Invoke-Kerberoast Output Converter

convert.py

#!/usr/bin/python

# Invoke-Kerberoast output hash extractor.
#
# For when you have:
#    TicketByteHexStream  :
#    Hash                 : $krb5tgs$23$*sqlSvc$Adomain.com$MSSQLSvc/sqlserver.Adomain.com:1433*$C13BFD40143C0E
#                           ....
#    SamAccountName       : sqlSvc
#    DistinguishedName    : CN=sqlSvc,OU=ServiceAccounts,DC=Adomain,DC=com
#    ServicePrincipalName : MSSQLSvc/sqlserver.Adomain.com:1433
#
# But just want:
#    $krb5tgs$23$*sqlSvc$Adomain.com$MSSQLSvc/sqlserver.Adomain.com:1433*$C13BFD40143C0E...
#
# 2018 @leonjza

import sys

if len(sys.argv) != 2:
    print("Usage: " + sys.argv[0] + " hash_file")
    sys.exit(1)

source = sys.argv[1]
start = "Hash                 :"
end = "SamAccountName       :"

started = False
partial_hash = ""
hashes = []

with open(source, 'r') as f:
    tickets = f.readlines()

for line in tickets:

    if start in line:
        started = True
   
    if started and end not in line:
        part = line.replace(start, '').replace(end, '').lstrip().rstrip()
        partial_hash += part

    if end in line:
        started = False
        hashes.append(partial_hash)
        partial_hash = ""

for hash in hashes:
    print(hash)