我如何拆分此哈希表搜索的结果？

Question

我正在尝试使用 this to compare my AD NT hashdump with https://haveibeenpwned.com/Passwords 哈希。我在将具有相同密码的多个用户名分组在一起时遇到问题。

代码：

  param(
        [Parameter(Mandatory = $true)]
        [System.IO.FileInfo] $ADNTHashes,

        [Parameter(Mandatory = $true)]
        [System.IO.FileInfo] $HashDictionary
    )
    #>

    process {
        $stopwatch = [System.Diagnostics.Stopwatch]::StartNew()

        #Declare and fill new hashtable with ADNThashes. Converts to upper case to 
        $htADNTHashes = @{} 
        Import-Csv -Delimiter ":" -Path $ADNTHashes -Header "User","Hash" | % {$htADNTHashes[$_.Hash.toUpper()] += @($_.User)}

        #Create empty output object
        $mrMatchedResults = @()

        #Create Filestream reader 
        $fsHashDictionary = New-Object IO.Filestream $HashDictionary,'Open','Read','Read'
        $frHashDictionary = New-Object System.IO.StreamReader($fsHashDictionary) 

        #Iterate through HashDictionary checking each hash against ADNTHashes
        while (($lineHashDictionary = $frHashDictionary.ReadLine()) -ne $null) {
            if($htADNTHashes.ContainsKey($lineHashDictionary.Split(":")[0].ToUpper())) {
                $foFoundObject = [PSCustomObject]@{
                    User = $htADNTHashes[$lineHashDictionary.Split(":")[0].ToUpper()]
                    Frequency = $lineHashDictionary.Split(":")[1]
                    Hash = $linehashDictionary.Split(":")[0].ToUpper()
                }
                $mrMatchedResults += $foFoundObject               
            }
        }
        $stopwatch.Stop()
        Write-Verbose "Function Match-ADHashes completed in $($stopwatch.Elapsed.TotalSeconds) Seconds"
    }

    end {
        $mrMatchedResults
    }
}

我尝试注释掉 | % {$htADNTHashes[$_.Hash.toUpper()] += @($_.User)}，这似乎很接近，但不知何故删除了“频率”列。

结果如下所示：

User                            Frequency Hash                            
----                            --------- ----                            
{TestUser2, TestUser3}          20129     H1H1H1H1H1H1H1H1H1H1H1H1H1H1H1H1
{TestUser1}                     1         H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2

我希望它们分开：

User                            Frequency Hash                            
----                            --------- ----                            
{TestUser2}                     20129     H1H1H1H1H1H1H1H1H1H1H1H1H1H1H1H1
{TestUser3}                     20129     H1H1H1H1H1H1H1H1H1H1H1H1H1H1H1H1
{TestUser1}                     1         H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2H2

我确定这是一个简单的更改，但我的 powershell 经验很少。

将 $FormatEnumerationLimit 更改为 -1 的建议也不是我想要的，它只是修复了列表截断问题。 {用户 1、用户 2、用户 3...}

Answer 1

while (($lineHashDictionary = $frHashDictionary.ReadLine()) -ne $null) {
            if($htADNTHashes.ContainsKey($lineHashDictionary.Split(":")[0].ToUpper())) {
                $Users = $htADNTHashes[$lineHashDictionary.Split(":")[0].ToUpper()]
                foreach($User in $Users){
                $foFoundObject = [PSCustomObject]@{
                    User = $User
                    Frequency = $lineHashDictionary.Split(":")[1]
                    Hash = $linehashDictionary.Split(":")[0].ToUpper()
                }
                $mrMatchedResults += $foFoundObject
                }
            }
        }

我如何拆分此哈希表搜索的结果？

How can i split up the results of this hashtable search?

powershell

hashtable