hashcat Forum › Support › hashcat v
zip2john Hash Problems

Thread Closed 
Threaded Mode
zip2john Hash Problems
PWn3R Offline
Junior Member
**
Posts: 16
Threads: 3
Joined: May 2017
#1
12-12-2017, 06:59 AM (This post was last modified: 12-12-2017, 06:31 PM by PWn3R.)
Hi All -

Using the latest version of the John Jumbo package and "zip2john" program to generate a hash to attack with hashcat. If I manually modify the hash so that it looks similarly formatted to the example on the examples page, it says "Salt-value exception". If I leave it in the unmodified format that comes out, it says "Signature unmatched". I've tried piping input and copy and pasting the hash value into a file and supplying directly via the command line for the program. I'm thinking that there have been changes to the format of the output of the zip2john program, but I'm not sure how to modify what it's spitting out to make it work. 

I can also confirm that the hash it's spitting out is NOT a pkzip hash.

I know we are not supposed to post hashes, but I can provide one or I can summarize some sections. As always, thank you for your help!

Edit: I just compiled two different versions on ubuntu and the hashes from those do not work either.
Find
PWn3R Offline
Junior Member
**
Posts: 16
Threads: 3
Joined: May 2017
#2
12-18-2017, 08:01 PM
Sorry to "bump" this but just hoping someone can help. I've downloaded and compiled multiple versions of John for linux, and have tried the latest beta version of hashcat.

Hashfile 'hash.txt' on line 1 ($zip2$...599*4ff58d6ee41775bc4680*$/zip2$): Salt-value exception
No hashes loaded.
Find
tacohashcat Offline
Member
***
Posts: 65
Threads: 0
Joined: Nov 2016
#3
12-18-2017, 10:12 PM
This is the example hash from the wiki:
$zip2$*0*3*0*b5d2b7bf57ad5e86a55c400509c672bd*d218*0**ca3d736d03a34165cfa9*$/zip2$
Does yours resemble this structure?
Find
tacohashcat Offline
Member
***
Posts: 65
Threads: 0
Joined: Nov 2016
#4
12-18-2017, 10:14 PM
I also found this thread about zip hashes that was recent: https://hashcat.net/forum/thread-6946.html don't know if they got theirs sorted out or not.
Find
PWn3R Offline
Junior Member
**
Posts: 16
Threads: 3
Joined: May 2017
#5
12-18-2017, 10:48 PM (This post was last modified: 12-18-2017, 10:52 PM by PWn3R.)
Yes, mine resembles that, but with more * dividers in the middle. I could post the hash, but I know we are not supposed to do that. I've tried adjusting to get it to match as closely as possible, but that didn't work either.

Edit: My hash has a bunch of other numbers in the middle between dividers. I just deleted all of those, and 0'd the value that is 0 in the example and it looks like it started. Let's see what happens.
Find
Thread Closed