我有一个实验室ntlm-extract.ntds
文件,其中包含以下格式的用户名和哈希值:
domain\username:integer:hash:hash2
例如:
somedomain.local\jcricket:5201:0020cfaecd41954fb9c9da8c61ccacd7:0020cfaecd41954fb9c9da8c61ccacd7
我正在将LINE[3]/hash2
列中的哈希值与NTLM HIBP 数据库,然后我想打印出匹配的用户名,但是不断domain\username
丢失\
我尝试的任何内容,并且我不确定是否在读取或写入时丢失了它。
到目前为止我的脚本是:
#!/usr/bin/bash
while read line
do
IFS=':' read -ra "LINE" <<< ${line}
HASH=${LINE[3]}
HASH=${HASH^^}
printf "Checking for %s\n" $HASH
found=(`grep "$HASH" "./pwned-passwords-ntlm-ordered-by-hash-v7.txt"`)
if [ -n $found ]; then
printf "Match on username %s\n" "${LINE[0]}"
fi
done < "ntlm-extract.ntds"
根据建议,最终的工作脚本如下:
#!/usr/bin/bash
numoflines=(`wc -l ntlm-extract.ntds`)
numcomp=0
while IFS= read -r line; do
IFS=: read -ra hashline <<< "${line}"
passhash="${hashline[3]}"
printf "Checking for %s\n" $passhash
printf "Line %d of %d\n" $numcomp $numoflines
numcomp=$((numcomp+1))
found=''
found=(`grep -m 1 -i "$passhash" "./pwned-passwords-ntlm-ordered-by-hash-v7.txt"`)
wait
if [ -z "$found" ]; then
continue
else
printf "found return value is %s\n" "$found"
printf "%s\n" "${hashline[0]}" >> ./hibp-busted.txt
fi
done < "ntlm-extract.ntds"
答案1
你需要的-r
是外在read
,而不仅仅是内在read -a
。您还应该引用"${line}"
并(可能)想要,IFS=
除非您明确想要删除前导空格:
while IFS= read -r line; do
IFS=: read -ra LINE <<< "${line}"; printf '%s\n' "${LINE[@]}"
done < ntlm-extract.ntds
somedomain.local\jcricket
5201
0020cfaecd41954fb9c9da8c61ccacd7
0020cfaecd41954fb9c9da8c61ccacd7
我还建议将变量名称更改LINE
为不全大写的名称。