(08-28-2013, 03:59 PM)fuzztester Wrote: bob:$NETNTLM$a415001cd5900a32$632e803415162e36652263799f8e8a1c05a6bc4d0ecf5d72
I was just looking at this myself this morning. The hash just needs some flipping around:
perl -ne '/(.*?):\$.*?\$(.*?)\$(.*)/; print "$1::::$3:$2\n";'
I haven't tested this with users specified like DOMAIN\user yet. I'm not sure if the domain needs to be moved to the 3rd field or not but it works on the above test case.