Databases
StackOverflow2013
Postsdbo
POImplement a Data Structure to Compare NTLM Hashfiles
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POImplement a Data Structure to Compare NTLM Hashfiles
    primarykey
    data
    text
    <p>Currently I'm in the process of simplifying a process for extracting Windows password hashes in security audits. Personally I want to make the process easier to generate a list of recovered users and their passwords when I do an audit. I think it would also be useful for other people who are trying to compare and generate large amounts of data.</p> <p>So here's the gist: </p> <p>When I extract all of the data from the Windows system files, I simplify them down to the format user:hash, where the hash is an NTLM hash such as "a87f3a357d73085c45f9416be5787e86."</p> <p>I then will use oclHashcat and attempt to crack the hashes, whether it be dictionary or brute-force, it doesn't matter. I generate an output of all of the recovered hashes, however Hashcat generates them in the format hash:password. </p> <p>Now here's my problem and what I would like some input on - I want to produce the output as user:password given the two input files. Considering that I can have hundreds of hashes yet only a few recovered passwords, there is no use of trying to order the lists.</p> <p>I am unsure which data structure might benefit me the most. Arrays were too inefficient for large tables. I've looked into serialization and I've been exploring the use of Hash Maps and Hash Tables. Given the size of the hash, I haven't had any luck implementing either of these methods, or I'm doing so incorrectly.</p> <p>Currently I'm running the program like so:</p> <pre><code>program [user:hash file] [hash:password file] -o [user:password output] </code></pre> <p>And I'm effectively trying to run the program like so (briefly):</p> <pre><code>Load Files // user:hash file For each line, split by ':' delimiter before delimiter = table1.user after delimiter = table1.hash // hash:password file For each line, split by ':' delimiter before delimiter = table2.hash after delimiter = table2.password // generate user:password file Check each entry of table1 vs table2 if table1.hash = table2.hash table1.user = output.user table2.password = output.password print to output "output.user:output.password" </code></pre> <p>I am only trying to figure out an efficient method for tracing through each line and extracting the necessary data into a data structure that I can easily trace through. </p> <p>If I need to clarify anything, please let me know. Any help is appreciated!</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USSignus
    1. USSignus
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. COCould you give more detail on the problems you have been having with hashes? Also, why are you implementing your hashes rather than using the ones in the stl?
      singulars
      1. POImplement a Data Structure to Compare NTLM Hashfiles
      1. USRonaldBarzell
    2. COWell I think I was implementing them incorrectly to begin with. But then I started to wonder if there were any other better ways of storing that data. The reason I use my hashes is because they are an output from Hashcat and other software, and I need those for comparison.
      singulars
      1. POImplement a Data Structure to Compare NTLM Hashfiles
      1. USSignus
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload