hashcat Forum

Full Version: zip2john Hash Problems
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
Hi All -

Using the latest version of the John Jumbo package and "zip2john" program to generate a hash to attack with hashcat. If I manually modify the hash so that it looks similarly formatted to the example on the examples page, it says "Salt-value exception". If I leave it in the unmodified format that comes out, it says "Signature unmatched". I've tried piping input and copy and pasting the hash value into a file and supplying directly via the command line for the program. I'm thinking that there have been changes to the format of the output of the zip2john program, but I'm not sure how to modify what it's spitting out to make it work. 

I can also confirm that the hash it's spitting out is NOT a pkzip hash.

I know we are not supposed to post hashes, but I can provide one or I can summarize some sections. As always, thank you for your help!

Edit: I just compiled two different versions on ubuntu and the hashes from those do not work either.
Sorry to "bump" this but just hoping someone can help. I've downloaded and compiled multiple versions of John for linux, and have tried the latest beta version of hashcat.

Hashfile 'hash.txt' on line 1 ($zip2$...599*4ff58d6ee41775bc4680*$/zip2$): Salt-value exception
No hashes loaded.
This is the example hash from the wiki:
$zip2$*0*3*0*b5d2b7bf57ad5e86a55c400509c672bd*d218*0**ca3d736d03a34165cfa9*$/zip2$
Does yours resemble this structure?
I also found this thread about zip hashes that was recent: https://hashcat.net/forum/thread-6946.html don't know if they got theirs sorted out or not.
Yes, mine resembles that, but with more * dividers in the middle. I could post the hash, but I know we are not supposed to do that. I've tried adjusting to get it to match as closely as possible, but that didn't work either.

Edit: My hash has a bunch of other numbers in the middle between dividers. I just deleted all of those, and 0'd the value that is 0 in the example and it looks like it started. Let's see what happens.