mirror of
https://github.com/trustedsec/hate_crack.git
synced 2026-07-28 22:51:14 -07:00
8db889c8d5
* fix: use sys.executable for PCFG/PRINCE-LING subprocesses
pcfg_guesser.py and prince_ling.py were launched via a bare "python3"
resolved from PATH, so they ran under whatever interpreter happened to
be first on PATH instead of the pinned 3.13 hate_crack itself runs
under. sys.executable always resolves to that interpreter, which also
makes the shutil.which("python3") presence check unnecessary.
Fixes #149
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix: match pcfgRuleset default casing to on-disk Rules/Default
pcfgRuleset defaulted to "DEFAULT" but pcfg_cracker ships Rules/Default
(capitalized, not all-caps). Case-insensitive filesystems (macOS)
masked the mismatch; on case-sensitive filesystems (most Linux) both
PCFG-based attacks failed out of the box.
Fixes #148
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix: keep PCFG/PRINCE-LING child stdin open to avoid silent truncation
hcatPCFG launched pcfg_guesser.py with no stdin=, so it inherited
hate_crack's own stdin. Whenever that stdin isn't a TTY (cron, CI,
detached runs, piped input), pcfg_guesser's keypress-listener thread
hit EOFError on its first input() call and the guesser shut itself
down after tens of thousands of candidates, silently ignoring
--limit/pcfgMaxCandidates. Passing stdin=subprocess.PIPE keeps the fd
open without writing to it, so input() blocks instead of raising.
prince_ling.py comes from the same upstream project and shares the
keypress thread, so hcatPrinceLing gets the same treatment.
Fixes #146
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* style: apply ruff format to hcatPCFG Popen call
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix: catch OSError loading config.json.example defaults
The config.json.example defaults load only caught JSONDecodeError, so
a missing or unreadable file (e.g. a dangling symlink surviving a
git-archive tarball, docker COPY, or partial /opt/hate_crack install)
escaped as an uncaught FileNotFoundError instead of the "package
installation issue" message already written for exactly this case.
Extracted the load into _load_config_defaults() so the failure paths
are unit-testable, and added a dangling-symlink-specific message.
Fixes #155
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* style: apply ruff format to _load_config_defaults
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix: replace brittle config.json.example test guards
test_packaged_example_is_symlink_to_root asserted symlink-ness, an
implementation detail that setuptools dereferences in every built
wheel/sdist — the test only ever passed in the source tree.
test_packaged_and_root_examples_have_identical_content compared the
same inode to itself there, making it a tautology. Neither would catch
real drift in a distributed artifact. Replaced both with an explicit
expected-key-set assertion (the substantive invariant #150 needed) and
a content-parity check that's only exercised outside the source tree.
Fixes #154
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix: share config.json.example defaults between api.py and main.py
api.py's get_hcat_wordlists_dir/get_rules_dir/get_hcat_tuning_args/
get_hcat_potfile_path read config.json directly and fell back to their
own hardcoded, cwd-relative defaults for any key absent from disk.
main.py merges config.json.example into config_parser in memory (since
af46f59 stopped backfilling it to disk), so any key missing from a
user's config.json now resolves differently depending on which module
resolved it — e.g. rules_directory: <hate_path>/hashcat/rules in
main.py vs <cwd>/rules in api.py, silently creating an empty directory
under whatever directory the user launched from.
Added _load_config_defaults()/_load_merged_config() in api.py so both
modules perform the same config.json.example-then-config.json merge.
Fixes #153
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix: revert inert hcatPrinceLing stdin=PIPE change
prince_ling.py never imports lib_guesser.cracking_session (the only
file with input()/a keypress thread) and never reads stdin, so there
was nothing for stdin=PIPE to fix there. Worse, subprocess.run(...,
stdin=subprocess.PIPE) with no input= argument closes the pipe
immediately via communicate(None), so the change was inert regardless.
The hcatPCFG side of #146 (Popen with stdin=PIPE, which correctly
keeps the write end open) is unaffected and remains the actual fix.
* fix: resolve pcfgRuleset case-insensitively against Rules/ on disk
Users with a config.json predating this stack's default-casing fix
have "DEFAULT" backfilled to disk (hate_crack used to write missing
keys to disk; see af46f59). For them, the new "Default" default in
config.json.example is never consulted, so Rules/DEFAULT still
doesn't resolve on case-sensitive filesystems and both PCFG attacks
stay broken. Resolve the configured ruleset name case-insensitively
against whatever casing actually exists under pcfg_cracker/Rules/, so
both a stale "DEFAULT" on disk and a user typo like "default" resolve
to the real Rules/Default directory.
