+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Need help restoring the password form the old DOS PKZIP archive (/thread-12522.html)
Need help restoring the password form the old DOS PKZIP archive - Taro222 - 03-09-2025
Need help restoring the password from the old DOS PKZIP archive.
The archive contains multiple files and folders, compressed, one password/all files. Opens in WinRAR and shows it's structure OK, however asks the password on extraction.
Hashcat version 6.2.6 on Ubuntu 22.04.
Both zip2john and zip2hashcat worked OK, no errors. Both produced quite large hash (>1mb text).
The hash is in this format:
-----------------
$pkzip$4*1*1*0*8*24*baec*7b6f10395bb5a0f556140188ef.............< 1Mb data >.....a556fb8a0ec46c*$/pkzip$
-----------------
hashcat --identify provides this:
-----------------
user@hashVM:/# hashcat --identify hash.txt
No hash-mode matches the structure of the input hash.
-----------------
What MODE number do I need here, or how can I crack this?
Tried some dedicated to PKZIP (17200, 17220 etc) but all returned the error "Hashfile 'hash.txt' on line 1 ($pkzip...1424e0323a556fb8a0ec46c*$/pkzip$): Signature unmatched. No hashes loaded.".
Thanks!!
RE: Need help restoring the password form the old DOS PKZIP archive - Snoopy - 03-11-2025
first of all, see https://hashcat.net/wiki/doku.php?id=example_hashes
compare your hash with pkzip examples and you will see, that your type of hash $pkzip$4*** isn't supported by hashcat
RE: Need help restoring the password form the old DOS PKZIP archive - Taro222 - 03-12-2025
Hi guys,
Just to let you know that JTR loads these hashes perfectly, and got em cracked in a few seconds (the pw's are simple 6-char all-digits ones).
Not pretty sure of why HashCat is having issues with such an oldie as PKZIP.
--------------
root@hashVM:/JohnTheRipperJumbo/run# ./john list25-03.hash
Using default input encoding: UTF-8
Loaded 12 password hashes with 12 different salts (PKZIP [32/64])
Will run 12 OpenMP threads
Note: Passwords longer than 21 [worst case UTF-8] to 63 [ASCII] rejected
Proceeding with single, rules:Single
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
Almost done: Processing the remaining buffered candidate passwords, if any.
Proceeding with wordlist:./password.lst
Enabling duplicate candidate password suppressor
<redacted> (?)
<redacted> (?)
<redacted> (?)
<redacted> (?)
<redacted> (?)
<redacted> (?)
<redacted> (?)
<redacted> (?)
<redacted> (?)
<redacted> (?)
<redacted> (?)
<redacted> (?)
12g 0:00:00:01 DONE 2/3 (2025-03-12 16:30) 6.704g/s 453077p/s 3761Kc/s 3761KC/s vianet..ewan90
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
root@hashVM:/JohnTheRipperJumbo/run#
--------------
Anyone willing to discuss this, pls feel free to post.
RE: Need help restoring the password form the old DOS PKZIP archive - Konubixe - 04-13-2025
Hi Taro222,
I#ve also been wondering why hashcat has some issues with decoding some zip hash types.
Seems to be an old theme, but I couldn't find out the reason in the forum.
Ok, I can use JtR also, but as a fan of hashcat trying to decode everything I can find with it this is a question mark for me...