{"id":21573693,"url":"https://github.com/syss-research/hashcathelper","last_synced_at":"2025-08-21T19:30:57.663Z","repository":{"id":43229842,"uuid":"508429626","full_name":"SySS-Research/hashcathelper","owner":"SySS-Research","description":"Convenience tool for hashcat ","archived":false,"fork":false,"pushed_at":"2023-11-17T15:44:20.000Z","size":1594,"stargazers_count":104,"open_issues_count":0,"forks_count":3,"subscribers_count":5,"default_branch":"main","last_synced_at":"2024-04-26T16:45:46.073Z","etag":null,"topics":["active-directory","cracking","hashcat","pentesting","reporting"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SySS-Research.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2022-06-28T19:29:07.000Z","updated_at":"2024-04-24T05:18:45.000Z","dependencies_parsed_at":"2023-11-17T17:01:41.073Z","dependency_job_id":null,"html_url":"https://github.com/SySS-Research/hashcathelper","commit_stats":null,"previous_names":[],"tags_count":7,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SySS-Research%2Fhashcathelper","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SySS-Research%2Fhashcathelper/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SySS-Research%2Fhashcathelper/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SySS-Research%2Fhashcathelper/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SySS-Research","download_url":"https://codeload.github.com/SySS-Research/hashcathelper/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":230527875,"owners_count":18240052,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["active-directory","cracking","hashcat","pentesting","reporting"],"created_at":"2024-11-24T12:07:44.266Z","updated_at":"2024-12-20T03:10:40.867Z","avatar_url":"https://github.com/SySS-Research.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"hashcathelper\n=============\n\nConvenience tool for hashcat.\n\nUsage\n-----\n\nRun `hashcathelper -h` for help. The program is structured in subcommands.\nSee `hashcathelper \u003csubcommand\u003e -h` for more information.\n\n### Subcommand \"ntlm\"\n\nFirst, it bruteforces all LM hashes and uses the results to crack the\ncorresponding NT hashes. Then, a large wordlist (recommendation:\n[Crackstation](https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm))\nis used together with a large ruleset (recommendation:\n[OneRule](https://notsosecure.com/one-rule-to-rule-them-all/)) to crack all\nremaining NT hashes. The list of account names is prepended to the wordlist,\nas hashcat does not automatically check if the account name is the password.\n\nThe pwdump format is the one which is used by\n[secretsdump](https://github.com/SecureAuthCorp/impacket/blob/master/impacket/examples/secretsdump.py)\nor Meterpreter's\n[hashdump](https://www.offensive-security.com/metasploit-unleashed/meterpreter-basics/)\nfunction.\n\nExample:\n\n```\n$ hashcathelper ntlm dc01.ntds\n```\n\n### Subcommand \"analytics\"\n\nOutput interesting statistics about the cracked passwords. It is meant to be\nused together with the output of the `ntlm` subcommand, but passwords which\nwere obtained elsewhere can be analyzed as well.\n\nIt takes the following files as an input:\n\n* Password hashes in the pwdump format\n* Cracked passwords with accounts (output of the `ntlm` subcommand)\n* Plain passwords\n\nAt least one of those is required. Ideally, you pass the hashes and the\noutput of the `ntlm` subcommand.\n\nBy default, computer accounts and accounts which are marked as `disabled`\nin the pwdump file (like `secretsdump -user-status` does) will be disregarded.\n\nAdditionally, you can pass the path to a file containing account names to be\nused as a filter. Only the accounts whose names are listed in this file will\nbe considered. This is useful if you are only interested in statistics\nregarding active accounts and did not use `secretsdump.py -user-status`, for\nexample. Or you want the statistics regarding all accounts with `admin` in\ntheir name. Or statistics regarding kerberoastable users.\n\nIn addition to a filter file, you can also pass a Cypher query (some are\npredefined) and the appropriate credentials to use information from a\nBloodHound database.\n\nExample:\n\n```\n$ hashcathelper analytics \\\n    -H dc01.ntds \\\n    -A dc01.ntds.out \\\n    -F kerberoastable_accounts.txt \\\n    -f text -o report.txt\n```\n\nThe report comes as text, HTML, XLSX, or in JSON. The different sections contain\ndifferent degrees of detail:\n\n* 1: Only show statistics\n* 2 (default): Show some password information such as top 10 lists\n* 3: Include full credentials of certain accounts, such as which accounts have blank passwords or clusters of accounts with the same passwords\n* 4: Include a full list of all credentials\n\n![Example analytics report in text format](doc/txt_report.png)\n\n\n### Subcommand \"db\"\n\nUse this subcommand to interact with the database.\nResults from the `analytics` subcommand can be submitted and collected in a\ndatabase. This enables us to view statistics for each entry, for example how\nthey compare to other customers. We can now make statements like this: 57%\nof all passwords could be cracked, which puts you in the bottom 20th\npercentile.\n\nUse `hashcathelper db submit \u003cfilename\u003e` to submit a result and `hashcathelper db\nstats \u003cid\u003e` to view statistics for one entry.