hashcat-utils is a set of small utilities for advanced password cracking.
Each utility is provided as a separate stand-alone binary.
Each utility performs one specific function.
They all work with STDIN and STDOUT, so you can group them into chains.
hashcat-utils is released as open source software under the MIT license.
The current version is 1.10.
Some of the tools described below were dropped and are not in the 1.10 release. They are deskey_to_ntlm, export_potfile, remaining, req, seprule, tmesis, tmesis-dynamic and topmorph. Their sections are kept for reference and each has a notice at the top.
The programs are available for Linux and Windows on both 32-bit and 64-bit architectures, as well as .app binaries for 64-bit OSX/macOS. The project is released as MIT-licensed open source software.
hashcat-utils does not have a dedicated homepage, but this download link always has the latest release:
Each of them is described in detail in the following sections.
Tool used to generate .hccapx files from network capture files (.cap or .pcap). Those files feed -m 2500, which is deprecated: hashcat prints a notice asking you to use -m 22000 instead.
For WPA/WPA2 today, use hcxpcapngtool from hcxtools and -m 22000. See Cracking WPA/WPA2. cap2hccapx is documented here because it still ships and still converts old captures.
The additional options allow you to specify a network name (ESSID) to filter out unwanted networks and to give cap2hccapx a hint about the name of a network (ESSID) and MAC address of the access point (BSSID) if no beacon was captured.
Syntax:
$ ./cap2hccapx.bin usage: ./cap2hccapx.bin input.pcap output.hccapx [filter by essid] [additional network essid:bssid]
Strips rules from STDIN that are not compatible with a specified platform.
Syntax:
usage: ./cleanup-rules.bin mode
… where mode is 1 = CPU, 2 = GPU.
Example ('<' is a rules directive that only works with legacy CPU hashcat):
$ cat dirty.rules l <3 $ cleanup-rules 1 < dirty.rules l <3 $ cleanup-rules 2 < dirty.rules l $
Syntax:
$ ./combinator.bin usage: ./combinator.bin file1 file2
This program is a stand-alone implementation of the Combinator Attack.
Each word from file2 is appended to each word from file1 and then printed to STDOUT.
The program needs to rewind the files multiple times, so it requires real files and cannot work with STDIN.
Another option would be to store both files entirely in memory. Password cracking often uses huge files, so this would require too much memory.
$ cat two.list nes tor $ combinator two.list two.list nesnes nestor tornes tortor
See Combinator Attack for more examples.
Like combinator, but accepts three files as input, producing the combination of all three lists as output.
$ cat three.list nes tor $ combinator3 three.list three.list three.list nesnesnes nesnestor nestornes nestortor tornesnes tornestor tortornes tortortor
An expanded combinator tool that can combine up to eight elements, with custom separators between each element, and with session / restore support and other useful flags.
Note that combinatorX cannot use the same direct file on disk for more than two lists. This is due to how the files are read from disk at a low level. A workaround for this is to copy the lists to separate files.
Simple example:
$ cat list1.txt the quick $ cat list2.txt brown fox $ cat list3.txt jumped over $ combinatorX -1 list1.txt -2 list2.txt -3 list3.txt thebrownjumped thebrownover thefoxjumped thefoxover quickbrownjumped quickbrownover quickfoxjumped quickfoxover
Produces all “unique combinations” from a short list of inputs.
$ cat wordlist a b c XYZ 123 $ combipow wordlist a b ab c ac bc abc XYZ aXYZ bXYZ abXYZ cXYZ acXYZ bcXYZ abcXYZ 123 a123 b123 ab123 c123 ac123 bc123 abc123 XYZ123 aXYZ123 bXYZ123 abXYZ123 cXYZ123 acXYZ123 bcXYZ123 abcXYZ123
TBD
Syntax:
usage: ./ct3_to_ntlm.bin 8-byte-ct3-in-hex 8-byte-salt-in-hex [24-byte-ESS-in-hex]
There are two different versions for NetNTLMv1 - one with ESS, and one without.
If you don't have an ESS:
NETNTLM_bs_fmt_plug.c: {"$NETNTLM$1122334455667788$B2B2220790F40C88BCFF347C652F67A7C4A70D3BEBD70233", "cory21"},
You can use it like this:
./ct3_to_ntlm.bin C4A70D3BEBD70233 1122334455667788 51ad
If you have ESS:
./ct3_to_ntlm.bin 7D01513435B36DCA 1122334455667788 1FA1B9C4ED8E570200000000000000000000000000000000 34d5
Forum discussion here.
