<gh_stars>1-10
#!/usr/bin/python3
from StateAction import StateAction
import paramiko
import socket
import argparse
import subprocess
import os

class Hashcat(StateAction):
    """ Runs hashcat for all 'etc_shadow' SSH actions """

    def __init__(self, dictionary_path):
        super().__init__('hashcat', ['host', 'dictionary'], ['host', 'dictionary'])

        self.dictionary_path = dictionary_path
        self.dictionary_filename = dictionary_path.split('/')[-1]

    def emit(self):
        emit_list = list(self.utils.knowledge.find({'type': 'state_action', 'subtype': 'result', 'result.status': 1, 'pentest_id': self.utils.pentest_id, 'name': 'ssh_exec', 'input.cmd_name': 'etc_shadow'}))
        # print(str(emit_list))
        emit_list = self.strip_list(emit_list,['input.host', 'input.cmd_name','result.cmd_results[0].stdout'])

        emit_list = [{**x, **{'dictionary':self.dictionary_filename, 'dictionary_path': self.dictionary_path}} for x in emit_list]

        # print(str(userhostcommand))
        return emit_list

    def work(self, params):
        # print(str(params))

        with open('./tmp/shadow.txt', "w+") as f:
            f.write(params['stdout'])
            f.close()

        # Sorry for this one-liner...
        cmd = "./shadow2crack.sh ./tmp/shadow.txt {} ./tmp/cracked.txt".format(self.dictionary_path)
        print(cmd)
        os.system(cmd)

        with open('./tmp/cracked.txt', "r") as f:
            lines = f.readlines()
            f.close()
        lines = [x.strip() for x in lines]
        creds = [{'username': x.split(' ', 1)[0],  'password': x.split(' ', 1)[1]} for x in lines]

        result = subprocess.run('rm ./tmp/cracked_pass.txt; cat ./tmp/cracked.txt | cut -d" " -f 2 > ./tmp/cracked_pass.txt', shell=True, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        result = subprocess.run('pipal ./tmp/cracked_pass.txt', shell=True, stdout=subprocess.PIPE)
        pipal = result.stdout.decode()
        print(pipal)

        if(len(creds)>0):
            flattened = [ [x['username'], x['password']] for x in creds]
            self.utils.knowledge.replace_one(
                {'pentest_id': self.utils.pentest_id, 'type': 'known_userpass', 'purpose': 'ssh', 'source': 'hashcat_'+params['host'], },
                {'pentest_id': self.utils.pentest_id, 'type': 'known_userpass', 'purpose': 'ssh', 'source': 'hashcat_'+params['host'],'data': flattened},
                upsert=True)

            return {'status':1, 'credentials': creds, 'pipal': pipal}

        return {'status':0}

parser = argparse.ArgumentParser(description='Runs hashcat against all found /etc/shadow files')
parser.add_argument('-d', '--dictionary',type=str, required=True, help='Path to the dictionary file')
parser.add_argument('-r', '--retry',  action='store_true', default=False, help='Rerun all, regardles of prior run or prior success.' )
parser.add_argument('-rr', '--remove-and-retry',  action='store_true', default=False, help='--retry, with additional removal of successful results from prior runs' )
args = parser.parse_args()
# print(args)

ssh = Hashcat(args.dictionary)
ssh.run(retry=(args.retry or args.remove_and_retry) , retry_successful=(args.retry or args.remove_and_retry), remove_previous=args.remove_and_retry )

#!/usr/bin/python3
from StateAction import StateAction
import paramiko
import socket
import argparse
import subprocess
import os

class Hashcat(StateAction):
    """ Runs hashcat for all 'etc_shadow' SSH actions """

    def __init__(self, dictionary_path):
        super().__init__('hashcat', ['host', 'dictionary'], ['host', 'dictionary'])

        self.dictionary_path = dictionary_path
        self.dictionary_filename = dictionary_path.split('/')[-1]

    def emit(self):
        emit_list = list(self.utils.knowledge.find({'type': 'state_action', 'subtype': 'result', 'result.status': 1, 'pentest_id': self.utils.pentest_id, 'name': 'ssh_exec', 'input.cmd_name': 'etc_shadow'}))
        # print(str(emit_list))
        emit_list = self.strip_list(emit_list,['input.host', 'input.cmd_name','result.cmd_results[0].stdout'])

        emit_list = [{**x, **{'dictionary':self.dictionary_filename, 'dictionary_path': self.dictionary_path}} for x in emit_list]

        # print(str(userhostcommand))
        return emit_list

    def work(self, params):
        # print(str(params))

        with open('./tmp/shadow.txt', "w+") as f:
            f.write(params['stdout'])
            f.close()

        # Sorry for this one-liner...
        cmd = "./shadow2crack.sh ./tmp/shadow.txt {} ./tmp/cracked.txt".format(self.dictionary_path)
        print(cmd)
        os.system(cmd)

        with open('./tmp/cracked.txt', "r") as f:
            lines = f.readlines()
            f.close()
        lines = [x.strip() for x in lines]
        creds = [{'username': x.split(' ', 1)[0],  'password': x.split(' ', 1)[1]} for x in lines]

        result = subprocess.run('rm ./tmp/cracked_pass.txt; cat ./tmp/cracked.txt | cut -d" " -f 2 > ./tmp/cracked_pass.txt', shell=True, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        result = subprocess.run('pipal ./tmp/cracked_pass.txt', shell=True, stdout=subprocess.PIPE)
        pipal = result.stdout.decode()
        print(pipal)

        if(len(creds)>0):
            flattened = [ [x['username'], x['password']] for x in creds]
            self.utils.knowledge.replace_one(
                {'pentest_id': self.utils.pentest_id, 'type': 'known_userpass', 'purpose': 'ssh', 'source': 'hashcat_'+params['host'], },
                {'pentest_id': self.utils.pentest_id, 'type': 'known_userpass', 'purpose': 'ssh', 'source': 'hashcat_'+params['host'],'data': flattened},
                upsert=True)

            return {'status':1, 'credentials': creds, 'pipal': pipal}

        return {'status':0}

parser = argparse.ArgumentParser(description='Runs hashcat against all found /etc/shadow files')
parser.add_argument('-d', '--dictionary',type=str, required=True, help='Path to the dictionary file')
parser.add_argument('-r', '--retry',  action='store_true', default=False, help='Rerun all, regardles of prior run or prior success.' )
parser.add_argument('-rr', '--remove-and-retry',  action='store_true', default=False, help='--retry, with additional removal of successful results from prior runs' )
args = parser.parse_args()
# print(args)

ssh = Hashcat(args.dictionary)
ssh.run(retry=(args.retry or args.remove_and_retry) , retry_successful=(args.retry or args.remove_and_retry), remove_previous=args.remove_and_retry )
#!/usr/bin/python3 Runs hashcat for all 'etc_shadow' SSH actions # print(str(emit_list)) # print(str(userhostcommand)) # print(str(params)) # Sorry for this one-liner... # print(args)