Hashcat support?

[kaven130]

Is there a built in hashcat for cracking. Im using it on stryker vm. I was able to run it properly after some hours of digging, captured hs but i see noway to crack them

[xxcosita3czxx]

theres not hashcat yet, but you can download it and run it, the command is pretty simple: "hashcat -m 22000 "

[kaven130]

It will very helpful to include it like in wifite 2

[xxcosita3czxx]

according to source it is planned

[derv82]

@xxcosita3czxx is correct: The plan is to support shelling out to other crackers (hashcat, fallback to john/aircrack-ng).

This is blocked on the "Preferences" feature (not started yet) and the "Vault" feature.

Wifit3's Preferences would have options to specify:

• path to hashcat (if not on $PATH)
• hashcat CLI args (-w <profile>, -r <rule>, etc)
• path to wordlist(s)

So you would need to have a cracker installed on your system, and then configure wifit3 to automatically start cracking handshakes once they are captured.

[laxdog]

I have an MVP for the Vault stuff, still need a few tweaks before PR. Not sure if anyone has already started working on it. (https://github.com/laxdog/wifit3/tree/feat/vault-loot-manager)

I've also been doing a lot of hashcat stuff, but it's been completely separate from the tool, just on another box (mainly as I was testing bruteforce rather than just dicts). Definitely makes sense to land prefs and vault before starting this. That said, similar plugin system that I talked about for ET works here. Hashcat|JtR|NFS|SMB|Whatever.

So basically, take this file and hand it off to this other service. Obviously on top of that you'd have a hook that called said service every time you 'vaulted' one.

[derv82]

@laxdog I haven't started any work on the Vault yet.

I look a peek, looks good: Vault as its own screen is a good call; we'll need to use modals for things like file/dir selection, "checking" PSKs/PINs/etc on live APs, etc.

I hit a nasty wall when trying to design the Vault's cracker stuff, because it's not just "pick exe & run":

• The input format varies. FORMAT{.hc22000, .pcap} and within those AKM{PSK, FT, SAE, EAP}.
• The list of available tools varies, depending on the input (.hc22000 = hashcat only?, .pcap = JtR|aircrack|pyrit|.., EAP = hashcat only?, FT=hashcat only).
• The arguments to each tool varies (-m 22000 for PSK, -m 22001 for PMK, JtR uses different args, etc)
  • The arguments vary within each tool by version
• The output varies (hashcat's stdout, JtR's stdout, aircrack's stdout) -> necessary to support all of them if we want wifit3 to run these and extract the PSKs...
  • The output varies within each tool by version
• Sometimes / possibly multiple tools need to be called:
  • E.g. hcxpcapngtool ... output.hc22000 -> hashcat -m 22000 output.hc22000 (if wifit3 didn't already generate the .hc22000 files).

For the solution: I think I'm just scared of the word "plugin" lol.

We could have a Cracker(ABC) or Process(ABC) that holds a single tool's logic. E.g. a hashcat.py module:

• path(): Detects the location of hashcat on the machine ($PATH), or None if not found
  • Hashcat path could be configurable in Prefs.
• can_crack(file): Checks file type/extension, checks IE RSN ciphers (AKMs) in .pcaps, decides hashcat module to use, compares with modules list in hashcat, returns True or False if it's possible.
• crack(file): Launches hashcat with the appropriate -m <module> and path to pcap. Maybe even massages the file first to a temporary file (if needed) before launching hashcat.
  • Hashcat custom args could be configurable in Prefs. (like -O 4 or whatever the GPU-specific flags are)

The cracker ABCs could live in wifit3/crack/tools/, loaded from the dir without wiring, generic like a plugin:

from wifit3.crack.tools import *
if <tool>.exists() and <tool>.can_crack(file):
    result = <tool>.crack(file)

---

Oh, one other thing about the Vault & cracking:

I recently learned about a pwnagotchi custom plugin that uploads handshakes to wpa-sec.stanev.org (if you have a token): https://github.com/dadav/pwnagotchi-custom-plugins/blob/master/wpa-sec.py

Gemini sez:

The turnaround time for WPA-Sec is heavily bimodal: it is generally either under 30 minutes or never.

Which sounds promising, especially for mobile users. But I'll need to get the permission from the owners of the WPA-Sec site before including this in wifit3.

[laxdog]

Apologies for the radio silence recently, just had a few things going on. Will get back to this and the other PR soon.

[derv82]

Apologies for the radio silence recently, just had a few things going on. Will get back to this and the other PR soon.

No problem, take your time. In the meantime, I'll check out your fork locally, and look into merging something to master.

@laxdog I've taken your Vault implementation and tweaked some things (kind of what I imagined it would look like). It's in master now, using the same v keybinding. Thanks for getting this started!

[derv82]

Added hashcat support in https://github.com/derv82/wifit3/releases/tag/v0.3.3 - accessible from the "vault" drawer (press v to open the vault from any screen).

If there's any bugs, please create an issue.