Play a Sound and Get Discord Alerts When Hashcat Cracks a Password

diGi
4 min readNov 22, 2024

--

This is a complete walkthrough if you want to hear an audio alert play when Hashcat cracks a password hash. I will also walk you through setting up a discord notification every time Hashcat cracks a password.

Adding mp3 audio to Hashcat binary

Go to your home directory cd ~

You will need to download a fresh copy of Hashcat from github:
$ git clone https://github.com/hashcat/hashcat.git

Enter in the folder and go to the src folder:
$ cd hashcat/src

We need to edit the potfile.c file:
$ nano potfile.c

You need to find the line around 249 that says this:
void potfile_write_append (hashcat_ctx_t *hashcat_ctx, const char *out_buf, const int out_len, u8 *plain_ptr, unsigned int plain_len)
{

You will need to scroll down approximately 50 or so lines until the closing of that function before the ending }. It should look like this:

  if (hc_unlockfile (&potfile_ctx->fp))
{
event_log_error (hashcat_ctx, "%s: Failed to unlock file.", potfile_ctx->filename);
}
}

You will then want to add the audio part here, above the closing }:

  if (hc_unlockfile (&potfile_ctx->fp))
{
event_log_error (hashcat_ctx, "%s: Failed to unlock file.", potfile_ctx->filename);
}
//audio notifier
int audio_status = system("ffplay -nodisp -autoexit /opt/hashcatcracked.mp3 > /tmp/audio_log.txt 2>&1");
}

Find a mp3 of any audio clip, it could be a simple beep or short audio clip from a song. I don’t recommend it being too long.

Save the audio file here:
/opt/hashcatcracked.mp3

In order for ffplay to work you need to install sudo apt install ffmpeg

You’re not done yet, you still need to rebuild Hashcat for the changes to work. I am going to explain the Discord webhook notification part, if you do not want to add that, you can skip to the rebuild part.

Adding a Discord notification when Hashcat cracks a password using webhooks

This will be extending the same file potfile.c we used to add the mp3. Right below it we will add this code:

  if (hc_unlockfile (&potfile_ctx->fp))
{
event_log_error (hashcat_ctx, "%s: Failed to unlock file.", potfile_ctx->filename);
}
//audio notifier
int audio_status = system("ffplay -nodisp -autoexit /opt/hashcatcracked.mp3 > /tmp/audio_log.txt 2>&1");
// Discord Notification

char webhook_url[] = "<YOUR_DISCORD_WEBHOOK_URL_HERE>";

char message[512];
snprintf(message, sizeof(message),
"{\"content\": \"Hashcat cracked a hash!\"}",
out_buf, plain_ptr);

char curl_command[1024];
snprintf(curl_command, sizeof(curl_command),
"curl -H \"Content-Type: application/json\" -d '%s' %s > /tmp/discord_log.txt 2>&1",
message, webhook_url);

int curl_status = system(curl_command);

// Log system call statuses
FILE *log_fp = fopen("/tmp/system_calls.log", "a");
if (log_fp != NULL)
{
fprintf(log_fp, "Audio status: %d\n", audio_status);
fprintf(log_fp, "Discord status: %d\n", curl_status);
fclose(log_fp);
}
}

You will need to update the part where it says: <YOUR_DISCORD_WEBHOOK_URL_HERE>

Here is how. Choose a Discord server and channel where you want the notifications to appear. Once you find a channel, click the edit channel settings for it. Click integrations and then Webhooks.

Create a new Webhook and click Copy Webhook URL

Paste this in potfile.c where it says:
<YOUR_DISCORD_WEBHOOK_URL_HERE>

Rebuild Hashcat

Whether you did the audio and/or Discord notification you will need to do this part. You should currently be in ~/hashcat/src go back to ~/hashcat folder. Run $ make clean && make. This part should take a little while.

Once it’s done, your modified Hashcat binary should be good to go.

Test it

Create a new hash.txt and put hash in it:
2c4bf3534517860443492cdba17390e1

It’s important to note that you will NOT be using the new modified Hashcat binary by running $ hashcat xxxx. We will change that in the last part. For now, run the following from ~/hashcat:
$ ./hashcat -a3 hash.txt ?a?a?a?a?a?a?ahere -w4 -O

You should hear the mp3 play and get a Discord notification.

Final Step

As I mentioned, you will have 2 Hashcat binaries, the one that responds when you use $ hashcat and the one in ~/hashcat/hashcat. You can replace your original binary by doing the following:

chmod +x ~/hashcat/hashcat
sudo ln -sf ~/hashcat/hashcat /usr/bin/hashcat

I prefer hashcat to be in /opt/hashcat rather than ~/hashcat (optional)

--

--

diGi
diGi

Written by diGi

20+ years as a web developer turned cybersecurity professional. 2X NCL trophy winner & 1st place in MWCC 2023.

No responses yet