/
← Voltar ao feed
low

TrustedSec releases hate_crack updates since 2.0: 13 new cracking attacks, renumbered menu, rebuilt updater and local-only LLM attack

1 fonte(s) · 1 atualização(ões) · publicado 24/09/2026 01:00 · coletado há 1 dia

TrustedSec published Part 1 of a three-part reference on changes to its open-source password-cracking orchestrator hate_crack since version 2.0 (February 2026). Since then there have been 101 releases and 781 commits, adding thirteen attacks, four submenus, a rewritten LLM integration and a scripted non-interactive mode. New attacks include PCFG, PRINCE-LING, OMEN, Spoonman, Rosetta, Corporate Masks and Smart Mask. The main menu was renumbered, so users upgrading from older versions should expect changed option numbers. The author removed a short-lived PassGPT feature, which fine-tuned a GPT-2 model on cracked client passwords, because he could not justify the data handling from a DLP standpoint. The current LLM attack runs only against a local Ollama server. This is tool and product news with no vulnerability, exploitation or victim.

Technical Details

  • hashcat is no longer a submodule. Supporting submodules are hashcat-utils, princeprocessor, pcfg_cracker, omen, HashcatRosetta and Corporate_Masks. Existing clones need git submodule update --init --recursive and a re-run of make; otherwise three of the new attacks do not work.
  • PCFG (20) pipes pcfg_guesser.py into hashcat and sustains about 770,000 candidates/s. Grammar training is not wrapped and must be done with pcfg_cracker's trainer.py. PRINCE-LING (21) derives a PRINCE base wordlist from a trained grammar. The cache filename now includes the size, which fixes a stale-cache bug.
  • OMEN (13, formerly 16) uses createNG/enumNG. The default cap was aligned to 100,000,000 in 2.14.4, because an in-code fallback of 1,000,000 made runs finish early. The unused omenTrainingList key was deleted.
  • The updater was rewritten to handle clones made before the master→main rename, where git pull silently did nothing. It now uses git checkout -B main origin/main and adds --nightly (2.17.0) and a persistent update_channel setting.
  • Menu consolidation (2.16.0) moved the old 90–93 download and analysis options into submenus. This exposed a duplicated menu table in hate_crack.py where key 91 ran the Weakpass handler instead of 'Analyze Hashcat Rules'. 2.17.0 removed duplicate downloaders from the no-hash-file menu.
  • Credentials moved from config.json to a .env file in 2.20, which is a breaking change. HASHVIEW_API_KEY in .env enables Hashview option 94.
  • Other attacks documented include Markov (.hcstat2), N-gram, Permutation (N! growth), Random Rules, Combipow (63-line limit), an Ad-hoc Mask attack with hashcat 7 custom charsets ?5–?8, and a combinator submenu.

Remediation

  • Not applicable as a threat. Operators of hate_crack should update to the latest release, re-init submodules, review the config and .env migration if upgrading from before 2.20, and check any scripts or muscle memory against the new menu numbers. HATE_CRACK_ARROW_MENU=1 avoids number-based navigation.
  • For OMEN, verify omenMaxCandidates on versions older than 2.14.4.
  • On client engagements, avoid sending recovered plaintext to third-party ML tooling.

Linha do tempo

  1. trustedsec.com ↗ · pub. 24/09/2026 01:00 · coletado 19/10 17:57 primeiro registro

    TrustedSec releases hate_crack updates since 2.0: 13 new cracking attacks, renumbered menu, rebuilt updater and local-only LLM attack

    ler a análise desta fonte

    TrustedSec published Part 1 of a three-part reference on changes to its open-source password-cracking orchestrator hate_crack since version 2.0 (February 2026). Since then there have been 101 releases and 781 commits, adding thirteen attacks, four submenus, a rewritten LLM integration and a scripted non-interactive mode. New attacks include PCFG, PRINCE-LING, OMEN, Spoonman, Rosetta, Corporate Masks and Smart Mask. The main menu was renumbered, so users upgrading from older versions should expect changed option numbers. The author removed a short-lived PassGPT feature, which fine-tuned a GPT-2 model on cracked client passwords, because he could not justify the data handling from a DLP standpoint. The current LLM attack runs only against a local Ollama server. This is tool and product news with no vulnerability, exploitation or victim.

    Technical Details

    • hashcat is no longer a submodule. Supporting submodules are hashcat-utils, princeprocessor, pcfg_cracker, omen, HashcatRosetta and Corporate_Masks. Existing clones need git submodule update --init --recursive and a re-run of make; otherwise three of the new attacks do not work.
    • PCFG (20) pipes pcfg_guesser.py into hashcat and sustains about 770,000 candidates/s. Grammar training is not wrapped and must be done with pcfg_cracker's trainer.py. PRINCE-LING (21) derives a PRINCE base wordlist from a trained grammar. The cache filename now includes the size, which fixes a stale-cache bug.
    • OMEN (13, formerly 16) uses createNG/enumNG. The default cap was aligned to 100,000,000 in 2.14.4, because an in-code fallback of 1,000,000 made runs finish early. The unused omenTrainingList key was deleted.
    • The updater was rewritten to handle clones made before the master→main rename, where git pull silently did nothing. It now uses git checkout -B main origin/main and adds --nightly (2.17.0) and a persistent update_channel setting.
    • Menu consolidation (2.16.0) moved the old 90–93 download and analysis options into submenus. This exposed a duplicated menu table in hate_crack.py where key 91 ran the Weakpass handler instead of 'Analyze Hashcat Rules'. 2.17.0 removed duplicate downloaders from the no-hash-file menu.
    • Credentials moved from config.json to a .env file in 2.20, which is a breaking change. HASHVIEW_API_KEY in .env enables Hashview option 94.
    • Other attacks documented include Markov (.hcstat2), N-gram, Permutation (N! growth), Random Rules, Combipow (63-line limit), an Ad-hoc Mask attack with hashcat 7 custom charsets ?5–?8, and a combinator submenu.

    Remediation

    • Not applicable as a threat. Operators of hate_crack should update to the latest release, re-init submodules, review the config and .env migration if upgrading from before 2.20, and check any scripts or muscle memory against the new menu numbers. HATE_CRACK_ARROW_MENU=1 avoids number-based navigation.
    • For OMEN, verify omenMaxCandidates on versions older than 2.14.4.
    • On client engagements, avoid sending recovered plaintext to third-party ML tooling.