Hashcat - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/hashcat/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 22 Aug 2026 15:31:53 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCVE-2026-68766: Argument Injection in Hashcat Restore Fileshttps://feed.craftedsignal.io/briefs/2026-08-hashcat-restore-injection/Sat, 22 Aug 2026 15:31:53 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-hashcat-restore-injection/Hashcat is vulnerable to argument injection when parsing restore files, potentially leading to arbitrary code execution if a user restores a malicious session file.Hashcat versions up to and including 7.1.2 are susceptible to an argument injection vulnerability (CVE-2026-68766) occurring during the parsing of restore files. This flaw allows an attacker to inject arbitrary command-line options, such as --outfile or --potfile-path, by crafting a malicious restore file. When a user runs hashcat with this file, the application processes these injected options without sufficient validation. An attacker can leverage this to redirect hashcat output to arbitrary locations on the filesystem. By targeting shell startup files (such as .bashrc, .profile, or .zshrc), an attacker can append malicious commands to these files, leading to arbitrary code execution when the victim next opens a shell. This vulnerability relies on the user performing a restore action, making it a viable target for local attackers or those capable of dropping files in directories where a user typically runs password recovery operations.

Attack Chain

  1. Attacker creates a malicious session restore file with injected command-line arguments (e.g., --outfile).
  2. Attacker places the crafted restore file in a directory monitored or used by a target user for hashcat sessions.
  3. Victim executes hashcat, pointing to the malicious restore file (e.g., hashcat --restore session.restore).
  4. Hashcat process parses the restore file and executes with the injected flags applied to its internal state.
  5. Hashcat writes its output or potfile data to the path specified by the attacker (e.g., ~/.bashrc).
  6. The injected payload is successfully appended to the target shell configuration file.
  7. Victim starts a new shell session, triggering the execution of the appended commands.
  8. Attacker-controlled code runs within the context of the user, achieving full arbitrary code execution.

Impact

Successful exploitation results in arbitrary code execution within the security context of the victim user. This could lead to full system compromise, data theft, or persistence on the host. The vulnerability affects all platforms (Windows, Linux, macOS) where hashcat 7.1.2 or earlier is deployed.

Recommendation

  • Upgrade to the latest version of hashcat (post-7.1.2) where the parsing logic for restore files has been restricted.
  • Audit hashcat session directories for unexpected restore file modifications, particularly in shared compute environments.
  • Monitor for processes spawning with unexpected command-line arguments derived from file inputs.
  • Deploy the Sigma rules below to detect suspicious hashcat command-line invocation patterns.
]]>highadvisory