Used wrong mode for PKZIP?
#2
(02-25-2021, 10:40 AM)cybhashcat Wrote: Hey guys,
i was given zip files to crack, and according to zip2john the hashes are:
Code:
$pkzip2$3*1*1*0*8*24*ee4c*5edb*492edbbe78f98606d8437d7cb3e759b1c046fc4f318010df342ce93388211a2392182475*1*0*8*24*c1c6*5edb*492edbbe78f98606d8437d7ccb3487f8506d46dd14f4b14e21d3e35559913cb77c4eb9b2*2*0*1d*11*97dd2617*8239*39*0*1d*97dd*772a*ece2f6a911d76d04f070b8ae90a26b97b74669cd198688399f68a81d09*$/pkzip2$

$pkzip2$3*1*1*0*8*24*4630*5e54*906ad67edca72e9f37ef4e5ead91eb7475312621e92215656ae882b60a8e1c2fd8bf7f4f*1*0*8*24*3362*6848*39c53ac8a7904e606ca61cc2180dfcbc9d8704b0ac61cbf1ca3472c7dae0011196220bde*2*0*1d*11*97dd2617*f022*26*0*1d*97dd*8893*002e2dc1798308557a17e435d6b35467dbd8de6cdd5bfaa20e01de5f61*$/pkzip2$

According to the example hashes i assumed, due to leading (3*1*1*0*8*24) that this must be -m 17220 PKZIP (Compressed Multi-File), however, i am getting a message saying "Hash contains unsupported compression type for current mode"

I tried using 17230 and the hashes were instantly cracked to " bonenfant" and "043minuses" (respectively), but even when using PKWARE's PKZIP, the passwords do not work. is it possible that this is a false result because i used the wrong module? since 17225 also runs (but i was unable to crack anything)

thanks guys.

magnum postet an issue here

https://github.com/hashcat/hashcat/issues/2719

according to this, there is an update to zip2john and no more need of mode pkzip2, update zip2john and try again
Reply


Messages In This Thread
Used wrong mode for PKZIP? - by cybhashcat - 02-25-2021, 10:40 AM
RE: Used wrong mode for PKZIP? - by Snoopy - 03-01-2021, 12:11 AM