Match cracked password with original username in file
#1
Here is the deal, I am cracking AD passwords and my original file is in this format
username:XXXXX:XXXXXXXXXXXXXX:ZZZZZZZZZZZZZ:::

I crack the passwords

and output to my pot file the format is

ZZZZZZZZZZZZZ:<crackedpassword>

Now what I usually need to do is go back and compare ZZZZZZZZZZZZZ to the ZZZZZZZZZZZZZ in the input file to find the username the password belongs to.

How can I automate this without trying to do it manually?

I attempted to use --show and --username but it just outputs a blank file...

Any help is appreciated.  Otherwise, I can obviously write something in PS or python to match them (even excel) but I am doing something wrong here, obviously.
Reply
#2
you need to specify hashmode (example md5) and outfileformat, oel.txt contains username:md5(öl)
BEWARE: if you use another potfile than hashcat.potfile you have to specify this too, option: --potfile-path

hashcat --show -m0 --username --outfile-format 2 oel.txt

output
username:öl
Reply
#3
Yeah, I did that.. im stumped.
hashcat -m 1000 --show --username --potfile-path filelocation.pot -o outputnew.txt --outfile-format 3 hashextract.ntds
Reply
#4
It is worth noting, my hashcat session is still running, i made copies of all the files i used and am trying to do it that way.... when i run hashcat on a seperate (no session) in another term it isn't referencing the other running session, is it?
Reply
#5
(07-05-2022, 05:43 PM)sqlallstar Wrote: It is worth noting, my hashcat session is still running, i made copies of all the files i used and am trying to do it that way.... when i run hashcat on a seperate (no session) in another term it isn't referencing the other running session, is it?

no it shouldnt, as far as i know --show is using show as session-name, so as long you didnt explicit told hahscat to use show as your runnung session-name everything should be fine
Reply
#6
(07-06-2022, 03:29 PM)Snoopy Wrote:
(07-05-2022, 05:43 PM)sqlallstar Wrote: It is worth noting, my hashcat session is still running, i made copies of all the files i used and am trying to do it that way.... when i run hashcat on a seperate (no session) in another term it isn't referencing the other running session, is it? io games

no it shouldnt, as far as i know --show is using show as session-name, so as long you didnt explicit told hahscat to use show as your runnung session-name everything should be fine
I am also facing the same problem, thanks for your helpful advice.
Reply