Skip to content

ENG-8819 fix(network-ops): collect cracked passwords on time-boxed/partial hashcat and john runs - #174

Merged
thomasqbrady merged 1 commit into
mainfrom
eng-8819-hashcat-discards-recovered-passwords
Oct 14, 2026
Merged

thomasqbrady merged 1 commit into
mainfrom
eng-8819-hashcat-discards-recovered-passwords

Conversation

@thomasqbrady

Copy link
Copy Markdown
Contributor

Summary

hashcat and john_the_ripper in network-ops/tools/cracking.py recover passwords into a potfile as they run and return them via a second --show step. But the crack step runs through the platform execute() helper, which raises on any non-zero exit — so on the normal time-boxed path (hashcat exits non-zero when the keyspace is exhausted or the --runtime box fires) the function aborted before --show ever ran, and every password hashcat had actually recovered was discarded while the operator saw a command failure.

This classifies the crack step's outcome instead of treating all non-zero exits as failure.

Changes

  • hashcat: tolerate the exit codes that mean "ran, then stopped" — 1 (exhausted), 2/3 (aborted), 4 (halted by --runtime) — plus a timeout kill, then always collect results via --show. A missing compute backend keeps its actionable "use john_the_ripper" message. Any other failure (255, negative, or an error with no parseable exit code) is re-raised, so an empty --show result can never be mistaken for "nothing cracked".
  • john: tolerate the run timeout (its only time box) and collect via --show; a non-zero john exit is a genuine failure and surfaces.
  • Tests for both tools covering exhausted/aborted/runtime/timeout recovery, and the genuine-failure-surfaces paths (255, unparseable error, john non-zero).
  • network-ops bumped to 2.1.9.

Notes

  • The tolerated exit code is read from execute()'s failure text; if that text ever lacks a parseable code the error is treated as genuine and re-raised (fails toward surfacing, not swallowing).
  • Exit codes were confirmed live against kalilinux/kali-rolling:latest (the sandbox base image): exhausted 1, --runtime 4, malformed hash 255, --show 0. The ticket's assumption of 2 for --runtime is actually 4 on current hashcat — hence tolerating the whole 1–4 "ran then stopped" range rather than pinning one code against an unpinned rolling image.

…hcat and john runs (ENG-8819)

hashcat and john recover passwords into a potfile as they run, and the tools
returned that via a second `--show` step. But the crack step ran through the
platform execute() helper, which raises on any non-zero exit, so the function
aborted before `--show` — discarding every password hashcat actually recovered
on the normal time-boxed path.

Classify the crack step's outcome instead of failing on all of them:

- hashcat: tolerate the exit codes that mean "ran then stopped" (1 exhausted,
  2/3 aborted, 4 halted by --runtime — confirmed against current Kali hashcat)
  and a timeout kill, then always read results via `--show`. A no-backend error
  keeps its actionable "use john_the_ripper" message; any other failure (255,
  negative, or no parseable exit code) is re-raised so an empty result never
  masks a broken invocation.
- john: tolerate the run timeout (its only time box) and collect via `--show`;
  a non-zero john exit is a genuine failure and surfaces.

Adds tests covering partial/exhausted/runtime/timeout recovery and the
genuine-failure-surfaces paths for both tools. Bumps network-ops to 2.1.9.
@thomasqbrady
thomasqbrady merged commit ac4420c into main Oct 14, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants