From 142ee4b245b8de862ce7ab27d7d81c8d7ee1ebc2 Mon Sep 17 00:00:00 2001 From: Justin Bollinger Date: Thu, 19 Mar 2026 15:29:59 -0400 Subject: [PATCH] fix: transparently decompress gzip wordlists for external tool attacks Add _open_wordlist() helper that returns gzip.open() or open() based on the .gz extension. Apply it to the three functions that open wordlist files themselves before piping to an external binary: - hcatPrince: prince base list fed to pp64.bin - hcatPermute: wordlist fed to permute.bin - hcatMarkovTrain: source file fed to hcstat2gen.bin Attacks that pass wordlist paths directly to hashcat are unaffected - hashcat already handles .gz natively. --- hate_crack/main.py | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/hate_crack/main.py b/hate_crack/main.py index cebc19c..3bc7ba7 100755 --- a/hate_crack/main.py +++ b/hate_crack/main.py @@ -23,7 +23,9 @@ import time import argparse import urllib.request import urllib.error +import gzip import lzma +import tempfile from types import SimpleNamespace #!/usr/bin/env python3 @@ -682,6 +684,13 @@ hcatProcess: subprocess.Popen[Any] | None = None debug_mode = False +def _open_wordlist(path): + """Open a wordlist file, transparently decompressing gzip if the path ends with .gz.""" + if path.endswith(".gz"): + return gzip.open(path, "rb") + return open(path, "rb") + + def _format_cmd(cmd): # Shell-style quoting to mirror what a user could run in a terminal. return " ".join(shlex.quote(str(part)) for part in cmd) @@ -2092,7 +2101,7 @@ def hcatMarkovTrain(source_file, hcatHashFile): return False try: - with open(source_file, "rb") as stdin_f: + with _open_wordlist(source_file) as stdin_f: hcatProcess = subprocess.Popen( [hcstat2gen_bin, hcstat2_path], stdin=stdin_f, stderr=subprocess.PIPE ) @@ -2210,7 +2219,7 @@ def hcatPrince(hcatHashType, hcatHashFile): hashcat_cmd.extend(shlex.split(hcatTuning)) _append_potfile_arg(hashcat_cmd) hashcat_cmd = _add_debug_mode_for_rules(hashcat_cmd) - with open(prince_base, "rb") as base: + with _open_wordlist(prince_base) as base: prince_proc = subprocess.Popen(prince_cmd, stdin=base, stdout=subprocess.PIPE) hcatProcess = subprocess.Popen(hashcat_cmd, stdin=prince_proc.stdout) prince_proc.stdout.close() @@ -2244,7 +2253,7 @@ def hcatPermute(hcatHashType, hcatHashFile, wordlist): ] hashcat_cmd.extend(shlex.split(hcatTuning)) _append_potfile_arg(hashcat_cmd) - with open(wordlist, "rb") as wl_file: + with _open_wordlist(wordlist) as wl_file: permute_proc = subprocess.Popen( [permute_path], stdin=wl_file, stdout=subprocess.PIPE )