From 375a359f4f9658a0b21876bfa45af005618ed531 Mon Sep 17 00:00:00 2001
From: Justin Bollinger <justin.bollinger@trustedsec.com>
Date: Thu, 30 Jan 2025 12:42:43 -0500
Subject: [PATCH] added logic for checking for format of username:hash

---
 hate_crack.py | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/hate_crack.py b/hate_crack.py
index bcf66ae..bcb9918 100755
--- a/hate_crack.py
+++ b/hate_crack.py
@@ -1308,7 +1308,7 @@ def main():
         lmHashesFound = False
         pwdump_format = False
         hcatHashFileLine = open(hcatHashFile, "r").readline()
-        if re.search(r"[a-z0-9A-Z]{32}:[a-z0-9A-Z]{32}:.*::", hcatHashFileLine):
+        if re.search(r"[a-f0-9A-F]{32}:[a-f0-9A-F]{32}:::", hcatHashFileLine):
             pwdump_format = True
             print("PWDUMP format detected...")
             print("Parsing NT hashes...")
@@ -1331,6 +1331,15 @@ def main():
             pwdump_format = False
             print("PWDUMP format was not detected...")
             print("Hash only detected")
+        elif re.search(r"^.+:[a-f0-9A-F]{32}$", hcatHashFileLine):
+            pwdump_format = False
+            print("PWDUMP format was not detected...")
+            print("username with Hash detected")
+            subprocess.Popen(
+                "cat {hash_file} | cut -d : -f 2 |sort -u > {hash_file}.nt".format(hash_file=hcatHashFile),
+                             shell=True).wait()
+            hcatHashFileOrig = hcatHashFile
+            hcatHashFile = hcatHashFile + ".nt"
         else:
             print("unknown format....does it have usernames?")
             exit(1)