Agent crashed in macOS 10.15.6

[raptork]

I finally know the problem. I'm using "New Task" instead of "Preconfigured Task". The wordlist can be downloaded successfully via the agent, but the following error occurred (sorry for a chain of problems):

Code:

Got cracker binary type hashcat
dlopen(/Users/adv/Downloads/hash/crackers/1/modules/module_11600.so, 2): no suitable image found.  Did find:
/Users/adv/Downloads/hash/crackers/1/modules/module_11600.so: unknown file type, first eight bytes: 0x7F 0x45 0x4C 0x46 0x02 0x01 0x01 0x00
/Users/adv/Downloads/hash/crackers/1/modules/module_11600.so: unknown file type, first eight bytes: 0x7F 0x45 0x4C 0x46 0x02 0x01 0x01 0x00

Error during keyspace measure: Command './hashcat.osx --keyspace --quiet  ../../files/crackstation-human-only.txt  --hash-type=11600 ' returned non-zero exit status 255.
No task available!

What is the problem this time? I am so confused.

[s3in!c]

I guess you compiled the osx binary, but the modules might still be linux, so make sure that the .so files are newly created when you build the osx binary.

[raptork]

Okay, I replaced the "module_11600.so" with Mac-compiled version, the message "Keyspace got accepted!" finally appears; I guess I passed the first barricade.

But the following error message showed:

Code:

Benchmark task...
Error during speed benchmark, return code: 255 Output:

and the task doesn't get executed further. What should I do? 

Is the Hashtopolis not supporting macOS at all? Seems I have to replace every file by myself.
Should I send a Mac-compiled version of "hashcat" to you?

[s3in!c]

Hashtopolis is supporting OS X, but hashcat is not prebuilt on OS X and also there are only few users using it on this operating system.
The error message is pretty generic, I cannot see at all what it tries to run, most likely there is either an error within hashcat or a wrong task to run. I asked you already to turn on debug on the agent, so we get more output than just an error.

[raptork]

My bad. I forgot to turn on the debug flag. Here is the output after turning on the debug mode:

Code:

https://unlocker.yourappapp.com:443 "POST /hashtopolis/src/api/server.php HTTP/1.1" 200 63
b'{"action":"getChunk","response":"SUCCESS","status":"benchmark"}'
Benchmark task...
CALL: ./hashcat.osx --machine-readable --quiet --progress-only --restore-disable --potfile-disable --session=hashtopolis -p " "  ../../hashlists/1 ../../files/crackstation-human-only.txt   --hash-type=11600  -o ../../hashlists/1.out
Error during speed benchmark, return code: 255 Output: 
{'action': 'clientError', 'token': 'nisPTTEiaU', 'taskId': 2, 'chunkId': None, 'message': 'Speed benchmark failed!'}
https://unlocker.yourappapp.com:443 "POST /hashtopolis/src/api/server.php HTTP/1.1" 200 45
b'{"action":"clientError","response":"SUCCESS"}'
{'action': 'getTask', 'token': 'nisPTTEiaU'}
Resetting dropped connection: unlocker.yourappapp.com
https://unlocker.yourappapp.com:443 "POST /hashtopolis/src/api/server.php HTTP/1.1" 200 85
b'{"action":"getTask","response":"SUCCESS","taskId":null,"reason":"Agent is inactive!"}'
No task available!

I executed the command in the "crackers/1/" folder, and here is the result:

Code:

% ./hashcat.osx --machine-readable --quiet --progress-only --restore-disable --potfile-disable --session=hashtopolis -p " "  ../../hashlists/1 ../../files/crackstation-human-only.txt   --hash-type=11600  -o ../../hashlists/1.out
clBuildProgram(): CL_BUILD_PROGRAM_FAILURE

<program source>:7:10: fatal error: 'inc_vendor.h' file not found
#include "inc_vendor.h"
         ^

* Device #1: Kernel /Users/adv/Downloads/hash/crackers/1/OpenCL/shared.cl build failed.

Started: Thu Oct  8 10:09:02 2020
Stopped: Thu Oct  8 10:09:02 2020

Seems the build cannot find the header file. Yet I checked the file "inc_vendor.h" exists in the "crackers/1/OpenCL/" folder. Since it's a header file, I think it's OS independent this time. I think it should be the "header include path" problem. Therefore I searched online and found this post: https://hashcat.net/forum/thread-9206.html, but the post has no solution yet. It is hashcat problem specifically in OSX.

Thanks again for helping.

[raptork]

I finally get it working in macOS without resolving the problems of Hashcat.

I make use of Docker image (https://github.com/dizcza/docker-hashcat) to set up the environment. However, for macOS, it's impossible for Docker to use the native GPU (no "nvidia-docker" is available in macOS), thus CPU has to be used.

[raptork]

For the "inc_vendor.h" not found issue, I have found an almost-perfect workaround.

I installed hashcat via Homebrew, and symlinked the local hashcat to the "hashcat.osx" in the /crackers/1/ directory.
Everything works fine now, except for the following error sometimes appears:

Code:

{'action': 'sendProgress', 'token': 'nisPTTEiaU', 'chunkId': 77, 'keyspaceProgress': 1939200, 'relativeProgress': 6156, 'speed': 25, 'state': 2, 'cracks': [], 'cpuUtil': [93.8]}
Error occurred: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response'))

I believe my network connection is stable, but I have no clue why this error will occur. 
The chunk progress status can be updated to Hashtopolis without a problem, though.

[s3in!c]

This is an issue due to a specific default configuration in apache2. The client tries to keep the connection open where it sends updates every 5 seconds. The default max time on apache2 for connection keepalive is 5 seconds. So it sometimes happens, that apache closes the connection before the client sends the next update, therefore the error and it has to reconnect.
It's not something to worry about, if you want to make it clean, you can set the keepalive max to something higher, e.g. 10 seconds on the apache2 config.

[raptork]

Thanks for the Apache2 hint; it works fine. Hope you don't mind I still have more questions, as I am testing out different options of Hashtopolis.

I have an attack command which consists of multiple rule files:

Code:

#HL# -r append_d.rule -r append_d_passthrough.rule -r append_lus.rule -r append_lus_passthrough.rule -r append_s.rule -r append_s_passthrough.rule -r append_u.rule -r append_us.rule -r append_us_passthrough.rule -r append_u_passthrough.rule

I checked the rule files are downloaded successfully into the /files folder.

And the following command fails when I execute the task in macOS:

Code:

./hashcat.osx --keyspace --quiet  -r ../../files/append_d.rule -r ../../files/append_d_passthrough.rule -r ../../files/append_lus.rule -r ../../files/append_lus_passthrough.rule -r ../../files/append_s.rule -r ../../files/append_s_passthrough.rule -r ../../files/append_u.rule -r ../../files/append_us.rule -r ../../files/append_us_passthrough.rule -r ../../files/append_u_passthrough.rule  --hash-type=11600

When I execute the command alone in Terminal, it seems that the syntax is incorrect, as the output is as follow:

Code:

Usage: hashcat [options]... hash|hashfile|hccapxfile [dictionary|mask|directory]...

Try --help for more help.

What could be the problem?

--- 

UPDATE: The same output is also displayed when only 1 rule is used:

Code:

./hashcat.osx --keyspace --quiet  -r ../../files/append_d.rule   --hash-type=11600

[s3in!c]

You are missing a wordlist, you cannot just run tasks with rules without any candidates.