Can hashcat support zip2john's "$pkzip$" instead of only "$pkzip2$"?

[ac2022]

Hello!

I want to recover a zip password using hashcat.

hashcat requires the hash of the desired password.

In order to obtain the password hash from the zip, I have tried using zip2john using:


sudo zip2john /home/The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali)/Desktop/myfile.zip > hash.txt


It works and outputs a hash, starting with "$pkzip$".

hashcat however seems to expect "$pkzip2$".

It responds:

Token length exception: This error happens if the wrong hash type is specified, if the hashes are malformed, or if input is otherwise not as expected (for example, if the --username option is used but no username is present).
hashcat provides sample hashes here.

What could I try next?

I have tried some online tools, but their hashes triggered the same error message.

Thank you!

[marc1n]

Use john the ripper for crack...

[b8vr]

Have you formatted the hash for correct use in hashcat? Zip2john is for John the Ripper and does not work out of the box for hashcat. You need to remove any data from the hash after and including any : (colon).
Try hashcat --identify hash to have hashcat tell you what modes to try.

[@smyb2002]

Hello，I met the same problem. Do you find an answer?

[drsnooker]

Hello，I met the same problem. Do you find an answer?

I haven't tested this but there is a zip2hashcat (instead of zip2john) might work better for your needs.
https://hashcat.net/forum/thread-11547.html

[@smyb2002]

Hello，I met the same problem. Do you find an answer?

I haven't tested this but there is a zip2hashcat (instead of zip2john) might work better for your needs.
https://hashcat.net/forum/thread-11547.html

Thank you too much! but when i use the ziptohashcat, the extracted hash value is tooooo long. it seems not like a right value. Do you know why?

[drsnooker]

There are other zip2hashcat on github. May be one will work?
I haven't done any archive cracking, but I think I read somewhere that the hash includes the smallest file. So if the archive only contains one large file you can end up with a large hash. John the ripper has no problem with large hashes, but hashcat fails. If you only want to search through a small dictionary as you may know parts of the password, may be John is the way to go.

I'll add another bit of advice is to practice with a known file. Create a new zip with a known password and see if you can recover that, before working on the unknown one.

[@smyb2002]

There are other zip2hashcat on github. May be one will work?
I haven't done any archive cracking, but I think I read somewhere that the hash includes the smallest file. So if the archive only contains one large file you can end up with a large hash. John the ripper has no problem with large hashes, but hashcat fails.  If you only want to search through a small dictionary as you may know parts of the password, may be John is the way to go.

I'll add another bit of advice is to practice with a known file. Create a new zip with a known password and see if you can recover that, before working on the unknown one.

thank you again, it is helpful

[c4p0ne]

Someone else was making a similar query in another thread, I'll give you the same shot in the dark. https://github.com/leftstack/unhash. Hope it gives you the correct output.