This program (new in hashcat-utils-0.6) cuts up a wordlist read from STDIN for use in a Combinator attack. If passwords in a dump tend to have a common padding length at the beginning or end, it can extract prefixes or suffixes of that length and pass them to STDOUT.
Syntax:
$ ./cutb.bin usage: ./cutb.bin offset [length] < infile > outfile
Example wordlist file:
$ cat wordlist apple1234 theman fastcars
Example positive offset and fixed length (first 4 characters):
$ ./cutb.bin 0 4 < wordlist appl them fast
Example positive offset, no length (returns remaining characters in string):
$ ./cutb.bin 4 < wordlist e1234 an cars
Example negative offset (last 4 characters in string):
$ ./cutb.bin -4 < wordlist 1234 eman cars
Example negative offset, fixed length:
$ ./cutb.bin -5 3 < wordlist e12 hem tca
Suggested uses:
Remember to run sort -u on the output before using it in an attack!
No longer shipped. deskey_to_ntlm was dropped from hashcat-utils and not in the 1.10 release. What follows is kept for reference.
TBD
Syntax:
usage: ./deskey_to_ntlm.pl 8-byte-key-in-hex
Forum announcement and discussion here.
This program has no parameters to configure.
Each word read from STDIN is split into individual characters, mutated, reconstructed and sent to STDOUT.
It generates patterns from the input word using the following operations:
Important: make sure you unique the output afterwards.
Example:
$ echo pass1 | ./expander.bin | sort -u 1 1p 1pas a as ass ass1 p pa pas pass s s1 s1p s1pa ss ss1 ss1p
This program is the heart of the Fingerprint Attack.
No longer shipped. export_potfile was dropped from hashcat-utils and not in the 1.10 release. What follows is kept for reference.
Attempt to extract plaintexts from potfile records containing mixed hash types. Operates on stdin. Assumes last colon-separated string is the plaintext and that any plaintexts containing colons are HEX-encoded.
Each wordlist going into STDIN is parsed and split into equal sections and then passed to STDOUT based on the amount you specify. The reason for splitting is to distribute the workload that gets generated.
For example, if you have an i7 CPU and a program that cannot use multiple cores, use gate to split your dictionary into smaller pieces. Then run multiple instances of that program.
Syntax:
$ ./gate.bin usage: ./gate.bin mod offset < infile > outfile
The two important parameters are “mod” and “offset”.
Here is an example input dictionary:
$ cat numbers 1 2 3 4 5 6 7 8 9 10 11 12 13 14
We want to split a dictionary into two equal dictionaries:
$ ./gate.bin 2 1 < numbers 2 4 6 8 10 12 14
$ ./gate.bin 2 0 < numbers 1 3 5 7 9 11 13
Stand-alone utility to generate random rules.
Usage: ./generate-rules.bin number [seed]
This command generates 10 random rules, using “42” as a seed:
./generate-rules.bin 10 42 $ $} z3 *61 t l o2* L2 *6B *98 D1 x0A f x32 s^L s[5 s'# swU }
A tool for generating .hcstat files for older hashcat versions' --markov-hcstat parameter and for statsprocessor.
NOTE: The output generated by hcstatgen is no longer supported by current hashcat and does not support longer passwords (up to length 256). Use hcstat2gen instead.
Syntax:
usage: ./hcstatgen.bin out.hcstat < infile
Each output file is 32.1 MB.
See also hcstat2gen.
A tool for generating custom Markov statistics, for use (after LZMA compression) with hashcat's --markov-hcstat (soon to be --markov-hcstat2) parameter.
hcstat2gen is like its predecessor hcstatgen, but updated in sync with hashcat 4.0 to support a maximum password length up to 256 (and also added a filetype header).
To conserve space, hashcat now expects hcstat2 files to be compressed as LZMA. If the file is not compressed, you will see a “Could not uncompress data” error.
