Signature unmatched for a pkzip file
#1
Hi , I'm trying to decrypt a pkzip2 zip a pkzip with multi compressed files (17220) 
but i don't know why it is not working 
i tried this command :

Code:
hashcat -m 17220 -a 3 -1 ?l?d ?1?1?1?1?1?1?1?1 hash.txt
 

with this hash :  : 
Code:
$pkzip$4*1*1*0*8*24*9dfb*a45923125f77f5c190fd52ad5d594be85c66f68614a2ab49416706fa136ac524f8cf96c6*1*0*8*24*a5dd*dc923419d9267659b0fc32d41aae61a9248a7168de7a3f79a55fd9156f35bafdc161a22f*1*0*8*24*a5e1*bdea169205086cddba31c06d89f7d50985a43164aa21cfe9ddcd52e1cffeef1c42d7f4cc*2*0*29*1d*6c791c11*0*42*0*29*0168*b0db32dba40d036a6be71d7cbc41321267e2ffa6b28d7bea1ed09f2f381a00b7f7794e5bb80262cc95*$/pkzip$

i don't get the meaning of "?1" so can someone help me ? thanks.
Reply
#2
(10-02-2022, 05:13 PM)Sigan Wrote: Hi , I'm trying to decrypt a pkzip2 zip a pkzip with multi compressed files (17220) 
but i don't know why it is not working 
i tried this command :

Code:
hashcat -m 17220 -a 3 -1 ?l?d ?1?1?1?1?1?1?1?1 hash.txt
 

with this hash :  : 
Code:
$pkzip$4*1*1*0*8*24*9dfb*a45923125f77f5c190fd52ad5d594be85c66f68614a2ab49416706fa136ac524f8cf96c6*1*0*8*24*a5dd*dc923419d9267659b0fc32d41aae61a9248a7168de7a3f79a55fd9156f35bafdc161a22f*1*0*8*24*a5e1*bdea169205086cddba31c06d89f7d50985a43164aa21cfe9ddcd52e1cffeef1c42d7f4cc*2*0*29*1d*6c791c11*0*42*0*29*0168*b0db32dba40d036a6be71d7cbc41321267e2ffa6b28d7bea1ed09f2f381a00b7f7794e5bb80262cc95*$/pkzip$

i don't get the meaning of "?1" so can someone help me ? thanks.

First of all, running hashcat --identify on the given hash reveals that you need to use mode 17225 or 17230.
Second, the meaning of ?1 in your example means, that for each character of the 8 character brute force you're trying to do, it will try characters a-z and 0-9, because parameter -1 has been loaded with ?l (lowercase) and ?d (digits).
Reply
#3
ok i see but i tryed with 17225 and 17300 and it's not working
Reply
#4
(10-02-2022, 06:46 PM)Sigan Wrote: ok i see but i tryed with 17225 and 17300 and it's not working

Not 17300. 17230.
And what exactly do you mean, when saying "not working"?
Reply