Git Product home page Git Product logo

hashtopolis / server Goto Github PK

View Code? Open in Web Editor NEW
1.4K 66.0 211.0 28.11 MB

Hashtopolis - distributed password cracking with Hashcat

License: GNU General Public License v3.0

PHP 74.29% JavaScript 2.81% CSS 0.05% HTML 17.75% Shell 0.38% TeX 0.04% Dockerfile 0.28% Python 4.41%
cracking distributed hashcat pentesting passwords hashtopussy hashlist password-recovery password-recovery-tool password

server's Introduction

Hashtopolis

Hashtopolis

CodeFactor LoC Hashtopolis Build

Hashtopolis is a multi-platform client-server tool for distributing hashcat tasks to multiple computers. The main goals for Hashtopolis's development are portability, robustness, multi-user support, and multiple groups management. The application has two parts:

  • Agent Python client, easily customizable to suit any need.
  • Server several PHP/CSS files operating on two endpoints: an Admin GUI and an Agent Connection Point

Aiming for high usability even on restricted networks, Hashtopolis communicates over HTTP(S) using a human-readable, hashing-specific dialect of JSON.

The server part runs on PHP using MySQL as the database back end. It is vital that your MySQL server is configured with performance in mind. Queries can be very expensive and proper configuration makes the difference between a few milliseconds of waiting and disastrous multi-second lags. The database schema heavily profits from indexing. Therefore, if you see a hint about pre-sorting your hashlist, please do so.

The web admin interface is the single point of access for all client agents. New agent deployments require a one-time password generated in the New Agent tab. This reduces the risk of leaking hashes or files to rogue or fake agents.

There are parts of the documentation and wiki which are not up-to-date. If you see anything wrong or have questions on understanding descriptions, join our Discord server at https://discord.gg/S2NTxbz.

To report a bug, please create an issue and try to describe the problem as accurately as possible. This helps us to identify the bug and see if it is reproducible.

In an effort to make the Hashtopussy project conform to a more politically neutral name it was rebranded to "Hashtopolis" in March 2018.

Features

  • Easy and comfortable to use
  • Dark and light theme
  • Accessible from anywhere via web interface or user API
  • Server component highly compatible with common web hosting setups
  • Unattended agents
  • File management for word lists, rules, ...
  • Self-updating of both Hashtopolis and Hashcat
  • Cracking multiple hashlists of the same hash type as though they were a single hashlist
  • Running the same client on Windows, Linux and macOS
  • Files and hashes marked as "secret" are only distributed to agents marked as "trusted"
  • Many data import and export options
  • Rich statistics on hashes and running tasks
  • Visual representation of chunk distribution
  • Multi-user support
  • User permission levels
  • Various notification types
  • Small and/or CPU-only tasks
  • Group assignment for agents and users for fine-grained access-control
  • Compatible with crackers supporting certain flags
  • Report generation for executed attacks and agent status
  • Multiple file distribution variants

Setup and Usage

Please visit the wiki for more information on setup and upgrade.

Some screenshots of Hashtopolis (by winxp5421 and s3in!c): Imgur1 Imgur2

Contribution Guidelines

We are open to all kinds of contributions. If it's a bug fix or a new feature, feel free to create a pull request. Please consider some points:

  • Just include one feature or one bugfix in one pull request. In case you have two new features please also create two pull requests.
  • Try to stick with the code style used (especially in the PHP parts). IntelliJ/PHPStorm users can get a code style XML here.

The pull request will then be reviewed by at least one member and merged after approval. Don't be discouraged just because the first review is not approved, often these are just small changes.

Thanks

  • winxp5421 for testing, writing help texts and a lot of input ideas
  • blazer for working on the csharp agent and hops for working on the python agent
  • Cynosure Prime for testing
  • atom for hashcat
  • curlyboi for the original Hashtopus code
  • 7zip binaries are compiled from here
  • uftp binaries are compiled from here

server's People

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

server's Issues

Notifications

There should be hooks which allow notifications on different channels like Mattermost, Email etc. on some actions.
It should be configurable for different kinds of events to have different notifications.

server still sending chunk when all hashes cracked

See output

Hashlist contained 2 hashes, 2 hashes were cracked in the chunk.
When queried for work the server is responding with same chunk when it should in fact with more no tasks or next task rather than chunk from same task.

{"action":"solve","token":"nqRsKOJbj3","chunk":104,"keyspaceProgress":0,"progres
s":114200000,"total":200000000,"speed":7230294,"state":5,"cracks":["02c879de651d
eb8a1e146d87287dd568:cba:32165487","9a361ed860ec2617da5af72079594a21:abc:1234567
8"]}
Attack finished
{"action":"solve","response":"SUCCESS","cracked":2,"skipped":0,"zaps":[]}
Progress:114200000/200000000 (57.1%)
Total Speed:7230294
Uploaded 2 cracks, server accepted 2
Finished last chunk
{"action":"chunk","response":"SUCCESS","status":"OK","chunk":104,"skip":0,"lengt
h":100000}

Optimizing API

In some cases the API checks the token of the agent multiple times or loads the agent twice. This should get cached in some way to reduce MySQL queries

Salts not displayed

On the hashes.php view the hashes of hashlists which are salted, are only displayed without salt.