Syntax:
usage: ./hcstat2gen.bin outfile < dictionary
Common usage example:
./hcstat2gen.bin hcstat2_output_raw.bin </path/to/dict.txt lzma --compress --format=raw --stdout -9e hcstat2_output_raw.bin > output.hcstat2
If your lzma does not support --stdout, try:
lzma --compress --format=raw hcstat2_output_raw.bin --suffix=hcstat2
Each raw outfile should be about 132MB in size (with variable size after compression).
Note that this newer format is not yet supported by statsprocessor.
See also hcstatgen.
Calculates keyspace in a hashcat-aware manner.
./keyspace.bin, keyspace utility for hashcat
Usage: ./keyspace.bin [options] mask
=======
Options
=======
-m, --hash-type=NUM Hash-type
--hex-charset Assume charset is given in hex
--markov-hcstat=FILE Specify hcstat file to use, default is hashcat.hcstat
-t, --markov-threshold=NUM Threshold for markov-chains
-1, --custom-charset1=CS User-defined charsets
-2, --custom-charset2=CS Examples:
-3, --custom-charset3=CS --custom-charset3=?dabcdef : sets charset ?3 to 0123456789abcdef
-4, --custom-charset4=CS --custom-charset4=?l?u : sets charset ?4 to all lower and upper case letters
-h, --help Print help
Each word going into STDIN is parsed for its length and passed to STDOUT if it matches a specified word-length range.
Syntax:
usage: ./len.bin min max < infile > outfile
Here is an example input dictionary:
$ cat dict 1 123 test pass hello world
We want only words with a length of 2, 3 or 4:
$ ./len.bin 2 4 < dict 123 test pass
Merges two lists.
Like rli2, the two lists must be sorted (in LC_ALL=C order).
Syntax:
Usage: ./mli2.bin infile mergefile
Example:
$ cat w1.txt 123 1234 999 aceofspades cards password veryfast $ cat w2.txt 123 1234 999 extra $ mli2 w1.txt w2.txt 123 1234 999 aceofspades cards extra password veryfast
If you use mli2 on unsorted lists, you will get unmerged results.
If you use mli2 on sorted lists containing duplicates, the results will be sorted but will still contain duplicates.
morph generates insertion rules for the most frequent character sequences in the dictionary you provide, separately for each position.
Syntax:
usage: ./morph.bin dictionary depth width pos_min pos_max
- Dictionary = Wordlist used for frequency analysis.
- Depth = Determines what “top” chains that you want. For example 10 would give you the top 10 (in fact, it seems to start with value 0 so that 10 would give the top 11).
- Width = Maximum length of the chain. With 3, for example, you get up to 3 rules per line for the most frequent 3-letter chains.
- pos_min = Minimum position for the generated insertion rule. For example, 5 means that the string is inserted only at position 5 or higher.
-pos_max = Maximum position for the generated insertion rule. For example, 10 means that the inserted string ends no later than position 10.
ngramX is a small utility that reads a text file, splits it into words, and generates n-grams of a given size. It preserves punctuation (only removing newline characters) and supports n-grams that continue across line boundaries.
Syntax:
Usage: ./ngramX <filename> <groupSize>
Let's assume we have this text to use for generating n-grams:
$ head alice_in_wonderland.txt TITLE: Alice's Adventures in Wonderland AUTHOR: Lewis Carroll
= CHAPTER I =
=( Down the Rabbit-Hole )=
Alice was beginning to get very tired of sitting by her sister
on the bank, and of having nothing to do: once or twice she had peeped into the book her sister was reading, but it had no
Example output:
$ ./ngramX.bin alice_in_wonderland.txt 3 | head TITLE: Alice's Adventures Alice's Adventures in Adventures in Wonderland in Wonderland AUTHOR: Wonderland AUTHOR: Lewis AUTHOR: Lewis Carroll Lewis Carroll = Carroll = CHAPTER = CHAPTER I CHAPTER I =
This program is a stand-alone implementation of the Permutation Attack.
It has no parameters to configure.
Each word going into STDIN is parsed and run through “The Countdown QuickPerm Algorithm” by Phillip Paul Fuchs (see: https://permuteweb.tchs.info)
See Permutation Attack for examples.
TBD
Syntax:
Usage: ./permute_exist.bin word < infile > outfile
This program optimizes dictionaries for the Permutation attack.
Due to the nature of the permutation algorithm itself, the input words “BCA” and “CAB” would produce exactly the same password candidates.
