acmesecorg / metacrack

Use meta data to create association attacks for Hashcat.

metacrack

Metacrack is a command line tool for security researchers and pentesters to create targeted hash / word association lists to help crack salted hashes in hashcat. Metacrack is currently in beta, and is not yet optimised for performance. Users of Metacrack should be very comfortable with using command line tools, including Hashcat.

Each function is written as a plugin which maps directly to a command line verb, for example:

meta export values.txt output.txt

• meta is the name of the compiled command line executeable
• export is the verb you wish to use
• values.txt and output.txt are parameters specific to the export verb.

Help for each verb can be viewed by typing meta <plugin> --help. It is also possible to write your own plugin as a c# dll, which will automatically be loaded and executed by the meta command line tool. See creating your own plugin for more details.

License

Metacrack is licensed under the MIT license. Refer to license.txt for more information.

Latest builds

Platform	Link
win-x64	meta-win-x64-1.2.12.7z
linux-x64	meta-linux-x64-1.2.12.7z

Usage and features

Metacrack uses metadata associated with a hash to create a per-hash list of possible words to use where a hash is difficult or expensive to crack. Common sources of data include previous password breaches, usernames, birthdates, and emails addresses.

Metadata is first cataloged using the catalog verb which stores the data indexed by a key derived from an anonymised version of an email address.

By providing a file containing a list of email:hash combinations, it is possible to perform a lookup to create two files that are compatible with Hashcat associative attack (attack mode 9). Words that would be duplicated by a rule in hashcat can be filtered out by supplying the rule to metacrack. Hashes can be filtered by Hashcat mode and iteration count to ensure that they are valid, as any inconsistencies will prevent hashcat from running the attack. Output in the form of cracked hashes from hashcat can be provided to metacrack to be removed from hash / wordlists, and exported using the export verb, in various formats.

Note Ensure that you are both legally and ethically allowed to use the meta data associated with the hashes you are trying to crack.

Plugins

Please see more comprehensive documentation taking shape in the https://github.com/acmesecorg/metacrack/tree/rocksdb branch

metacrack's Issues

Add iterations validation for phppass

As for the validator of the iterations in bcrypt and PBKDF2-SHA256, meta needs a validator for iterations in hashes like phppass.

Fix 27200 validation

I noticed that the validation doesn't keep count of the length of the salt (that must be 40 chars). pls fix this

Add some new hashmodes

Hey, can you add some hash modes such as 124, 120(same as 110) and other modes?

Convert k instead of adding 000 multiply by 1000

Now while using meta split, when I run like 3kk it adds 000000 to the 3 resulting in 3000000. The problem is that if I put 2.5kk it will fail cause it will add 000000 to 2.5 resulting in 2.5000000. Probably the best way to fix this is, instead of adding 000 when k is written, multiply the number by 1000. In this way if I have 2.5kk meta will read 2.510001000=2500000.

Add rule export to rank

Use an option eg --output-rule that converts outputs to rules instead of word lists, using $x$x$x syntax

Allow map to generate empty word files

If you dont specify a file to map, assume you want to map just a zero length string

Add support for -m 12000

Please add support for mode
12000 (PBKDF2-HMAC-SHA1)

Please add support for lookups for mode 19500