\n\n### Subcommand \"bloodhound\"\n\nThis subcommand lets you insert new relationships into an existing\n[BloodHound](https://github.com/BloodHoundAD/BloodHound) database. It takes\na BloodHound URI, a report in JSON format (with degree of detail equal to\nthree or higher) and the domain name and creates edges between user objects\nthat share the same password. This enables you to create graphs like this,\nwhich immediately shows you offenders of password reuse among the\nadministrator team:\n\n![Bloodhound showing clusters of tiered accounts](doc/bloodhound_clusters.png)\n\nThis picture is the result of a query like this:\n\n```\nMATCH p=((a:User)-[r:SamePassword*1..2]-(b:User))\nWHERE ALL(x in r WHERE STARTNODE(x).objectid \u003e ENDNODE(x).objectid)\nAND ANY(c in [a,b] WHERE c.admincount OR c.name =~ '(?i)adm_.*')\nRETURN p\n```\n\nIt might need some manual modification depending on the particular naming\nscheme for admin accounts. See `customqueries.json` for more queries. You\ncan add these to `~/.config/bloodhound/customqueries.json`.\n\nNote that you can create reports with the `analytics` subcommand without\nhaving to actually crack anything; a JSON report can be created from just\nthe hashes, which already enables us to see password reuse.\n\nAlso, not all edges of a cluster are inserted, because the numbers of actual\nedges grows very quickly. Instead, one member of a cluster is chosen as the\n\"center\" and all other members have edges to this one member. So the\nproperty may not look transitive in BloodHound even though it is. Keep this\nin mind.\n\n### Subcommand \"autocrack\"\n\nTo be done; stay tuned.\n\n\nInstallation\n------------\n\nThe recommended way to install this package is to use `pipx` to pull it\nfrom PyPI:\n\n```\n$ pipx install hashcathelper\n```\n\nAs with any other proper Python package, `pip` and virtual environments can\nbe used as usual.\n\nNotes\n-----\n\n### Workflow\n\nThe typical workflow starts with using secretsdump on a domain controller:\n\n```\n$ secretsdump.py \u003cdomain\u003e/\u003cadmin\u003e:\u003cpassword\u003e@\u003cdc\u003e -user-status -just-dc-ntlm -outputfile hashes.txt\n```\n\nThis is passed to hashcathelper for cracking:\n\n```\n$ hashcathelper ntlm hashes.txt\n```\n\nNote that several files can be passed and cracked in parallel without it\ntaking longer.\n\nThen, reports can be generated:\n\n```\n$ hashcathelper analytics -H hashes.txt -A hashes.txt.out -f json -o hashes.json\n```\n\nIf secretsdump was run with `-user-status`, deactivated accounts are\nautomatically disregarded. Computer accounts (those that end on `$`) are\nalso disregarded. You can restrict analysis to a group of accounts by\npassing another file with `-F`. That file needs to contain one account name\nper line, without the UPN suffix (see below for more information).\n\nIn the last step, you can submit the report to the database:\n\n```\n$ hashcathelper db submit hashes.json\n```\n\nIf you have enough data, you can retrieve statistics about the data set:\n\n```\n$ hashcathelper db stats\nINFO - Connection to database: sqlite:////home/cracker/.local/share/hashcathelper/hch_db.sqlite\nThe database holds information about 94037 accounts in 16 entries.\nKey                                                Value    Mean    Std. Dev.    Perc.\n-----------------------------------------------  -------  ------  -----------  -------\nAccounts where password was cracked (%)            66.66   56.91        13.41       25\nAccounts with nonunique password (%)               46.11   23.09        11.78        0\nAccounts where username equals the password (%)     1.36    4.02        11.1        25\nAccounts with a non-empty LM hash (%)               3.19    8.42        16.76       50\nAccounts with an empty password (%)                 0       1.17         2.87       50\nLargest baseword cluster (%)                       45.2    10.22        10           0\nAverage length of cracked passwords                 8.39    9.58         0.84        6\n```\n\nThe last column shows the percentile. It should be read as \"this result is\nbetter than X% of all other results\", so higher is better. These values can\nbe visualized as radar chart using third-party tools:\n\n![Example radar chart](doc/radar.png)\n\n\n### UPN Suffix\n\nThe output from secretsdump contains lines that start with the account name. The\nformat looks like `\u003cdomain\u003e\\\u003caccount name\u003e`, however, that is not the\ndomain. It is the UPN suffix and can be entirely independent of the domain\nname -- it just coincides with the domain name by default. Especially after\nmigrating an account from domain A to domain B, the UPN suffix will not\nchange, but the domain name obviously will.\n\nHashcathelper ignores the UPN suffix pretty much everywhere. All accounts in\none file are assumed to belong to the same domain. And that is actually the\ncase if the file has been created by using secretsdump on a domain\ncontroller -- unless you used the `-use-vss` flag, then there is a chance\nyou might encounter duplicate entries.\n\n### Config\n\nThe config file (located at\n`${XDG_CONFIG_HOME:-$HOME/.config}/hashcathelper/hashcathelper.conf` or the CWD) should\nlook like this:\n\n```\n[DEFAULT]\n\n# Path to hashcat binary\nhashcat_bin = /home/cracker/hashcat/hashcat-latest\n\n# Path to hashcat rule set (OneRule is recommended)\nrule = /home/cracker/hashcat/rules/OneRule.rule\n\n# Path to hashcat wordlist (Crackstation is recommended)\nwordlist = /home/cracker/wordlists/crackstation.txt\n\n# URI to database\ndb_uri = sqlite:////home/cracker/.local/share/hashcathelper/stats.sqlite\n\n# Optional: Path to HIBP database\n# Must be a sorted list of NT hashes in upper case\n# Download here: https://haveibeenpwned.com/Passwords\nhibp_db = /home/cracker/wordlists/pwned-passwords-ntlm-ordered-by-hash-v8.txt\n```\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsyss-research%2Fhashcathelper","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsyss-research%2Fhashcathelper","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsyss-research%2Fhashcathelper/lists"}