#!/usr/bin/perl

# This script decodes Login Recovery "VERSION:04" password hash dumps into
# the PWDUMP format supported by John the Ripper and many other tools.
# Hacked together in 2009 by Solar Designer and placed in the public domain.

while (<>) {
	($name, $id, $o, $lm) = /^([^:]+):(\d+):([0-9A-F]{2})([0-9A-F,]*):/;
	next unless ($name && $id && $o);
	$_ = <>;
	($nt) = /^_([0-9A-F,]+,)XX:::/;
	next unless ($nt);
	$o = ord(pack("H2", $o));
	$lm =~ s/,(..)/unpack("H2", chr((ord(pack("H2", $1)) - $o) & 0xff))/eg;
	next unless (length($lm) == 32 || length($lm) == 0);
	$nt =~ s/(..),/unpack("H2", chr((ord(pack("H2", $1)) - $o) & 0xff))/eg;
	next unless (length($nt) == 32);
	print "$name:$id:$lm:$nt" . ":::\n";
}