$ echo BCA | ./permute.bin BCA CBA ABC BAC CAB ACB $ echo CAB | ./permute.bin CAB ACB BCA CBA ABC BAC
To remove these duplicates, reorder each input word by the ASCII value of its characters:
Input:
Output: ABC
Input:
Output: ABC
Now we can safely sort -u afterwards:
$ wc -l rockyou.txt 14344391 rockyou.txt $ ./prepare.bin < rockyou.txt | sort -u > rockyou.txt.prep $ wc -l rockyou.txt.prep 9375751 rockyou.txt.prep
Removed 4968640 words (34.6%) that would produce duplicate candidates in a permutation attack.
No longer shipped. remaining was dropped from hashcat-utils and not in the 1.10 release. What follows is kept for reference.
Syntax:
use: ./remaining.pl wordlist_base.txt wordlist_search.txt
This program takes 2 wordlists:
This is likely to create duplicates. Use sort -u to remove them from the result.
Result is ideal for using in -a 1 combinator attack mode. You may want to do two attacks:
Example:
Content wordlist (base):
isajack3935 jackysch_5131 HBjackas5 mom1jackhopes
Content wordlist (search):
jack jacky
… produces candidates:
isa 3935 ysch_5131 HB as5 mom1 hopes sch_5131
No longer shipped. req was dropped from hashcat-utils. req-exclude and req-include, both described below, do this job now. What follows is kept for reference.
req has been replaced by req-include and req-exclude, below.
Like req-include, but it excludes words that match specific criteria.
Each word read from STDIN is passed to STDOUT if it matches the specified password group criteria.
Sometimes you know that a password must include a lowercase character, an uppercase character and a digit to meet a specific password policy.
Candidates that do not meet this policy cannot match the password, so they can be skipped.
This program is not very complex and it cannot fully match all the common password policy criteria, but it does provide a little help.
The following password groups are defined:
| Name | Item | Chars |
|---|---|---|
| LOWER | 1 | abcdefghijklmnoprstuvwxyz |
| UPPER | 2 | ABCDEFGHIJKLMNOPRSTUVWXYZ |
| DIGIT | 4 | 0123465789 |
| SYMBOL | 8 | 0x20 to 0x7e NOT IN lower, upper, digit |
| OTHER | 16 | All others, not matching the above |
To configure a password group, add the item numbers of the entries you want to include.
For example, to pass only words containing at least one lowercase character and at least one digit to STDOUT, look up “lower” (“1”) and “digit” (“4”) in the table. Add them to get “5”.
$ echo hello | ./req.bin 5 $ echo hello1 | ./req.bin 5 hello1 $ echo Hello1 | ./req.bin 5 Hello1
rli compares one file against one or more other files and removes duplicates:
rli usage: rli infile outfile removefiles...
Suppose we have two files, starting with w1.txt:
password 123 cards 999 aceofspades 1234 veryfast
And w2.txt:
123 999 1234
If we run the following command:
rli w1.txt OUT_FiLE.txt w2.txt
OUT_FiLE.txt will have:
password cards aceofspades veryfast
It also supports multiple files:
w3.txt has “password” in it, we run:
rli w1.txt OUT_FiLE.txt w2.txt w3.txt
OUT_FiLE.txt:
cards aceofspades veryfast
rli can remove duplicates from your dictionaries to produce a set of dictionaries with unique entries.
But the dictionary size cannot exceed host memory size. Read rli2 below for large files.
Unlike rli, rli2 has no size limit. It requires infile and removefile to be sorted (in LC_ALL=C order) with duplicates removed first. Otherwise, it will not work correctly.
For example using w1.txt and w2.txt files from above, if we run:
rli2 w1.txt w2.txt
This will output:
password 123 cards 999 aceofspades 1234 veryfast
No change. But if we sort and unique w1.txt and w2.txt as:
sort w1.txt > w1su.txt sort w2.txt > w2su.txt
And running:
rli2 w1su.txt w2su.txt
Will do it accurately:
aceofspades cards password veryfast
rli2 does not support multiple files. rli2 writes to STDOUT rather than a file. Redirect its output to save it in a file.
TBD
No longer shipped. seprule was dropped from hashcat-utils and not in the 1.10 release. What follows is kept for reference.
TBD
This program is designed to be a dictionary optimizer for the now-deprecated oclHashcat.