Check Utils Class

Check the Utils class if still all functions there are required and do make sense.
Also add some Documentation to the functions.

Hashlist notes and task history

Have a Notes field to paste notes on the hashlist,
Also, include Previous tasks name's that have finished completely ( even if they are removed from tasks.php)

Abort does not work

Aborting a chunk doesn't work as the chunk state gets overwritten before it gets checked

Rewrite Chunk creation and benchmarking saving

As we get a new feature in Hashcat for benchmarking tasks (--progress-only) the creation of the chunks and how the benchmark is stored need to be changed.

This affects quite some locations in the source code and it should be carefully be checked where these are.

Benchmarking detail which needs to be written somewhere in the manual

Due to the way how the benchmarking is done, there is a special case where the benchmarking can result in chunks which are not all equally same size (in calculation time).

Because on salted hashes the benchmarking is done on a single hash, if you use hashes with weights (like for example in bcrypt) and the hashes in the list do not all have the same weight, the result will not reflect the average for all hashes, but will be calculated from the weight of the first hash in the list.

Update agents.php

  • Include the creation of new agents into the agents.php file
  • Extend the AgentHandler for handling new agents
  • Complete the agent detail view and implement the new SQL queries

salted hashes not working

{"action":"solve","token":"xx15Dkz4iE","chunk":93,"keyspaceProgress":0,"progress
":114200000,"total":200000000,"speed":7566838,"state":5,"cracks":["02c879de651de
b8a1e146d87287dd568:cba:32165487","9a361ed860ec2617da5af72079594a21:abc:12345678
"]}
{"action":"solve","response":"SUCCESS","cracked":0,"skipped":0,"zaps":[]}
Progress:114200000/200000000 (57.1%)
Total Speed:7566838

Uploaded 2 cracks, server accepted 0

The server is not accepting cracked salted hashes

Copy not working

Copying a task with the 'Copy' button on an existing task is not working. The values don't get copied into the form for creating a new task.

Task issues

See https://alpha.hashes.org/src/tasks.php?id=57:

  • All chunks are shown active, even there was no activity over long time or even if they are finished.
  • The agent is also shown active all the time
  • All the dispatches chunks show N/A as agent
  • Chunks are shown twice as soon as a second agent is assigned to the same task
  • Speeds shown on the agents are not correct (if there is more than one agent, the same speed is shown for both)
  • Time spent on the task on the assigned agents is always 0
  • Clicking on 'show all assignments' results in an error

Resizing chunks needs checking

When a chunk gets resized because it gets assigned to another agent, it should check if it resizes a chunk to length 0 and should delete it then. Otherwise there is a lot of trouble later.

Change Config page

The config page should display some information about every config setting and provide a name instead of just the string used in the code.
It would be nice to also have a check, that checks for every item that the corresponding value is allowed.

aborting agent mid run does not really remove agent

Scroll down, basically while the agent was running a task it was unassigned. The server responds with

{"action":"chunk","response":"ERROR","message":"You are not assigned to this task!"}

Which is correct, however when another part is uploaded the server seems to accept it

{"action":"solve","token":"nqRsKOJbj3","chunk":138,"keyspaceProgress":34,"progre
ss":29150750,"total":29150750,"speed":487,"state":4,"cracks":[]}
{"action":"solve","response":"SUCCESS","cracked":0,"skipped":0,"zaps":[]}
Progress:29150750/29150750 (100%)
Total Speed:487
Finished last chunk
Getting task

Then when a task is subsequently requested the server gives the client a task when it isn't suppose to

C:\Users\blazer\Documents\hashtopussy-agent\csharp\hashtopussy\bin\x64\Release\h
ashcat\hashcat64.exe -w 2 --gpu-temp-disable -d 3 --hash-type=0 "C:\Users\blaze
r\Documents\hashtopussy-agent\csharp\hashtopussy\bin\x64\Release\hashlists\21"
-a 3 ?a?a?a?a?a?a?a --outfile-check-dir="C:\Users\blazer\Documents\hashtopussy-a
gent\csharp\hashtopussy\bin\x64\Release\hashlists\zaps21" --potfile-disable --q
uiet --restore-disable --session=hashtopus --status --machine-readable --status-
timer=5 --outfile-check-timer=5 --remove --remove-timer=5 --separator=: --skip=3
3 --limit=1
Upload queue 1
{"action":"solve","token":"nqRsKOJbj3","chunk":138,"keyspaceProgress":33,"progre
ss":28293375,"total":28293375,"speed":635,"state":4,"cracks":[]}
{"action":"solve","response":"SUCCESS","cracked":0,"skipped":0,"zaps":[]}
Progress:28293375/28293375 (100%)
Total Speed:635
Finished last chunk
Writing Lines:
STATUS 4 SPEED 487 1 EXEC_RUNTIME 0.070367 CURKU
34 PROGRESS 29150750 29150750 RECHASH 0 879
RECSALT 0 1
Finished write:
Attack finished
{"action":"chunk","response":"ERROR","message":"You are not assigned to this tas
k!"}
ERROR
You are not assigned to this task!

