Welcome to Automating Hashtopolis. The second you see this slide, you might think it's an
awkward thing. So disclaimer; I have to read this as legal will kill me if I don't.
This talk has not been invented by IBM, IBM Security or X-Force Red. Opinions
expressed this talk are mine and mine alone. I'm not here speaking on behalf of
Hashcat, Hashtoplis, Team Hashcat, The Church of Wi-Fi, CSP, the Illuminati or Bigfoot.
No warranties expressed or implied. Not responsible for setting the house on fire, break
your Hashtoplis instance, blow up your database or otherwise severely break something and/or get yourself
fired. Please seek the assistance of a professional before doing this in production.
So, who am I? I'm noticing a lot in the industry. Bishop of the church Wi-Fi. Hacker for
X-Force Red. Member of Teamm Hashcat and that the CCDC has also rear admiral
eagle mohammed bit evil and special asian people.
Why are you here? Because Hashtopolis is awesome. Hashtopolis manages Hashcat.
And Hashtopolis can be automated with JSON. That's right, you all can be very, very
lazy. So, some terminology before we get going. Just in case you haven't used
Hashtopolis. An Agent is a hashcat worker node. Trust is an agent that it's
trusted to run secret hash lists. A Secret is a hashlist that cannot be sent to a
untrusted agents. A Task is a hashcat job. A Hatchlist
is a list hashes. Hashcat's an awesome password cracker,
Thank you Atom. And Hashtopolis manages Hashcat to distribute work thanks s3!nlc, hops,
Winxp and all others. That small crew right in front of me. So, we need to get
started. With this, you need to obviously install Hashtopolis. It needs to sort
of work at some point. If it doesn't start here. Next, go to generate yourself an api
key, go to users and api management. generate key. Then there's a nice little
document I'll be referencing throughout most of this. There's a user API
PDF which has the entire JSON spec for automating things. The tool I'm going to be
talking about is the Python bindings that calls it, but realistically run
Python, Powershell, JavaScript, Ruby, C-sharp, C++ if you're sadistic. But, right now
we're gonna talk about the Python bindings. You see, making you dredge up your
project in that directory to clone my really terrible repo. It's Python version
two only. You know I haven't upgraded to Python three because I'm really lazy.
I assume you're all good. I don't need to restart? Alight, cool. So yes, make your directory. A
clone my bindings as a sub-module. Questionable stuff happens and be
potentially profit. So the first thing you do is make yourself a config dot
JSON. There's three critical things you need to know here. One is your endpoint
that you're talking to, the speeder Hashtopolis instance. Yeah, if your being
smart, runs from port 443 but most of us are lazy run port 80. Really insecure
mode, but... Set yourself your endpoint. Certain path is if you want to actually
validate a certificate. Otherwise it says it's just a false. Also, there's a typo
here, it should be a lower case "F", not an upper case "f" on the JSON. I discovered that
this morning when I was fixing my slides. Set the API key relatively easy.
That's the major things you need to configure. Next thing you want to do is
want to test your connection to Hashtopolis. So in this case you know, run a
half from the htp client, API a top functions in port star, x equals test
connection, print x. It will return success. There are only two portions of
the Python bindings that return successor okay, everything else returns
raw JSON. And that is because I didn't feel like writing JSON parsers for the rest of
the API because I was lazy. So, test connection and test access. Return some kind of parse
and everything else doesn't. Under the hood, it's just all straight JSON. In fact
the entire API is and that's where that PDF comes in handy. So in
this case we're sending a section test, section or a connection before that.
Request connection, it'll return test connection success. This is the only
entry that does not require API keys. If you're API keys are wrong, you'll still
succeed. And this is just for us to get ready. I'm going to make sure the API
key actually works. So do something like test connection, test access,
standard important, print outputs, yeah.