* fix: resolve relative hcatPotfilePath against hate_path, not config dir
get_hcat_potfile_path resolved a relative hcatPotfilePath against the
config.json's own directory, while main.py resolves it against
hate_path unconditionally. These only agreed when config.json lived
at hate_path — they diverged for the ~/.hate_crack candidate root,
which is a first-class supported config location. This was the exact
divergence class #153 set out to eliminate, left inside the function
meant to fix it.
* fix: use resolved ruleset basename for prince_ling argv and cache path
hcatPrinceLing's ruleset existence check was fixed to resolve
pcfgRuleset case-insensitively against Rules/ on disk, but the
subprocess argv passed to prince_ling.py and the cache filename both
still used the raw, unresolved value. prince_ling.py does its own
(case-sensitive) Rules/ lookup internally, so a legacy "DEFAULT"
config would pass hate_crack's precheck and then fail inside
prince_ling.py itself with a confusing "generation failed" message.
Use the resolved basename in both places, matching what hcatPCFG
already does for its --rule argument.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
56 lines
2.5 KiB
JSON
56 lines
2.5 KiB
JSON
{
|
|
"hcatPath": "/path/to/hashcat",
|
|
"hcatBin": "hashcat",
|
|
"hcatTuning": "",
|
|
"hcatPotfilePath": "~/.hashcat/hashcat.potfile",
|
|
"hcatDebugLogPath": "./hashcat_debug",
|
|
"hcatWordlists": "./wordlists",
|
|
"hcatOptimizedWordlists": "./optimized_wordlists",
|
|
"rules_directory": "./hashcat/rules",
|
|
"hcatDictionaryWordlist": ["rockyou.txt"],
|
|
"hcatCombinationWordlist": ["rockyou.txt","rockyou.txt"],
|
|
"hcatCombinator3Wordlist": ["rockyou.txt","rockyou.txt","rockyou.txt"],
|
|
"hcatCombinatorXWordlist": ["rockyou.txt","rockyou.txt"],
|
|
"hcatHybridlist": ["rockyou.txt"],
|
|
"hcatMiddleCombinatorMasks": ["2","4"," ","-","_","+",",",".","&"],
|
|
"hcatMiddleBaseList": "rockyou.txt",
|
|
"hcatThoroughCombinatorMasks": ["0","1","2","3","4","5","6","7","8","9"," ","-","_","+",",","!","#","$","\"","%","&","'","(",")","*",".","/",":",";","<","=",">","?","@","[","\\","]","^","`","{","|","}","~"],
|
|
"hcatThoroughBaseList": "rockyou.txt",
|
|
"hcatGoodMeasureBaseList": "rockyou.txt",
|
|
"hcatPrinceBaseList": "rockyou.txt",
|
|
"pipalPath": "/path/to/pipal",
|
|
"pipal_count" : 10,
|
|
"bandrelmaxruntime": 300,
|
|
"bandrel_common_basedwords": "welcome,password,p@ssword,p@$$word,changeme,letmein,summer,winter,spring,springtime,fall,autumn,monday,tuesday,wednesday,thursday,friday,saturday,sunday,january,february,march,april,may,june,july,august,september,october,november,december,christmas,easter,covid19",
|
|
"hashview_url": "http://localhost:8443",
|
|
"hashview_api_key": "",
|
|
"hashmob_api_key": "",
|
|
"ollamaModel": "qwen2.5:32b",
|
|
"ollamaNumCtx": 2048,
|
|
"ollamaTimeout": 300,
|
|
"ollamaMaxSampleLines": 500,
|
|
"ollamaAutoResearch": true,
|
|
"omenTrainingList": "rockyou.txt",
|
|
"omenMaxCandidates": 100000000,
|
|
"pcfgRuleset": "Default",
|
|
"pcfgMaxCandidates": 50000000,
|
|
"pcfgPrinceLingMaxCandidates": 10000000,
|
|
"check_for_updates": true,
|
|
"optimizedKernelAttacks": [
|
|
"hcatDictionary", "hcatQuickDictionary", "hcatBandrel", "hcatGoodMeasure",
|
|
"hcatRecycle", "hcatBruteForce", "hcatTopMask", "hcatPathwellBruteForce",
|
|
"hcatAdHocMask", "hcatMarkovBruteForce", "hcatFingerprint", "hcatCombination",
|
|
"hcatCombinator3", "hcatCombinatorX", "hcatHybrid", "hcatYoloCombination",
|
|
"hcatMiddleCombinator", "hcatThoroughCombinator", "hcatCombipow", "hcatPrince",
|
|
"hcatPermute", "hcatPCFG", "hcatPrinceLing"
|
|
],
|
|
"notify_enabled": false,
|
|
"notify_pushover_token": "",
|
|
"notify_pushover_user": "",
|
|
"notify_per_crack_enabled": false,
|
|
"notify_attack_allowlist": [],
|
|
"notify_suppress_in_orchestrators": true,
|
|
"notify_max_cracks_per_burst": 5,
|
|
"notify_poll_interval_seconds": 5.0
|
|
}
|