Hashtopolis

Hashtopolis is a client-server tool that distributes hashcat tasks across several computers. A central server manages hash lists, word lists, rules and tasks and splits the work into chunks; agents on Windows, Linux and macOS fetch chunks, run hashcat and report results. It is used for authorised password recovery and security testing.

The Hashtopolis app announcement

Hashtopolis is a community application from the tebbiworld repository. Documentation and source can be found on Github

This module manages password cracking. Run it only against hashes you are authorised to attack: your own systems, or systems covered by a written engagement. The legal responsibility lies with the operator, not with the module or the upstream project.

• The server distributes work; it does not crack anything itself. The compute happens on the agents, which need hashcat and, in practice, GPUs. The NS8 node only needs to serve the web interface and the files.
• Word lists, rule files and cracker archives are stored in the volume hashtopolis-data and can grow large. Size the node's storage accordingly.
• Agents authenticate with a one-time voucher created in the web interface and receive a permanent token afterwards. Anyone who can reach the agent endpoint and holds a valid voucher can register an agent.

The upstream project publishes a backend and a frontend image, meant to be run with a compose file. The module adds:

• three rootless containers in one pod, so they reach each other over the pod's loopback;
• a single published port and a single Traefik route. The request paths are split inside the module by the frontend's nginx, which the module configures. Path routing is an internal matter of the module and does not belong in the cluster reverse proxy;
• the baseHost setting written into the database, so absolute URLs handed out to agents use the public scheme and host name (see below);
• a dedicated MySQL container with generated credentials, and an initial administrator account with a generated password.

Files served to agents live in the volume hashtopolis-data.

Everything not listed below is answered by the Angular application.

Hashtopolis has to hand out absolute URLs — agent binary downloads and v2 pagination links. It derives them from the request, and behind a TLS-terminating reverse proxy the backend only ever sees plain HTTP. Agents were therefore sent to HTTP addresses.

The module writes the public base address into the Hashtopolis baseHost configuration item, which is the supported override and short-circuits the auto-detection. The address is derived from the host name and the Traefik settings.

Set the optional Public URL field when this instance is published through a gateway node that terminates TLS while this node itself serves plain HTTP. Leave it empty otherwise.

Agents are registered with the agent address, which is the base address plus /api/server.php. Both the base address and the agent address are returned by get-configuration.

On the NethServer 8 cluster leader:

add-module hashtopolis 1

Configure it, replacing the host name:

api-cli run module/hashtopolis1/configure-module --data '{
  "host": "hashtopolis.example.org",
  "lets_encrypt": true,
  "http2https": true
}'

Read the configuration back, including the generated initial administrator password and the agent address:

api-cli run module/hashtopolis1/get-configuration --data '{}'

Log in with the user admin and the returned password, then change it immediately.

To remove the instance:

remove-module --no-preserve hashtopolis1

Up to 1.0.1 the module created seven Traefik routes and published two ports. Since 1.1.0 it creates one route and publishes one port; the update hook removes the extra routes. Existing instances keep their second, now unused, port until they are removed.

Two agent-facing defects were fixed in 1.1.0. Agents on an instance updated from 1.0.x should be checked: binary downloads from /static/ had no route at all, and the download addresses were built with HTTP instead of HTTPS.

• Change the generated administrator password at first login. It is readable through get-configuration for anyone with cluster administrator access.
• The database credentials are generated at installation and stored in the module environment (state/environment).
• Whoever reaches the web interface controls what the agents compute and can read the uploaded hash lists and results. Publish the instance only where that is acceptable.

The module does not list its volumes for the NS8 backup; there is no state-include.conf. An NS8 backup of this module contains the module environment only, not the database in hashtopolis-db with tasks, hash lists and results, and not the files in hashtopolis-data. Back these up separately until this is added to the module.

• Hashtopolis documentation
• Hashtopolis server on Github
• Bug reports

Private hobby project, shared as-is. No warranty, no guaranteed support, use at your own risk. Unofficial community package, not affiliated with or endorsed by the Hashtopolis project. The module's own code is licensed GPL-3.0-or-later.