Pretty simple. It's all Python two. I will import it eventually, but. Ignore my
terrible trans statements. Checking the access under the hood looks like a simple
section route test request, acts request access, given access key, the return ok
or error. Relativity simple. And in case there's a
message, it states something useful like API key not found. Now let's do something useful so
let's take going to create a hash list like say the example 0 - we import our
Python bindings import base64 will then read the example 0 Don - it'd be 64
encoded you pass off to create hash list so in this case the order is going to be
named whether it's salted or not whether it's going to be a heck salt but it's
secret your separator you pass format your hash type in DX group ID then your
encoded data whether using brain and the brain features and it should return
something like this will give your responsive okay if you have any
questions as to what you know if you're in front of your own the PDA is
fantastic I'm pretty sure they just have some latex that generates and PDF on a
routine basis so you could go grab the latex but I actually did all this by
hand they have seen here in the big guy but the assaulted his secret is how to
solve you pretty much do anything you need to to make it past
- lastrella quickly the important part is the hash for nut as well as sect
yeah it's hash formats the important one there's also a section here we've set up
with the binary etc but relatively simple the next thing you can do that's
really cool say you have a hundred masks and you wanna go ahead into a patch list
like save hathwell from the or logic folks in this case we're going to import
our HTTP client API functions when it's at the hash list ID which is an American
of Earth this case my headless was one we've given a priority value 102 set its
speed or the benchmarking to speed because the default benchmark one tends
to fail most the time if this breaks so we can flip back to a benchmark mode
open your mouth off I'll do a quick loop through it will set a priority - the
priority when we do things take master bought the newline character this is
very important if you have a newline character at the end of it it might
throw these things off then before your tasks so in this case % of the task name
said the paschal studied he said we've got my attack mode and then your mask we
said in this case 1200 is your trauma timer I hope I wasn't 5 those students
in the next line would go through it say benchmark you save your color on
things whether it's a secret hash etc etc that prints the new test get what
you're done it looks like oh okay exception of the JSON for this you also
set a priority for your strings important if you see the little brackets
there that's your final number so whatever you're creating a list and hash
table let's say what the word list say examples he wrote up dick you don't need
for that file you don't follow ribs in circles in brackets and it just prints
out your task when you hit a little script for if you need to go run say
pack on various things and import both tasks now this is kind of superfluous as
they don't have this in the GUI that makes me poor really easy but I like
CLI this one's handy they never have to delete all of your tasks from mash
topless bandwidth by clicking each and every single individual one this has
happened in contests it really annoyed me so in this case we do next week and
forty I said dude worthless tasks and there's a task I need seven list assets
JSON sweets looped through the tasks and upset kill tasks to delete house that
line in your task ID and it'll tell you what it's filling it'll destroy your one
hundred mouth wall tasks in a matter of seconds it's pretty quick and easy which
I'm pretty sure is saved some of us some time other cool thing if you have a hash
table instance that's been running for a long time you probably have a lot of
crack after to store it there so you just look them up rather than retracting
them all the time it's like the using hash table was it's your jangle pop up
so in this case you're important of the API again running get hash of the hash
you're looking for print X it'll return hash it'll return the crack position the
plane and your salt sat there said but a cooler way doing this if you want to get
this done in am actually details sir another slide after this so you want to
get the hash list details find out what set on mash these run get hatch list on
a setting you don't filter that I think the task ID it'll tell you what form it
is hash count your hash list it'll cut your hash that maybe your separators you
know and all this can be used for other functions later on so that's why we're
certain raw JSON as opposed to returning parsed and put for all this so you can
go look it up and do your own programming I don't have many
assumptions but what you're doing when you're automating your systems that's
exactly what you should be doing it this one's handy where you're going to
get all the crack times for a hash list this is a really dirty way of doing it
the next slide how to do it in the way that opens like a hash jackpot file but
friend get hash list cracked they hatch this ID and then cracked itself and then
they'll bring clear hash but a cooler way to win this he spilled things of
looking at pot fall again all the automated the flavor post-processing so
