Parsing a pwdump file python
Question: I'm trying to parse a pwdump file in python. The content of a pwdump file
looks like this:

    
    
    ...[snip]
    
    Domain\TESTIN$::aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
    
    Guest(current):501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
    
    Guest(hist_01):501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
    
    Guest(hist_02):501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
    
    ...[snip]
    

I would like to get 2 things out of this:

    
    
    Domain\USER (So first string before the ":")
    

And the actual hash :

    
    
    "aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0"
    

I was thinking about something like this :

    
    
    import sys
    
    infile, outfile = sys.argv[1], sys.argv[2]
    
    with open(infile) as inf, open(outfile,"w") as outf:
        line_words = (line.split('::') for line in inf)
        outf.writelines(words[1].strip() + '\n' for words in line_words if len(words)>1)
    

But somehow I have only the first hash parsed.

Any help would be greatly appreciated !

Thanks


Answer: The problem is that you're splitting on `"::"`. Try splitting on `":"`
instead. Only the first line conforms to this format. Lines 2 and up have a
number between two `:`s, which mucks with your algorithm.

Try this instead (more verbose for readability):

    
    
    with open(infile) as inf, open(outfile,"w") as outf:
        for line in inf:
            splits = line.split(":")
            user, hash = splits[0], ":".join(splits[2:4])
            outf.write(hash + '\n')
    

Hope that helps