Upload queue 1
{"action":"solve","token":"nqRsKOJbj3","chunk":138,"keyspaceProgress":34,"progre
ss":29150750,"total":29150750,"speed":487,"state":4,"cracks":[]}
{"action":"solve","response":"SUCCESS","cracked":0,"skipped":0,"zaps":[]}
Progress:29150750/29150750 (100%)
Total Speed:487
Finished last chunk
Getting task
{"action":"task","response":"SUCCESS","task":"72","wait":"30","attackcmd":"#HL#
-a 3 ?a?a?a?a?a?a?a","cmdpars":"-w 2 --gpu-temp-disable -d 3 --hash-type=0","has
hlist":"21","bench":"new","statustimer":"5","files":[]}
Hashlist for this task already exists, skiping download
{"action":"task","response":"SUCCESS","status":"benchmark"}

Update files.php

  • Change all DB requests in files.php to the new DBA
  • Put the 'action' requests into a new handler
  • Update it that we get a view of two lists with files (one for the wordlists and one for the rules)

Front-end Issues

Needs work

  • agents.php toggle active produces an error

  • agents.php deletion not working

  • newuser.php Creating a new user fails (object not found)

  • users.php Deletion of user produces error

  • file size determination on create wordlists does not work

  • import ist not listing files in directory

Not Tested

  • upload hashes from "Import" on files.php?view=rules, files.php?view=wordlists, and hashlist.php

  • Import hashes from "Import" on hashlist.php?newtrue, superhashlists.php

  • Agents.php entirely

  • config.php Rebuild chunk cache, Rescan global files, Clear all # 18

  • URL download on hashlist.php

  • Client related things on tasks.php?idXX

  • chunks.php

Tested and Working as of 12/2/16

  • Tasks.php?

  • supertasks.php?create=true

  • users.php & users.php?id=1

  • logout.php

  • hashtypes.php

  • account.php

  • hashcat.php?new=true

  • tasks.php?new=true

  • superhashlists.php?new=true

Wiki needs update

After we are ready for a beta release everyone needs to read through the help doc. So much has changed in this repo I simply do not have enough information to modify the entire document accurately. If you feel something needs to change place notes in this section.

Agent sections! If you create an agent get with @winxp5421 he will write a help section and/or assist users with troubleshooting.

Handling stacked variables

The templating has some problems with rendering stuff like:

[[Util::shortenstring([[gpu]], 20)]]
[[date([[config.getVal('timefmt')]], [[set.getVal('agent').getLastTime()]])]]

This should be fixed somewhere in Statement.class.php

Improve Super-Tasks

Modify the Supertasks lists to act more like Pre-configured tasks by including a supertasks list section in hashlists.php?id=XX instead of supertasks.php being the only place to issue work from.

Also in supertasks.php the copy button should not say copy it should be "create" or similar word as copy can be confusing when you are trying to issue work

Create a Collapsible/ Expandable ( or similar organizational UI) for Supertasks within tasks.php this would when collapsed allow grouping of tasks within a Supertask to be condensed into a single "Task" and when expanded to see each task within that Supertask. Visual representation http://prntscr.com/d1sx5a

Hashtype Salted

Make Hashtype configuration that it can be set if the hash contains a salt or not, so this has not to be selected when adding a hashlist.

Handle both benchmarking types

Make it possible that clients can submit both types of benchmarks and the server calculates the chunk length based on the given result.

Improve naming scheme on copy

Instead of just prefixing (copy) (copy), perhaps use something like copy1, copy2 copy3. or perhaps _X_copy, something to keep the names from getting extremely long.

Agent doesn't get auto-assigned to tasks

A agent connecting to the server doesn't get automatically to a task which has priority>0.
It could be that the logic getting the task which should be run next by the agent, doesn't get a correct result.

inconsistent chunk length variable type

Length var for tasks sometimes sent as int sometimes as string (depends whether the job already existed)

{"action":"task","response":"SUCCESS","status":"OK","chunk":"87","skip":"0","length":13762560}
{"action":"task","response":"SUCCESS","status":"OK","chunk":"87","skip":"0","length":"13762560"}

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.