we're in quarry API via tell them only get the hashes when we get them hash was
cracked then you do it for loop on this or hash your hashes you print your hash
hash in your house playing separator in there all sudden you've got your dump
out of all the plain text which is handy for you to do this another system may be
kind of like a pot falls after it I think this because hash propolis tends
to be crankier than hash the pussy ever did or has to put specifically about
getting exports food things so the API is far easier for getting exports from
your hash list use this in contests so thank you later
join me task details me to the same thing running get tasks on the tasks
Peggy cut your data it'll tell you everyone know what a task and on task on
this case is a hash that job so this comes in handy when say you've dispensed
the task and that task tends to rotate by the way one of the fixable things
I'll turn of these we're gonna be already on the task but gives you the
entire command output whether work is possible this is handy if you need to
find out if a task completed before moving on another one that's true put
this in my request is three things running calculating correctly so if you
don't look up if a task is please just search for possible true or false if
it's false then you're going to go so the important thing you'll run into when
you're automating hash monopolists is you really need to go look at files for
both rules and worthless and trying to find the
file IDs at the time it's kind of a pain so the in front missed the API call on
that I so I missed they all not baby I call it get file files I'll go to a show
on this at the next slide my quality that's right in this little
flake they ain't here on the list files on that I'm skated with all pause here
Eric in so let's do some actual code coding with mock my apology is due
it's a readable a bring it there we go unless you work so see the allocation
can get files today oh this process with us this files WI yeah every time so yes
so files equals list files makes me even tell you what balls are out there so if
we run this like for example simulation it works today nope doesn't like make it
back to the very versatile program so this follows a handy the was decent is
also sure we haven't been filled listing of all the definitions that are in there
I have tested each units in one it should work
they don't sweetie gave half of course Daniella I accept yellow and I bet my
slide should nice play from Kraft slide
use slideshow so I don't PowerPoint I don't know it might well so yeah so the
gay user list it's a handy one from this one we do like a listing of all the
existing users in your environment and let me try to create eaves or sandy
variety management purposes but often Mary contests are doing real-world info
on board 30 40 people on hit monthly but every single time gets tedious so they
for example when I run the script it returns an user anyone even long and
brave group one there's usually no administrator chosen knowledge of my
session lifetime relatively so I've got a great user this is Andy
so we've somebody who's maybe was test email test equals test calm bright
goodbye to equals one I'm using a real bull trout password please don't use
this in the real world but hey you can call create user first specify username
email right everybody and then you need to elicit the users to get that user any
that usually just create as you set its password so what we're doing here is
we're going for lining this user list from a user was to call my username
matches up we said its password we're good to go
sounds kind of handy in that case we've done a lot of work for people this is 92
creating poachers honey dead no greed like 30 40 vouchers to go hand into
various agents I mean it's just we may be nominating much else but this was all
right great voter script well I got created so it's there's a couple of
different voter creation commands when I have is a create virtual random is also
longer your set a specific voucher code if you don't want to use the built-in
random generator if you want to hit with a static vouchers everyone's agents may
get first onboarding but in this case for you stink or at the
API run creation Bhoja random list about useless for onboarding your agents so
that gets for the head not simply patients you can delete vouchers and if
you look a little freedom from that this is cool I mean I apologize for telling
you to do this but the whole donation link at the bottom of the screen please
donate that turn off the link but donate first so that's the case even for the
API we said force equals false so the force was true would also work and we
said that donate hills get config donate off just so you can see what the
donation setting was we cranked the old setting out then you're on a second fake
20 off true with your forced value of false maybe we get it again also like
the durational links off nice and easy now if you want to see what else you can
change about there's some scripts provides a list of the configuration
sessions you run the sessions equals list sections the overcurrent each line
you have something cracking your town on sixth really heat your fine-tuning your
UI and i'm server or multicast notifications these are handy broad
categories you see I don't actually use these I'm here to change new things
because we use let's configuration either side so this is handy if you can
