A tool and guide for cracking hashed SSH known_hosts files using hashcat to recover IP addresses.
known_hosts-hashcat is a security tool and guide for cracking hashed entries in SSH known_hosts files to recover the original IP addresses. It converts HMAC-SHA1 hashed known_hosts data into a format usable by hashcat, enabling efficient brute-force attacks against the IPv4 address space. This is useful for penetration testers and red teams to uncover network targets without triggering alarms.
Penetration testers, red team operators, and security researchers who need to extract IP addresses from compromised systems with hashed known_hosts files for network reconnaissance.
It provides an optimized, GPU-accelerated approach using hashcat mask attacks, avoiding the need for large IP dictionary files. The tool is specifically tailored for the HMAC-SHA1 hashing used by OpenSSH's HashKnownHosts feature, making it a practical solution for real-world engagements.
A guide and tool for cracking ssh known_hosts files with hashcat
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
The kh-converter.py script automatically extracts and formats hashed known_hosts entries for hashcat, streamlining the preprocessing step as demonstrated in the example usage.
Includes a pre-made IPv4 hcmask file that enables brute-forcing all possible IPv4 addresses without generating large dictionary files, optimizing performance based on hashcat forums insights.
Leverages hashcat's GPU capabilities to crack hashes in minutes on hardware like Nvidia GTX 1080, making it practical for time-sensitive engagements, as noted in the README.
Provides a detailed background on HashKnownHosts, its security implications, and attack feasibility, helping users understand cryptographic limitations in defensive setups.
The tool is ineffective against IPv6 addresses due to the vast address space, rendering it obsolete in networks transitioning to IPv6, as admitted in the README analysis.
Only works when SSH logins used IP addresses; it fails to recover domain names from hashed entries, limiting its utility in real-world scenarios where domains are common.
Requires hashcat and a capable GPU for efficient cracking; without these, the process becomes slow and impractical, adding setup complexity for users.