trustedsec / hate_crack

A tool for automating cracking methodologies through Hashcat from the TrustedSec team.
https://www.trustedsec.com
1.64k stars 259 forks source link

Support for recycling passwords that include a colon #6

Closed smidgedy closed 6 years ago

smidgedy commented 6 years ago

Hi,

I'm extremely not knowledgeable about things (and this is pretty trivial), but I notice on lines 125, 147, 252, and 269 it looks like the cut command is being used to extract passwords cracked by hashcat like:

hcatProcess = subprocess.Popen("cat %s.out | cut -d : -f 2 > %s.working" % (hcatHashFile, hcatHashFile),
                                   shell=True).wait()

Might be worth changing the -f 2 option to -f 2- so that passwords including a colon are captured.

Cheers!

bandrel commented 6 years ago

@smidgedy when hashcat outputs a password with a colon it will output the whole password in the format of $HEX[] which is the hex value of the ASCII character. This does bring up a good point in that the hex codes may need to be converted back to ASCII if you were going to feed them back into the system as a candidate. There is however an option you can add to the tuning section of the config that would make it so that the colons dont get converted to hex. --outfile-autohex-disable We will have to decide if it would make more sense to disable hex and change the cut as you suggest, or to add a function that does the converting after the cut. I'm leaning toward the later because there is less of a chance of getting partial passwords this way.

bandrel commented 6 years ago

this should be resolved with PR #7