Parsing a Potfile

[Scriptmonkey_]

just open the file in a text editor? The format is just hash:plain.

Just did it on a Hashcat v4.2.1 I have locally:

Code:

> cat .hashcat/hashcat.potfile
d0763edaa9d9bd2a9516280e9044d885:monkey

left is the m5 hash to crack, right is the plain.

Unfortunately what you suggest isn't sufficient... As royce says below I'm trying to do this with a large text file collected over a long period of time. plus...

On Unixlikes, 'cut' can be used, with ':' as the separator - but depending on how old the potfile is, some passwords that contain ':' may be in there that are not HEX-encoded. So asking for all fields after the first field:

Code:

cut -d\: -f2- hashcat.potfile

... will get you the plains, and asking for just the first field:

Code:

cut -d\: -f1 hashcat.potfile

... will get you the hashes.

Unfortunately neither will cut do the job.

Mainly because the hash contains ':' in some cases.

E.g. NetNTLMv2 and v1 are the most common offenders in my list.

So cut -d":" -f2- nets me mostly hash with a plain appended to the end.

I'm having a bash at regexin'g out some hash types in python at the moment or at least that's how i'm going about it, was wondering if there was a tool I had missed in my googling.

Grabbing hashes out by type would be nice, but only a nicety. If a quicker "just plains" "just hashes" method existed I would be happy with that for now.

P.S. Thanks Royce for that perl script to decode the hex passwords! that was my next challenge so I appreciate the heads up