keycloak_hash_formatter.py

#!/usr/bin/python3
import re
import sys

# Convert hashes from Keycloak DB format into something John can crack
#
# SELECT user_entity.username,credential.secret_data,credential.credential_data FROM user_entity,credential WHERE user_entity.id = credential.user_id;
#

with open(sys.argv[1]) as f:
    lines = f.readlines()
lines = [x.strip() for x in lines]

for line in lines:
    if 'additionalParameters' in line:
        user = line.split()[0]
        m = re.search('{"value":"([a-zA-Z0-9+/=]+)","salt":"([a-zA-Z0-9+/=]+)".*?"hashIterations":([0-9]+)', line)
        if m:
            hash = m.group(1)
            salt = m.group(2)
            iterations = m.group(3)

            # John uses a different base64 encoding with . instead of +, and no trailing =
            # Also truncates the hash to 43 base64 chars
            hash = hash.replace('+', '.').replace('=', '')[:43]
            salt = salt.replace('+', '.').replace('=', '')
            print(f'{user}:$pbkdf2-sha256${iterations}${salt}${hash}')