+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Recover password file .7z partially known (/thread-7167.html)
Recover password file .7z partially known - antwane - 01-04-2018
Hi,
I'm a beginner, but I need to extract an old file (7-zip) that I protected 4 years ago...
I think to know partially the password.
Below, an example of the search I'd like to do.
Prefix (2 choice): tv4kg58 or rG8pfE5
Suffix : 4 or 5 alphanumeric characters
And perhaps $ at the beginning or at the end.
Thank you in advance
RE: Recover password file .7z partially known - slyexe - 01-05-2018
extract the hash with 7z2hashcat first and confirm it looks similar to that of the example hash found on the wiki.
Then build your script for hashcat. Just use a bruteforce attack in my opinion.
./hashcat64 -1 ?l?u?d -a 3 -m 11600 -w 4 -i --increment-min 11 --increment-max 12 hashfile.txt yourprefix?1?1?1?1?1
this does not include the perhaps $ at the beginning or at the end portion
Here's a benchmark of 1070 for your knowledge of how fast you're gonna be working at this.
Code:
OpenCL Platform #3: NVIDIA Corporation
======================================
* Device #4: GeForce GTX 1070, 2048/8192 MB allocatable, 15MCU
Benchmark relevant options:
===========================
* --optimized-kernel-enable
Hashmode: 11600 - 7-Zip
Speed.Dev.#4.....: 5843 H/s (20.37ms)Good luck.
RE: Recover password file .7z partially known - antwane - 01-05-2018
(01-05-2018, 01:16 AM)slyexe Wrote: extract the hash with 7z2hashcat first and confirm it looks similar to that of the example hash found on the wiki.
It's a bad start, when I use 7z2hashcat (7z2hashcat64-1.2.exe), I have this message :
Code:
WARNING: the file blablabla.7z' unfortunately can't be used with hashcat since the data length in this particular case is too long (3086944 of the maximum allowed 327528 bytes).RE: Recover password file .7z partially known - philsmd - 01-05-2018
That's a 3 MB file compressed (uncompressed maybe even much larger if not totally random data).
Are there several files within the .7z file ?
You could also try to increase the limit that hashcat accepts for 7-Zip hashes as mentioned a couple of times within this forum (but at your on risk, the hash will be very, very, very long... the memory consumption will also increase a lot over 3 MB and you would need to test it a lot if everything is working correctly with higher limits... but lzma1/lzma2 decompression to check the checksum shouldn't be a problem even with much larger files).
RE: Recover password file .7z partially known - antwane - 01-05-2018
7-zip file contains 3 files (two .rar file and one .xls),
This is .xls file that I want to recover.
I'm going to look at how to increase the limite.
Thanks