Posts: 26
Threads: 3
Joined: Aug 2017
07-26-2018, 02:12 PM
(This post was last modified: 07-26-2018, 02:27 PM by undeath.
Edit Reason: hash removed
)
Ok, I downloaded, I launched Python command line (I do not know how to do it any other way) :
python axcrypt2john.py R485hgtd-jpg.axx (> my encrypted photo name)
And i get :
R485hgtd-jpg.axx:$axcrypt$*1*15000*
redacted
I saw here :
https://hashcat.net/wiki/doku.php?id=example_hashes , that the hash of an encrypted file with Axcrypt should look like that :
$ axcrypt $ * 1 * 10000 * aaf4a5b4a7185551fea2585ed69fe246 * 45c616e901e48c6cac7ff14e8cd99113393be259c595325e
Other than a 15000 instead of a 10000 and no space in some places
$axcrypt$*1*15000* >>> $ axcrypt $ * 1 * 10000 *
I feel like it looks like it should be. But ... so ... now, what should i do?
Posts: 2,301
Threads: 11
Joined: Jul 2010
Of course those numbers are not always identical. Otherwise there'd be no reason to include them in the hash string. There should not be any spaces anywhere.
Posts: 26
Threads: 3
Joined: Aug 2017
So, no space, the 10000 number that can be 15000, so maybe it's a good hash.
After searching (I did not find much), I copy my hash into a text file, I saved it as hash.txt and with a UTF-8 encoding.
Then I copy this file into the hashcat directory and I launched the following command line:
hashcat64 -m 13200 -a 3 -1? l? u? d? 1? 1? 1? 1? 1? 1? 1 hash.txt
There was a first error with timeout and the answer was on the hashcat site with the registry.
But after I have a second error, I get:
C: \ hashcat-4.1.0> hashcat64 -m 13200 -a 3 -1? L? U? D? 1? 1? 1? 1? 1? 1? 1 hash.txt
hashcat (v4.1.0) starting ...
OpenCL Platform # 1: NVIDIA Corporation
======================================
* Device # 1: GeForce GTX 1050 Ti, 1024/4096 MB allocatable, 6MCU
Hash '? 1? 1? 1? 1? 1? 1? 1? 1': Line-length exception
No hashes loaded.
Started: Fri Jul 27 16:12:42 2018
Stopped: Fri Jul 27 16:12:42 2018
C: \ hashcat-4.1.0>
I specify that I believe that my lost password must have uppercase and lowercase letters, numbers and that its length must be 6 to 8 characters.
What can i do ?
Posts: 2,301
Threads: 11
Joined: Jul 2010
your order of commands is wrong. First hash file, then mask/wordlist.
Posts: 26
Threads: 3
Joined: Aug 2017
Hello, well, I tried all the solutions below but nothing ???
C:\hashcat-4.1.0>hashcat64 hash.txt -m 13200 -a 3 -1 ?l?u?d 1?1?1?1?1?1?1?1?
hashcat (v4.1.0) starting...
OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: GeForce GTX 1050 Ti, 1024/4096 MB allocatable, 6MCU
Hashfile 'hash.txt' on line 1 (´╗┐$ax...8b02ac978403562fb0adc0896df8ed60): Signature unmatched
No hashes loaded.
Started: Sun Jul 29 18:17:59 2018
Stopped: Sun Jul 29 18:18:00 2018
and this one
C:\hashcat-4.1.0>hashcat64 -m 13200 hash.txt -a 3 -1 ?l?u?d 1?1?1?1?1?1?1?1?
hashcat (v4.1.0) starting...
OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: GeForce GTX 1050 Ti, 1024/4096 MB allocatable, 6MCU
Hashfile 'hash.txt' on line 1 (´╗┐$ax...8b02ac978403562fb0adc0896df8ed60): Signature unmatched
No hashes loaded.
Started: Sun Jul 29 18:23:18 2018
Stopped: Sun Jul 29 18:23:18 2018
and this another
C:\hashcat-4.1.0>hashcat64 -m 13200 -a 3 hash.txt -1 ?l?u?d 1?1?1?1?1?1?1?1?
hashcat (v4.1.0) starting...
OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: GeForce GTX 1050 Ti, 1024/4096 MB allocatable, 6MCU
Hashfile 'hash.txt' on line 1 (´╗┐$ax...8b02ac978403562fb0adc0896df8ed60): Signature unmatched
No hashes loaded.
Started: Sun Jul 29 18:25:20 2018
Stopped: Sun Jul 29 18:25:20 2018
One more idea ?
Posts: 2,301
Threads: 11
Joined: Jul 2010
you have garbage characters at the beginning of the hash file. See the first two characters. Probably a BOM. If you use a proper text editor you can disable the BOM.
Posts: 5,185
Threads: 230
Joined: Apr 2010
PS: I've add a BOM detection to 4.2.0, it will abort the hashcat session if detected
Posts: 26
Threads: 3
Joined: Aug 2017
So, the next version of Hashcat could solve this problem?
When we talk about stray characters, what are those, which are just after 15000 *, so cc?
$axcrypt$*1*15000*cc6d4549f04a2bb6a184f34e034dfe14* ...... etc ......
I do not know anything about it, I trust Python and axcrypt2john.py to find the right hach, so know if it's the right one, I do not know.
What can I do? Delete for example cc and retest?
Have you got some an exemple of software proper text editor ?
I had another question, is the axcrypt2john python file made for Axcrypt 1.x or Axcrypt 2.x, because I'm trying to find the password for a file that was Encrypted with Axcrypt 1.7.2126.0 ...
Posts: 26
Threads: 3
Joined: Aug 2017
Well, I did not disable cc, since I do not know how to do it, I removed them and ... it gives nothing
Posts: 8
Threads: 2
Joined: Jun 2018
Your hashcat output has the following line:
Hashfile 'hash.txt' on line 1 (´╗┐$ax...8b02ac978403562fb0adc0896df8ed60): Signature unmatched
'╗┐' is what you want to delete. Everything including and after the first '$' should make up the hash that you need. 'cc' is part of your hash.
