SOMEHASH:SOMEHASH:Disabled=False,Expired=False,PasswordNeverExpires=True,PasswordNotRequired=False,PasswordLastChanged=200704041414,LastLogonTimestamp=201409080813,IsAdministrator=True,IsDomainAdmin=True,IsEnterpriseAdmin=False::

domain\anotherusername:1889:SOMEHASH:SOMEHASH:Disabled=True,Expired=False,PasswordNeverExpires=False,PasswordNotRequired=False,PasswordLastChanged=201908011129,LastLogonTimestamp=201805080659,IsAdministrator=False,IsDomainAdmin=False,IsEnterpriseAdmin=False::

For cracking, I use something like

Code:
hashcat -m 1000 pwdump.txt

Then, I figured, I can use

Code:
hashcat -m 1000 pwdump.txt --user --show 

to show the already cracked hashes, together with the username..

My question is: Is there any way to display the whole line in the cracked output? I'm mainly interesting in the "LastLogonTimestamp", so I can sort the output by that value to know the relevance of the cracked password (a user, which last logged in 2015 will have an expired password, so not of worth)..

Can I somehow do this? Ideally, I'd receive something like

Code:
domain\username:1476:SOMEHASH:SOMEHASH:Disabled=False,Expired=False,PasswordNeverExpires=True,PasswordNotRequired=False,PasswordLastChanged=200704041414,LastLogonTimestamp=201409080813,IsAdministrator=True,IsDomainAdmin=True,IsEnterpriseAdmin=False::MYCRACKEDPASSWORD

domain\anotherusername:1889:SOMEHASH:SOMEHASH:Disabled=True,Expired=False,PasswordNeverExpires=False,PasswordNotRequired=False,PasswordLastChanged=201908011129,LastLogonTimestamp=201805080659,IsAdministrator=False,IsDomainAdmin=False,IsEnterpriseAdmin=False::MYCRACKEDPASSWORD

RE: Show all line information in cracked hashes - marc1n - 11-18-2022

Select

-outfile-format=

- [ Outfile Formats ] -

# | Format
===+========
1 | hash[ Confused

RE: Show all line information in cracked hashes - nameless - 11-18-2022

(11-18-2022, 03:17 PM)marc1n Wrote: Select

-outfile-format=

- [ Outfile Formats ] -

# | Format
===+========
1 | hash[alt]
2 | plain
3 | hex_plain
4 | crack_pos
5 | timestamp absolute
6 | timestamp relative

How do I use this? Can I also use it with the --show option? Or do I have to run it while cracking?

I tried

Code:
hashcat -m 1000 pwdump.txt --show --user --outfile-format=2

but it looks the same as before..