title: Password to NTLM from dump file
body: <p>I am in security and want to consume a massive password dump file (3GB) as part of my usual password audits</p>
  
  <p>The file is delimited into two columns, SHA1, and the actual password</p>
  
  <p>For my purposes, because Windows stores password as NTLM hashes at rest (Kerberos only used during transport) I need passwords in NTLM, not SHA1. (You can easily prove it to yourself by doing a password dump, I use DSInternals)</p>
  
  <p>I am currently converting clear-text passwords to NTLM with this script</p>
  
  <pre><code>#Install-Module DSInternals
  Import-Module DSInternals
  
  $reader = [System.IO.File]::OpenText("C:\...\68_linkedin_found_hash_plain.txt")
  
  try {
      for() {
          $line = $reader.ReadLine()
          if ($line -eq $null) { break }        
          $pwd = ConvertTo-SecureString $line.Split(':')[1] -AsPlainText -Force
          $hash = ConvertTo-NTHash $pwd;
      Add-Content C:\...\68_linkedin_ntlm.txt $hash 
      }
  }
  finally {
      $reader.Close()
  }
  </code></pre>
  
  <p>Any obvious way of processing this faster? I suppose I can ingest into a DB and process it threaded via a little C# app but maybe there's something quick and dirty?</p>
  
  <p>The file format is (no these are not my passwords, these are passwords from a common password dump file that is publicly available) </p>
  
  <pre><code>8c9fcfbf9ead0d63d04b5d3120c42cb885af899e:16piret
  8c9fd045ee531744a4fdc1f52e59c3878e742ee0:louie310
  8c9fd070274a0eebecf58f8f50e283bf53cec215:kery62
  8c9fd08d1c17266f7c1e42a3f16a1161613c7572:sa81nt
  8c9fd1093bd8592bbaea195785f8d1c81589073f:cuchilleros
  8c9fd1a963bbf44ea9b531e91e5cb1b591c454cc:198962914685590
  8c9fd1d8cc6d4fa8164a2fcb3adc7a45f3409547:sculp1011
  8c9fd20540d66831f6f65a39ce1bca0e654fd5e6:ume1431965
  8c9fd2b4a9571db21c4226bf9ecaea282ecadd5e:534015629819772
  8c9fd2f3e63c20314cc962b624178ba82c6674a7:siegenthaler
  8c9fd3713fe9600d2bea05b4e8cd33efe12bddb1:mkenrick
  8c9fd3a39cca8fb8cdeeb52999aed7e6e9435fd3:billscot
  8c9fd3b96ee1485e0fd7d6c71ffe3efd2e8a4614:ndiyehova
  8c9fd43aef9804dab6e0aebc58415543175fea00:662566123
  8c9fd481cf8f35edb6ebd683fffb0efce0478f21:371874conv
  8c9fd4f37632294093fb057eb0168a05d9396e74:h3aww7w
  8c9fd53dce9b046f73c5f298e2f694213f8f90f1:squishy23
  8c9fd55206e0525d119f4946d3ae75e347cccb4b:NEH3112
  8c9fd555303ac08f9103ff8451f8c05cf48cf120:marco22580
  8c9fd5c6a94b1171518d0ba264033d779a075e8c:Nowornever2010
  8c9fd613fb632b5bc6ae20a671aa40decdb8609a:MKSmks1976##
  8c9fd627a48f9971df5bee874501156e9d3c011d:Steripro5
  </code></pre>
  
  <p>TIA</p>
  
  <p><strong>EDIT:
  By reading into memory and writing to separate files speed up the process a bit. Also used suggestion from TessellatingHeckler</strong></p>
  
  <pre><code>Import-Module DSInternals
  $lines = [System.IO.File]::ReadAllLines('C:\...\68_linkedin_found_hash_plain.txt')
  
  foreach($line in $lines) {
      try {
          $password = $line.Substring($line.IndexOf(':')+1);
          if ($password.Length -lt 128)
              {
              $pwd = ConvertTo-SecureString $line.Substring($line.IndexOf(':')+1) -AsPlainText -Force
              $hash = ConvertTo-NTHash $pwd;
              Set-Content C:\Temp\Hashes\$hash.txt $hash
              }
          }
      finally {
  
      }
  }
  </code></pre>
  
  <p>The afterwards I can combine the files with</p>
  
  <pre><code>copy *.txt combined.log
  </code></pre>