Note: this optimization is no longer needed by modern hashcat.
oclHashcat has a very specific way of loading dictionaries, unlike CPU hashcat. The best way to organize your dictionaries for use with oclHashcat is to sort each word in your dictionary by its length into specific files, into a specific directory, and then to run oclHashcat in directory mode.
Syntax:
$ ./splitlen.bin usage: ./splitlen.bin outdir < infile
All you need to do is to create a new directory, for example “ldicts”.
$ mkdir ldicts $ ./splitlen.bin ldicts < rockyou.txt
Results in:
$ ls -l ldicts/ total 129460 -rw-r--r-- 1 root root 90 Oct 12 15:54 01 -rw-r--r-- 1 root root 1005 Oct 12 15:54 02 -rw-r--r-- 1 root root 9844 Oct 12 15:54 03 -rw-r--r-- 1 root root 89495 Oct 12 15:54 04 -rw-r--r-- 1 root root 1555014 Oct 12 15:54 05 -rw-r--r-- 1 root root 13634586 Oct 12 15:54 06 -rw-r--r-- 1 root root 20050168 Oct 12 15:54 07 -rw-r--r-- 1 root root 26694333 Oct 12 15:54 08 -rw-r--r-- 1 root root 21910390 Oct 12 15:54 09 -rw-r--r-- 1 root root 22150645 Oct 12 15:54 10 -rw-r--r-- 1 root root 10392420 Oct 12 15:54 11 -rw-r--r-- 1 root root 7219550 Oct 12 15:54 12 -rw-r--r-- 1 root root 5098436 Oct 12 15:54 13 -rw-r--r-- 1 root root 3727905 Oct 12 15:54 14 -rw-r--r-- 1 root root 0 Oct 12 15:54 15
NOTE: splitlen overwrites the files in outdir rather than appending to them. Use an empty directory.
Strips all \0 bytes from stdin.
Strips all \r bytes from stdin.
No longer shipped. tmesis was dropped from hashcat-utils and not in the 1.10 release. What follows is kept for reference.
tmesis will take a wordlist and produce insertion rules that would insert each word of the wordlist to preset positions.
For example, the word 'password' will create insertion rules that would insert 'password' from position 0 to position F (15), and will mutate the string '123456' as follows:
password123456
1password23456
12password3456
123password456
1234password56
12345password6
123456password
Hints:
* Use tmesis to create rules to attack hashlists that came from the source. Run initial analysis on the cracked passwords, collect the top 10-20 words that appear on the passwords, and use tmesis to generate rules from them.
* Use tmesis generated rules in combination with best66.rule.
* tmesis does not handle multibyte unicode characters as single characters, but rather as individual bytes. This means that it can be used to insert multibyte characters as well.
No longer shipped. tmesis-dynamic was dropped from hashcat-utils and not in the 1.10 release. What follows is kept for reference.
Syntax:
Usage: ./tmesis-dynamic.pl substring wordlist1.txt wordlist2.txt
tmesis-dynamic takes 2 wordlists and produces a new one, using a user-defined substring as a “key”.
Each word of wordlist 1 which matches that user-defined substring substitutes that substring with each word of wordlist 2.
For example, these wordlists:
$ cat wordlist1.txt isajack3935 jackysch_5131 HBjackas5 mom1jackhopes
$ cat wordlist2.txt 123456 password jill hashcat
… produce the following candidates when supplied with the key “jack”:
$ ./tmesis-dynamic.pl jack wordlist1.txt wordlist2.txt isa1234563935 isapassword3935 isajill3935 isahashcat3935 123456ysch_5131 passwordysch_5131 jillysch_5131 hashcatysch_5131 HB123456as5 HBpasswordas5 HBjillas5 HBhashcatas5 mom1123456hopes mom1passwordhopes mom1jillhopes mom1hashcathopes
No longer shipped. topmorph was dropped from hashcat-utils and not in the 1.10 release. What follows is kept for reference.
TBD
Syntax:
Usage: ./topmorph.pl dictionary depth width pos_min pos_max
Some programs in hashcat-utils accept only a specific range of word lengths, as in the “len” example.
E.g. see splitlen.c:
#define LEN_MIN 1 #define LEN_MAX 64
You can change these limits and recompile hashcat-utils. Longer plaintext words are rarely needed in password cracking.