new: hcxpottool (hashcat and john examples)

[ZerBea]

Like all the other hcxtools, hcxpottool is a pre-processor to hashcat an john.
hcxpottool is a tool

• to show the content of a pot file
• to verify a pot file
• to calculate a pot file
• to convert hashes to different hash modes
• to recover a PSK if you only have a PMK and an ESSID

To reproduce, get these example hashes from here:
22000 WPA-PBKDF2-PMKID+EAPOL

WPA*01*4d4fe7aac3a2cecab195321ceb99a7d0*fc690c158264*f4747f87f9f4*686173686361742d6573736964***

22000 WPA-PBKDF2-PMKID+EAPOL

WPA*02*024022795224bffca545276c3762686f*6466b38ec3fc*225edc49b7aa*54502d4c494e4b5f484153484341545f54455354*10e3be3b005a629e89de088d6a2fdc489db83ad4764f2d186b9cde15446e972e*0103007502010a0000000000000000000148ce2ccba9c1fda130ff2fbbfb4fd3b063d1a93920b0f7df54a5cbf787b16171000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001630140100000fac040100000fac040100000fac028000*a2

Add them to a hc22000 hash file:

$ echo "WPA*01*4d4fe7aac3a2cecab195321ceb99a7d0*fc690c158264*f4747f87f9f4*686173686361742d6573736964***" > test.hc22000

$ echo "WPA*02*024022795224bffca545276c3762686f*6466b38ec3fc*225edc49b7aa*54502d4c494e4b5f484153484341545f54455354*10e3be3b005a629e89de088d6a2fdc489db83ad4764f2d186b9cde15446e972e*0103007502010a0000000000000000000148ce2ccba9c1fda130ff2fbbfb4fd3b063d1a93920b0f7df54a5cbf787b16171000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001630140100000fac040100000fac040100000fac028000*a2" >> test.hc22000

$ cat test.hc22000
WPA*01*4d4fe7aac3a2cecab195321ceb99a7d0*fc690c158264*f4747f87f9f4*686173686361742d6573736964***
WPA*02*024022795224bffca545276c3762686f*6466b38ec3fc*225edc49b7aa*54502d4c494e4b5f484153484341545f54455354*10e3be3b005a629e89de088d6a2fdc489db83ad4764f2d186b9cde15446e972e*0103007502010a0000000000000000000148ce2ccba9c1fda130ff2fbbfb4fd3b063d1a93920b0f7df54a5cbf787b16171000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001630140100000fac040100000fac040100000fac028000*a2

Convert the hc22000 hash file to a format accepted by john (hcxpottool is working on hashcat an john files):

$ hcxhashtool -i test.hc22000 --john=test.john
$ cat test.john
4d4fe7aac3a2cecab195321ceb99a7d0*fc690c158264*f4747f87f9f4*686173686361742d6573736964
TP-LINK_HASHCAT_TEST:$WPAPSK$TP-LINK_HASHCAT_TEST#N4OnXgDw6ZvQGPSeGAsgmub/zO2kzmyvyozHg4DFeHYUgDTTJ8L9xsSlML2Esvsv.3dWbcbS06pe9xl6bPUup5ND9FVfbBsJF4uL9U21.5I0.Ec............/GAsgmub/zO2kzmyvyozHg4DFeHYUgDTTJ8L9xsSlML2.................................................................3X.I.E..1uk2.E..1uk2.E..1uk0U...................................................................................................................................................................................../t.....U....7.6bZG79zwdIIbP1RWO4w:22-5e-dc-49-b7-aa:64-66-b3-8e-c3-fc:6466b38ec3fc::WPA2:verified:converted by hcxhashtool

Get an actual word list (C-nets) from here and decompress it:

$ wget https://wpa-sec.stanev.org/dict/cracked.txt.gz
$ gunzip cracked.txt.gz

Now you should have these three files:

$ ls
cracked.txt  test.hc22000  test.john

[ZerBea]

Recover the PSK and generate hashcat out file and hashcat pot file:

