hashcat Command Line Injection via Restore File

Executive Summary

This vulnerability in hashcat allows attackers to inject malicious command-line options like --outfile and --potfile-path into restore files. When hashcat parses these files during a restore operation, it executes the injected options, enabling arbitrary file writes. Attackers can append malicious content to critical files such as shell startup files, leading to potential code execution when the victim logs in.

Useful 0 Not Useful 0

Detection Guidance

Check for suspicious restore files in hashcat's working directory, particularly those with unusual command-line options like --outfile or --potfile-path. Inspect shell startup files (.bashrc, .zshrc) for unexpected content. Use commands like 'find / -name "*.restore" -exec grep -l "outfile\|potfile-path" {} \;' to locate potentially malicious restore files.

Useful 0 Not Useful 0

Impact Analysis

If you use hashcat versions up to 7.1.2, an attacker could craft a malicious restore file to write arbitrary data to your files. This could include adding commands to your shell startup files (e.g., .bashrc), which would execute the next time you log in. This could lead to full system compromise, data theft, or further attacks on your system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution and data access, violating confidentiality and integrity requirements in GDPR and HIPAA. If exploited, it may result in unauthorized disclosure of sensitive data, triggering compliance breaches and potential legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Update hashcat to the latest version where the restore file parsing flaw is fixed. Avoid using restore files from untrusted sources. If using --restore, switch to --restore-position or --restore-auto for safer session recovery. Review and sanitize shell startup files for unauthorized modifications.

Useful 0 Not Useful 0