Create markdown table for NTLM reuse from cme --sam sweep

ntlm-reuse.clj

#!/usr/bin/bb -i

(defn remove-colors
  [string]
  (clojure.string/replace string #"\x1b\[[0-9;]*m" ""))

(defn ntlm? [string]
  (re-find #"aad3b435b51404eeaad3b435b51404ee" string))

(defn blank-ntlm? [string]
  (re-find #"31d6cfe0d16ae931b73c59d7e0c089c0" string))

(defn split-fields
  [string]
  (clojure.string/split string #"\s+"))

(defn clean-input [lines]
  (->> lines
       (map remove-colors)
       (filter #(not (re-find #"\[*\]" %1)))
       (filter ntlm?)
       (filter #(not (blank-ntlm? %1)))))

(defn parse-ntlm [ntlm]
  (let [parts (clojure.string/split ntlm #":")]
    {:username (nth parts 0)
     :ntlm (clojure.string/join ":" [(nth parts 2) (nth parts 3)])
     }))

(defn extract-fields [fields]
  (into {:host (nth fields 3)} (parse-ntlm (nth fields 4))))

(defn parse-line [line]
  (-> line
      (remove-colors)
      (split-fields)
      (extract-fields)
      ))

(defn build-reuse [reuse fields]
  (let [username (keyword (:username fields))
        ntlm (keyword (:ntlm fields))]
    (assoc-in reuse [ntlm username] (conj (get-in reuse [ntlm username]) (:host fields)))))

(defn parse-input [lines]
  (->> lines
       (clean-input)
       (map parse-line)
       (reduce build-reuse {})))


(defn reuse->row [hashmap]
  (let [usernames (keys hashmap)]
    (reduce #(conj %1 [(name %2) (%2 hashmap)]) [] usernames)))

(defn reuse->rows [reuse]
  (let [hashes (keys reuse)]
    (reduce #(into %1 (reuse->row (%2 reuse))) [] hashes)))


(defn gen-md-table [reuse]
  (->> (str "|User|Hosts|\n|----|----|\n"
            (clojure.string/join "\n" (map #(str "|" (first %1) "|" (clojure.string/join "," (second %1)) "|") (->> (reuse->rows reuse)
                                                                                                               (filter #(< 1 (count (second %1))))))))))

(println (gen-md-table (parse-input *input*)))