$ hashcat -m 22000 --potfile-path=hc.pot -o hc.found  test.hc22000 cracked.txt
hashcat (v7.1.2-382-g2d71af371) starting
...
...
Recovered........: 2/2 (100.00%) Digests (total), 2/2 (100.00%) Digests (new), 2/2 (100.00%) Salts
Started: Mon Jan 19 08:53:34 2026
Stopped: Mon Jan 19 08:53:37 2026

$ ls
cracked.txt  hc.found  hc.pot  test.hc22000  test.john

$ cat hc.found
4d4fe7aac3a2cecab195321ceb99a7d0:fc690c158264:f4747f87f9f4:hashcat-essid:hashcat!
024022795224bffca545276c3762686f:6466b38ec3fc:225edc49b7aa:TP-LINK_HASHCAT_TEST:hashcat!

$ cat hc.pot
88f43854ae7b1624fc2ab7724859e795130f4843c7535729e819cf92f39535dc*686173686361742d6573736964:hashcat!
0857172bd4d3ebb34cf00f3619726008d27558926d963a547332fab033023b82*54502d4c494e4b5f484153484341545f54455354:hashcat!

[ZerBea]

Verify hashcat pot file and show content (hexified if necessary):

$ hcxpottool --hcpotin=hc.pot --tabout=test.tab
12 threads started to calculate PMKs...
2 valid entries 
2 PMK(s) calculated

$ cat test.tab
88f43854ae7b1624fc2ab7724859e795130f4843c7535729e819cf92f39535dc	hashcat-essid	hashcat!
0857172bd4d3ebb34cf00f3619726008d27558926d963a547332fab033023b82	TP-LINK_HASHCAT_TEST	hashcat!

[ZerBea]

Generate hashcat pot file from hashcat out file:

$ hcxpottool --hcoutin=hc.found --hcpotout=calculated.pot
12 threads started to calculate PMKs...
2 valid entries 
2 PMK(s) calculated
2 PMK(s) corrected

$ cat calculated.pot
88f43854ae7b1624fc2ab7724859e795130f4843c7535729e819cf92f39535dc*686173686361742d6573736964:hashcat!
0857172bd4d3ebb34cf00f3619726008d27558926d963a547332fab033023b82*54502d4c494e4b5f484153484341545f54455354:hashcat!

[ZerBea]

Convert hashcat pot file to hash mode 12000 hash file:

$  hcxpottool --hcpotin=hc.pot --hcpbkdf2out=test.hc12000
12 threads started to calculate PMKs...
2 valid entries 
2 PMK(s) calculate

$ cat test.hc12000
sha1:4096:aGFzaGNhdC1lc3NpZA==:iPQ4VK57FiT8KrdySFnnlRMPSEPHU1cp6BnPkvOVNdw=
sha1:4096:VFAtTElOS19IQVNIQ0FUX1RFU1Q=:CFcXK9TT67NM8A82GXJgCNJ1WJJtljpUczL6sDMCO4I=

Verify converted hashes:

$ hashcat -m 12000 --potfile-path=hc.12000.pot -o hc.12000.found  test.hc12000 cracked.txt
hashcat (v7.1.2-382-g2d71af371) starting
...
Recovered........: 2/2 (100.00%) Digests (total), 2/2 (100.00%) Digests (new), 2/2 (100.00%) Salts
...
Started: Mon Jan 19 09:06:24 2026
Stopped: Mon Jan 19 09:06:27 2026

$ cat hc.12000.pot
sha1:4096:aGFzaGNhdC1lc3NpZA==:iPQ4VK57FiT8KrdySFnnlRMPSEPHU1cp6BnPkvOVNdw=:hashcat!
sha1:4096:VFAtTElOS19IQVNIQ0FUX1RFU1Q=:CFcXK9TT67NM8A82GXJgCNJ1WJJtljpUczL6sDMCO4I=:hashcat!

$ cat hc.12000.found
sha1:4096:aGFzaGNhdC1lc3NpZA==:iPQ4VK57FiT8KrdySFnnlRMPSEPHU1cp6BnPkvOVNdw=:hashcat!
sha1:4096:VFAtTElOS19IQVNIQ0FUX1RFU1Q=:CFcXK9TT67NM8A82GXJgCNJ1WJJtljpUczL6sDMCO4I=:hashcat!

