Dead simple example on OSX

[stylo]

Hi !
I'm trying to find a password on a ZIP created on OSX, just like :

Code:

touch test.txt
zip -er test.zip test.txt
# hello
zip2john test.zip > test.hash

hashcat -a 3 test.hash '?l?l?l?l?l'

But I've the error :

Code:

Hashfile 'test.hash' on line 1 (test.z...kzip$:test.js:test.zip::test.zip): Token length exception

No hashes loaded.

I've tried with -m 11600, -m 17200, -m 17220... but without any luck.

Here is my hash:

Code:

test.zip/test.js:$pkzip$1*1*2*0*253*4a8*d1432dcc*0*41*8*253*780c*50726e3480d1c3e47745a843ffbc1e790c23bee3fe97884b151a43d8b37cc24333c935f94d962931a95867de51bd056f5f26a53d464f4d804efb30717d2507b594c0462a4061b78d31cc572c69ff6e8b55683aab22628307bfcff703827bad139b3a9aad07d6c4364cd02d755b9e7261605469bbd0c7a115cf4476e8c4e28291e0f146ac44da8d3d32ddfb5db5a872d9b857ef9652c96877cd80e60b2e43861085f23f00d9af75542b9510f030d7444b8317004ff0fcfef566b29490b37ef8114985c60f21416283a447d43fb45c5e7b412998ab4f13102b5c0c570de4a7573fd4536a39658244d2f4b6e683ec7a1cb7e1a731292ddd826e587e13fde25d3c0f937ba5da55e4ea347e9d2c4a9ae46cb9a3d36402913d6de9be51423732e8e8c38880f55ced43134f9b15590a3ce7784beea4d6876eab27faceffa2d83df8ce223fd06763c843d89d5f10ea5880cd21eed318a74623d1c22e81f074300845550cdbe16ef9d956d5fbe438025a20970bbdc98231d62c1d085e6d2d1f79122d5fb72aac2919623ccd3dea89cb93cbd9ab88193fca020421b0d8cc2a42349c0f1698b027d3d2753bd659e8a1aa39b138fa6f140d3be056e085e0568c014000733fe06f2cf0bf0f2751cadca38f3890680567fd5da99ca2889df123456497792868b064afbf673fa5aa7ef28f06157c7a0d90c2348b255c563c707349876fd48fadd740235dc76ed2ea7438e945b242b6480ec423ae2969e820ebf8ee799f583b7d16d787828dfa77253e9527f0c06f935bead98a02a8714457f33f370d46fe045af90f8124fedb99be8eef5ebf68e8026e40d20252*$/pkzip$:test.js:test.zip::test.zip

How can I find the corresponding password for this hash ?

Regards,
Frank

[Banaanhangwagen]

If you look at the error, you'll see that there is a problem with the hash-format.

Please format it exactly as found here https://hashcat.net/wiki/doku.php?id=example_hashes, and you'll do fine.

[stylo]

Thanks Karamba.

Does it means that my zip2john command generated a wrong hash that can't be parsed by hashcat ?

I see in the exemple that it should begin with $pkzip2$1 and I have $pkzip$1.

[atom]

No but zip2john adds some stuff that's not needed in hashcat. You just need to remove it. See the link from Karamba to find out what exactly.