Used wrong mode for PKZIP?

[cybhashcat]

Hey guys,
i was given zip files to crack, and according to zip2john the hashes are:

Code:

$pkzip2$3*1*1*0*8*24*ee4c*5edb*492edbbe78f98606d8437d7cb3e759b1c046fc4f318010df342ce93388211a2392182475*1*0*8*24*c1c6*5edb*492edbbe78f98606d8437d7ccb3487f8506d46dd14f4b14e21d3e35559913cb77c4eb9b2*2*0*1d*11*97dd2617*8239*39*0*1d*97dd*772a*ece2f6a911d76d04f070b8ae90a26b97b74669cd198688399f68a81d09*$/pkzip2$

$pkzip2$3*1*1*0*8*24*4630*5e54*906ad67edca72e9f37ef4e5ead91eb7475312621e92215656ae882b60a8e1c2fd8bf7f4f*1*0*8*24*3362*6848*39c53ac8a7904e606ca61cc2180dfcbc9d8704b0ac61cbf1ca3472c7dae0011196220bde*2*0*1d*11*97dd2617*f022*26*0*1d*97dd*8893*002e2dc1798308557a17e435d6b35467dbd8de6cdd5bfaa20e01de5f61*$/pkzip2$

According to the example hashes i assumed, due to leading (3*1*1*0*8*24) that this must be -m 17220 PKZIP (Compressed Multi-File), however, i am getting a message saying "Hash contains unsupported compression type for current mode"

I tried using 17230 and the hashes were instantly cracked to " bonenfant" and "043minuses" (respectively), but even when using PKWARE's PKZIP, the passwords do not work. is it possible that this is a false result because i used the wrong module? since 17225 also runs (but i was unable to crack anything)

thanks guys.

[Snoopy]

Hey guys,
i was given zip files to crack, and according to zip2john the hashes are:

Code:

$pkzip2$3*1*1*0*8*24*ee4c*5edb*492edbbe78f98606d8437d7cb3e759b1c046fc4f318010df342ce93388211a2392182475*1*0*8*24*c1c6*5edb*492edbbe78f98606d8437d7ccb3487f8506d46dd14f4b14e21d3e35559913cb77c4eb9b2*2*0*1d*11*97dd2617*8239*39*0*1d*97dd*772a*ece2f6a911d76d04f070b8ae90a26b97b74669cd198688399f68a81d09*$/pkzip2$

$pkzip2$3*1*1*0*8*24*4630*5e54*906ad67edca72e9f37ef4e5ead91eb7475312621e92215656ae882b60a8e1c2fd8bf7f4f*1*0*8*24*3362*6848*39c53ac8a7904e606ca61cc2180dfcbc9d8704b0ac61cbf1ca3472c7dae0011196220bde*2*0*1d*11*97dd2617*f022*26*0*1d*97dd*8893*002e2dc1798308557a17e435d6b35467dbd8de6cdd5bfaa20e01de5f61*$/pkzip2$

According to the example hashes i assumed, due to leading (3*1*1*0*8*24) that this must be -m 17220 PKZIP (Compressed Multi-File), however, i am getting a message saying "Hash contains unsupported compression type for current mode"

I tried using 17230 and the hashes were instantly cracked to " bonenfant" and "043minuses" (respectively), but even when using PKWARE's PKZIP, the passwords do not work. is it possible that this is a false result because i used the wrong module? since 17225 also runs (but i was unable to crack anything)

thanks guys.

magnum postet an issue here

https://github.com/hashcat/hashcat/issues/2719

according to this, there is an update to zip2john and no more need of mode pkzip2, update zip2john and try again