[ZerBea]

Convert hashes to john hash file format:

$ hcxpottool --hcpotin=hc.pot --jtrpbkdf2out=pbkdf2.john
12 threads started to calculate PMKs...
2 valid entries 
2 PMK(s) calculated

$ cat pbkdf2.john
$pbkdf2-hmac-sha1$4096.686173686361742d6573736964.88f43854ae7b1624fc2ab7724859e795130f4843c7535729e819cf92f39535dc
$pbkdf2-hmac-sha1$4096.54502d4c494e4b5f484153484341545f54455354.0857172bd4d3ebb34cf00f3619726008d27558926d963a547332fab033023b82

Verify converted hashes:

$ john -w:cracked.txt --format=pbkdf2-hmac-sha1-opencl --pot=john.pbkdf2.pot pbkdf2.john
...
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
hashcat!         (?)     
hashcat!         (?)     
2g 0:00:00:00 DONE (2026-01-19 09:12) 2.381g/s 78019p/s 156038c/s 156038C/s 12345678..10213245

$ cat john.pbkdf2.pot
$pbkdf2-hmac-sha1$4096$686173686361742d6573736964$88f43854ae7b1624fc2ab7724859e795130f4843c7535729e819cf92f39535dc:hashcat!
$pbkdf2-hmac-sha1$4096$54502d4c494e4b5f484153484341545f54455354$0857172bd4d3ebb34cf00f3619726008d27558926d963a547332fab033023b82:hashcat!

[ZerBea]

Recover the PSK and generate john pot file:

$ john -w:cracked.txt --format=wpapsk-opencl --pot=john.wpa.pot test.john
..
.Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
Warning: Only 733928 candidates buffered, minimum 8388608 needed for performance.
hashcat!         (TP-LINK_HASHCAT_TEST)     
hashcat!         (?)     
2g 0:00:00:01 DONE (2026-01-19 09:18) 1.081g/s 396717p/s 793435c/s 793435C/s 12345678..73868370042228950622

$ cat john.wpa.pot
$WPAPSK$TP-LINK_HASHCAT_TEST#N4OnXgDw6ZvQGPSeGAsgmub/zO2kzmyvyozHg4DFeHYUgDTTJ8L9xsSlML2Esvsv.3dWbcbS06pe9xl6bPUup5ND9FVfbBsJF4uL9U21.5I0.Ec............/GAsgmub/zO2kzmyvyozHg4DFeHYUgDTTJ8L9xsSlML2.................................................................3X.I.E..1uk2.E..1uk2.E..1uk0U...................................................................................................................................................................................../t.....U....7.6bZG79zwdIIbP1RWO4w:hashcat!
4d4fe7aac3a2cecab195321ceb99a7d0*fc690c158264*f4747f87f9f4*686173686361742d6573736964:hashcat!

[ZerBea]

It is also possible to convert a john (pbkdf2) pot file to a hashcat potfile:

$ cat john.pbkdf2.pot
$pbkdf2-hmac-sha1$4096$686173686361742d6573736964$88f43854ae7b1624fc2ab7724859e795130f4843c7535729e819cf92f39535dc:hashcat!
$pbkdf2-hmac-sha1$4096$54502d4c494e4b5f484153484341545f54455354$0857172bd4d3ebb34cf00f3619726008d27558926d963a547332fab033023b82:hashcat!

$ hcxpottool --jtrpotin=john.pbkdf2.pot --hcpotout=hc.converted.pot
16 threads started to calculate PMKs...
2 valid entries 
2 PMK(s) calculated

$ cat hc.converted.pot
88f43854ae7b1624fc2ab7724859e795130f4843c7535729e819cf92f39535dc*686173686361742d6573736964:hashcat!
0857172bd4d3ebb34cf00f3619726008d27558926d963a547332fab033023b82*54502d4c494e4b5f484153484341545f54455354:hashcat!