NTLM Hashdump to hashcat/oclHashcat format converter
Hello everyone,

English class was quite boring today, so I decided to write a simple little script that I can actually use myself. Since *hashcat requires that you use either the NTLM hashes, or the username:hash with --username option, the script I made takes a hashdump (I used samdump2), and converts it to the username:hash format that *hashcat can use. I hope this is able to help someone besides myself (dumping a SAM hive with 50+ users, maybe?).

This script is quite simple, feel free to change it to fit your needs (I figured you would anyway). Written in Python3.


    Written by Jake Hemmerle
    Script takes a samdump2-like output format
    and converts it to a *hashcat usable format.

    Hope this helps!

import sys

if len(sys.argv) != 2:
    print("Usage: ntlm2hc.py infile")
    print("INFILE FORMAT")

infile = open(str(sys.argv[1]))

for line in infile:
    string = line.split(':')
    print(string[0] + ":" + string[3])

easier, no python requirement"

awk -F: '{print $1 ":" $4}' samdump2.txt

also, oclHashcat 1.20 will support pwdump format, etc.


Thanks for the info! I didn't know about the support in oclHashcat 1.20. I figured that you could easily do it with bash, but I am going to learn python at some point, and so I figured I would make this for practice.