7z2Hashcat + -m 11600 issues

[bowser]

Hey folks, a friend has asked me to crack a small (33kb) 7z file he's forgotten the password to. I've used 7z2Hashcat to extract the following:

Position 1: $7z
Position 2: $2
Position 3: $19
Position 4: $0
Position 5: $
Position 6: $8
Position 7: $ad4cd6f5cbb39e780000000000000000
Position 8: $approx 61000 digits....
Position 9: $29304
Position 10: $09

When running it through hashcat, it fails with a 'no hashes loaded' and when trying Hashcat Beta (5.1) it starts to run but then fails with a segmentation error. 

I can tell than there is LZMA2 compression from the $2 at position 2, but i'm unclear how to make that matter....

The actual hash at position 8 seems faaaar too long to be correct also. 

Any ideas?

Thanks all.

[philsmd]

are you able to debug where/who crashed ?

It could be the driver too and in this case maybe just a setup/driver installation problem, dunno.

Did you try to test with the example hashes from https://hashcat.net/wiki/example_hashes ?

[bowser]

I've not debugged before but always willing to learn. I've tried to 'format' the hash to be like in the example but then I get a 'seperator unmatched' fail followed by 'no hashes loaded'

Driver is working well - i've used Hashcat successfully with lots of other hashes & attacks, just this one is perplexing me...

[philsmd]

without the hash it's very difficult (or impossible?) for me to say what's the problem.

Maybe you can share the hash in a PM or try to generate a new hash with the 7-Zip tool that also crashes and share one of this examples in a PM.

If the example hash works (and the driver isn't crashing because of some weird library problems etc), the target hash should work too.

[bowser]

PM sent, thanks. I'll try the 7z2hashcat tool again.

[philsmd]

as mentioned within my reply to your PM (I don't know if you saw it), I couldn't reproduce the problem with your hash.
Neither with a windows system, nor with a linux system...

normally the windows operating system is more sensitive to memory (RAM, buffer overflow etc) problems... but still I couldn't reproduce it there.

My guess is that it could also have something to do with your setup/driver etc, but I'm not sure.

I also mentioned within my private reply to your PM that you should test with a different OpenCL device (i.e. with -D 1 or changing -d x)... or even try with a completely different operating system (e.g. linux instead of windows or vice-versa) or a different computer (for instance asking a friend, or testing with a notebook etc).

I tested with latest beta from https://hashcat.net/beta and couldn't see any crashes with your hash...
It could still have something to do with other parameters you use for hashcat or even further factors (like which driver / hardware you have)... we would need to pinpoint this to find out the main problem

[bowser]

Sigh, these things are sent to try me...

Ok fresh install of Ubuntu 18.04, Nvidia drivers - all tested & benchmarked, works fine. Download the hashcat beta which fails with a glibc 2.28 issue....do a bit of research and it *shouldnt* but it does....ok, back to regular hashcat. Use your awesome 7z2hashcat tool to extract the hash from my 7z file - get the same results as above (veeeery long hash) and pass it to regular hashcat which fails with a Token length exception (with a red no hashes loaded).

Phil - OK if I shoot you a PM with the actual 7z file to see if your 7z2hashcat gets the same results?