Skip to content

Instantly share code, notes, and snippets.

@psychsecurity
Forked from leonjza/convert.py
Created February 7, 2021 22:57
Show Gist options
  • Save psychsecurity/50a60b137ecd3dd79d1b1ed37f93fd84 to your computer and use it in GitHub Desktop.
Save psychsecurity/50a60b137ecd3dd79d1b1ed37f93fd84 to your computer and use it in GitHub Desktop.
Invoke-Kerberoast Output Converter
#!/usr/bin/python
# Invoke-Kerberoast output hash extractor.
#
# For when you have:
# TicketByteHexStream :
# Hash : $krb5tgs$23$*sqlSvc$Adomain.com$MSSQLSvc/sqlserver.Adomain.com:1433*$C13BFD40143C0E
# ....
# SamAccountName : sqlSvc
# DistinguishedName : CN=sqlSvc,OU=ServiceAccounts,DC=Adomain,DC=com
# ServicePrincipalName : MSSQLSvc/sqlserver.Adomain.com:1433
#
# But just want:
# $krb5tgs$23$*sqlSvc$Adomain.com$MSSQLSvc/sqlserver.Adomain.com:1433*$C13BFD40143C0E...
#
# 2018 @leonjza
import sys
if len(sys.argv) != 2:
print("Usage: " + sys.argv[0] + " hash_file")
sys.exit(1)
source = sys.argv[1]
start = "Hash :"
end = "SamAccountName :"
started = False
partial_hash = ""
hashes = []
with open(source, 'r') as f:
tickets = f.readlines()
for line in tickets:
if start in line:
started = True
if started and end not in line:
part = line.replace(start, '').replace(end, '').lstrip().rstrip()
partial_hash += part
if end in line:
started = False
hashes.append(partial_hash)
partial_hash = ""
for hash in hashes:
print(hash)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment