CrackMeUp

Overview

CrackMeUp is a Python wrapper around Hashcat for password audit workflows. It automates multi-pass cracking with curated wordlist/rule combinations, tracks progress in optional session files, and generates summary outputs for analysis.

At the end of a run, CrackMeUp combines discovered cracks, runs a final hashcat --show, and exports a CSV report with:

• Username
• Hash
• Plaintext password
• Password length
• Password complexity category

Requirements

1. Hashcat installed and available in PATH
2. Python 3
3. Python dependencies from requirements.txt
4. Hash file prepared for the target Hashcat mode (for NTLM audits this is commonly -m 1000)

Install dependencies:

pip install -r requirements.txt

Usage

python3 crackmeup.py -m MODE -d HASH_DIR -p POT_FILE.pot -f HASH_FILE [options] -s crackmeup_session.json

What to provide

CrackMeUp expects four things every time:

• A hash mode, such as 1000 for NTLM
• A hash file inside your working directory
• A pot file name that already includes the .pot extension, such as ad_name-ntlm.pot
• A working directory where it can write logs, reports, and session files

Use -p for the full pot filename, not just the base name. The script does not append .pot for you.

How to use it

1. Pick your hash mode and confirm the hash file is in HASH_DIR.
2. Choose a pot filename with .pot included.
3. Run the command.
4. Review the output files written to HASH_DIR.

Required arguments

• -m, --mode: Hashcat mode (example: 1000 for NTLM)
• -d, --hash_dir: Directory containing hash input and where outputs are written
• -p, --pot: Pot file name, including the .pot extension
• -f, --hash_file: Hash file to crack (inside hash_dir)

Optional arguments

• -a, --all: Run every wordlist/rule combination and create timestamped pot files for each pass
• -s, --session: JSON file used to resume or track progress between runs
• -e, --effort: Controls the cracking set size (low, medium, or high)
• -w, --workload: Hashcat workload profile (auto, 1, 2, 3, 4)
• --auto_mask: Launch mask attacks automatically from passwords discovered during cracking
• --mask_threshold: Minimum mask frequency required before an automatic mask attack is triggered
• --unhex: Decode $HEX[...] passwords in the final CSV and report output
• --report-only: Skip cracking and generate reports from an existing session or pot file
• --generate-rules: Build a custom .rule file from patterns discovered in cracked passwords
• --patd-format: Write a user:hash:password file for Password! At The Disco imports
• --rules_path: Override the rules directory
• --wordlist_path: Override the wordlists directory

Common workflows

Basic crack with a single pot file name:

python3 crackmeup.py \
  -m 1000 \
  -d /opt/tools/hashcat-files/hashes/2023PWAudit \
  -f 20231028-ad-int-hashes.txt \
  -p ad_name-ntlm.pot

Resume a run with session tracking and higher effort:

python3 crackmeup.py \
  -m 1000 \
  -d /opt/tools/hashcat-files/hashes/2023PWAudit \
  -f 20231028-ad-int-hashes.txt \
  -p ad_name-ntlm.pot \
  -s crackmeup-session.json \
  -e high

Run every combination, enable automatic mask attacks, and decode $HEX[...] passwords in the report:

python3 crackmeup.py \
  -m 1000 \
  -d /opt/tools/hashcat-files/hashes/2023PWAudit \
  -f 20231028-ad-int-hashes.txt \
  -p ad_name-ntlm.pot \
  -a \
  --auto_mask \
  --mask_threshold 20 \
  --unhex

Report-only mode using an existing session or pot file:

python3 crackmeup.py \
  -m 1000 \
  -d /opt/tools/hashcat-files/hashes/2023PWAudit \
  -f 20231028-ad-int-hashes.txt \
  -p ad_name-ntlm.pot \
  --report-only \
  -s crackmeup-session.json

Behavior to know

• --session stores completed combinations and completed masks so interrupted runs can continue without repeating work.
• If the run is interrupted with Ctrl+C, the current progress is saved before the script exits.
• --workload auto picks a higher workload for fast hashes and a lower workload for slower hashes.
• --report-only skips cracking and only generates reports from the pot files it can find.

Effort levels

Effort level controls how many wordlists/rules are used:

• low: smallest set (fastest)
• medium: balanced/default
• high: largest set (most comprehensive)

Output files

CrackMeUp writes outputs to hash_dir, including:

• Hashcat run logs (hashcat-*.log)
• Pot files per run (*.pot)
• Session tracking file (*.json, when --session is used)
• Line-delimited run summaries (hashcat_session_log_*.json)
• Combined deduplicated pot-style output (hashcat_combined_*.txt)
• Final Hashcat show output (temp-*.txt)
• Final CSV analysis report (hashcat-*.csv)

Notes

• For long cracking jobs over SSH, use screen or tmux.
• Ensure your wordlist/rule paths match your environment, or override with --wordlist_path and --rules_path.

Wordlists and rule sets

• https://weakpass.com/
• https://github.com/n0kovo/hashcat-rules-collection
• https://github.com/praetorian-inc/Hob0Rules