Simple script for converting SHA2 password hashes from Kentico CMS to password file for John the Ripper.

kentico2john.py

#!/usr/bin/env python

"""kentico2john.py Simple script for converting SHA2 password hashes from Kentico CMS to password file for John the Ripper.

See https://docs.kentico.com/k11/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/setting-the-user-password-format
TODO: add command line parameter for global salt

[List.Generic:dynamic_1505]
Expression=sha256($p.$s) (Kentico CMS SHA2SALT)
Flag=MGF_INPUT_32_BYTE
Flag=MGF_SALTED
Flag=MGF_FLAT_BUFFERS
Func=DynamicFunc__clean_input_kwik
Func=DynamicFunc__append_keys
Func=DynamicFunc__append_salt
Func=DynamicFunc__SHA256_crypt_input1_to_output1_FINAL
Test=$dynamic_1505$7a37b85c8918eac19a9089c0fa5a2ab4dce3f90528dcdeec108b23ddf3607b99$salt:password
Test=$dynamic_1505$05c706071053e527dfdb74a6ce66fc8136dd0220811e4e75ad42a7d19ba24ff5$HEX$7665726c6f6e6763726170707973616c74303132333435363738393031323334353637383930303132333435363738393030313233343536373839303031323334353637383930:verlongcrappypassword01234567890

"""
import binascii
import sys
import hashlib
from lxml import etree

def first(list, default=''):
    return list[0] if len(list)>0 else default

def process_file(filename):
    with open(filename, "r") as f:
        xml = etree.parse(f)
        for cms_user in xml.xpath('//cms_user'):
            if first(cms_user.xpath('UserPasswordFormat/text()')) != 'SHA2SALT':
                continue
            password_hash = first(cms_user.xpath('UserPassword/text()')).strip()
            if len(password_hash)==0:
                continue
            username = first(cms_user.xpath('UserName/text()'))
            password_salt = first(cms_user.xpath('UserGUID/text()'))            
            sys.stdout.write("%s:$dynamic_1505$%s$HEX$%s\n" % (username, password_hash, binascii.hexlify(password_salt)))

if __name__ == "__main__":
    if len(sys.argv) < 2:
        sys.stdout.write("Usage: %s <export file(s)>\n" % sys.argv[0])
        sys.exit(-1)

    for i in range(1, len(sys.argv)):
        process_file(sys.argv[i])