spin up a hash table sentences fresh for every contest configured specific ways
you can configure your entire hash table since pence by setting out your donation
settings or supertastic setting is your chunking settings to be the same every
time you guys do something in front of the sun's already run configure items
list config but for line or faith atoms items primal lions and in this case I
just grabbed for a brain for example take a bigger brain but because you'd be
list of configuration items fairly default state bar once you setup your
hash table lists pull the settings down for each one of them and make a skirt
for it this will save you 20 30 minutes and 17 hash table plus maybe longer
now this script is script right here will save your bacon
how many people here by show of hands and put in a bad task and also and
alterations shut down and then it's a 30 45 cent of manually
fix and it's a pain clicking everyone let's see I'm logging the line well
server yeah WinXP that's three offs you guys know what I'm talking about this
saves time so what we're doing here is we're gonna take our API list all the
agents and for each agent we're going to unassign there is a fantastic we're
gonna force them to not see but you only cuz that happens once popular thing the
wrong things in your system they need reset it to trust it because we trust
all our agents I mean we like the system but also in many cases we forgot to set
optimize and work little probe all through in all our agents would be doing
ntlm so in this case we'll set the agent s parameters then you set a page
inactive and all of a sudden your agents are working again assuming you believe
your bad tasks keep this iran it saves you a lot of interesting l server I need
you to do a funny for example you're trying to have a puppet through VPN and
figure out how to do buying maintenance and etc etc so I know it's really super
quick where you go through all the other cool a kind of the stole slide material
and I had but most important thing is chairman almost API these great API
management through to show you some of these options after this little slide
here it has all the debugging information you will ever need to find a
something wrong the PDF is usually correct and this changes often I don't
know get messed up quite often so and then we get home like I said it's
positive version to I will probably report it to Python version 3 just
please don't run all the way they thought and fire like someone does to my
other code because I will read a few more requests donate nationalist project
success to it for beer or buy the beer over here and the three mad geniuses are
sitting right there especially things test three he is saved my bacon on a
number of times when they have a slightly wrong or I was doing things
right he'd fix things in a bit a little bit thankful for him and also the
stuffing magically works and also thank Thailand for me - bad now that being
said not soul they went through ridiculously fast
is there anything anybody wants me to cover in detail on the API or functions
you'd like to see strips work is also one of them get it before late but I
take requests not by soe me show you it would be a documentation this looks like
we're here just because I love this thing so they wrote a really detailed
API spec guide like it details how the sections look like what each the
functions look like for example let's go we're on a super task and you're there
section and request ID even literally implement this in any language you want
my penny bomb is terrible I love to see the second power shell all I love
citizen Ruby yeah I'd like to see people automating national smart this is a
great system and it's free well be aware I think my license feeding
bourbon earlier this week and that's pretty small organizing the tasks
everything is basically a session in a request so everything that regarding
tasks is all in the same place ever do with requests but girls are a secondary
section in there so you can really find your way through how these pieces work
and then if you need to find out in the API how things are sorted get back to
this I just do it with grab death used to be functions functions and it tells
me all the various offers that are in there yeah it's not documented well but
that's it's mostly self talking about so if you want to keep into how that
amazing works I wrote this over the course of a
weekend mainly typing all the GS I need to do something Teresa but that's all it
really is some more functional study
this is all this is I'm literally transcribing the genius I'm it's
basically a jsonparser energy is not creative actively so
there's more of a toolkit rather than a natural tool in itself but you can do
some really crazy things with its various functions same person ever have
to touch the GUI again except for a couple of very specific things and we
see something's missing in the API please submit a FOIA request but make
sure it's complete blow requests and you've got exact details there's a lot
of reasons the ones up in hash-table must get and they've taken these in the
forums for support instead so check the forums first check their discord and
then about valent motocross or a tour bus ideally but a github issue of not
and I think that's and is there any questions and it was to try topic but
thank you all for showing up in a three o'clock on day two of conferring the
night before that's it
you