1

I have video files stacked in zip and I forgot the password.

I want to use hashcat, because john will take much longer, but the hash from hash zip2john isn't compatible and I don't know how to convert it

Hash from zip2john:

  $zip2$*0*3*0*XX7486X3X6X2XX74ebba3e9f6119b6f9*5894*28e5fc64*e5c44a6a3ce075a7a6f1073d1d80b28e17f7ddf7fcb70878613b3b1befa227af9d81120b21f107d918b1429eb1b0f3dba8a54e4de794a4077bf84b3289cf378b3459a867929e08be9c0b0bdcf5a8aac51964286b5a302d83e31e357181e3a661ec79c266bbc93e0475654a1780447c53a11a524b5cc3258f31f9f0130f60c640e1ce52e6609e2c264c4f9db993bab4b1cf986be203a729c3fd9adf6965997c2eec6101f8389bf574bcdac0c329cc37343e824a7fb6184a9f6a5527bde48e8f0392df8f5cdfbbc72b3003dd646572b262c3498c5dab90e1fb88f573cb98d8312d90a6ec90d7ed29f4b7e49d997a7daf6e5e35c41424df962e613ca10b6f31c1d4bbffeb0e2b7a06259a90cf80279fa0e1e4e03ab4dc74d72598cbd944a21010952d57d10280e1e3014db6c71b99f9494398d30db2e797b8ebd105056e0a3187abc74c708f6b6b45e27f0d757c6adede97407564d4962c31e3eaa535f08a2f098cf9d6835b4da3f8245b130ba0b7bbb735d6081413af8b1d86b100264341a3c1059f64c22c535cde3d6989738cc8ae7af0d3db3d99cdd5fab9e92b437fe2c95291d9100322067c5c84bd4be1d2f3c00980f62d6c24cb599216341aff26ec88e8fe4b91cd42b4120a17951d127dbd6b1397730dac275634644714e3d1d0ac2c0d0ccbce0b1248dc04bf8733e33dc0d11b0973875dd306d925e56e8fb9074400787540e326625426a1be1d2ec5dd49e56e0094e5b580dc3309bc3239f797b3409e962cabc6ccd22647e7436dcc4db5ad2b894cb24f4f8a2643cc223223e45c05e72c7b99789aa0f9552e40c42a85d0a49457712754758350b24b23e6b78f3b1ee6f9d90539ed5936a52b76e9743bf170a32b656a24fc7aa4933f6a120b346c6afedf047fed780e852115293d2a8db48959bd1b672be7b7b20b43cade72837f02628b35c8cb536815e89a3c67ffc577b4510e49deb00432115333f0adb812113d991587285159ff86db119863ccc420e209e96b63b915a7dd47f77a6c35d458b6a05e07a0bd02d567016e26ca1714c22bf338a1649a897abeb74a38dde4f07916901b249f4db64b2904f1ec09b167b87ef2e656211ad855515c
...

Hashcat:

    C:\Users\Admin\Desktop\hashcat-6.2.6>hashcat 
    "C:\Users\Admin\Desktop\try.txt"
    hashcat (v6.2.6) starting in autodetect mode

And this is the result:

    Oversized line detected! Truncated 1355545096 bytes

    Oversized line detected! Truncated 1355545144 bytes

    Oversized line detected! Truncated 1355545096 bytes

    Oversized line detected! Truncated 1355545144 bytes

    Oversized line detected! Truncated 1355545096 bytes

    Oversized line detected! Truncated 1355545144 bytes

    Oversized line detected! Truncated 1355545096 bytes

these continues and I do not know if it is working.

However, john works

    C:\Users\Admin\Desktop\john-1.9.0-jumbo-1-win64\john-1.9.0- 
    jumbo-1-win64\run>john "C:\Users\Admin\Desktop\try.txt"
    Warning: detected hash type "ZIP", but the string is also recognized as "ZIP-opencl"
    Use the "--format=ZIP-opencl" option to force loading these as that type instead
    Using default input encoding: UTF-8
    Loaded 1 password hash (ZIP, WinZip [PBKDF2-SHA1 256/256 AVX2 8x])
    Will run 4 OpenMP threads
    Proceeding with single, rules:Single
    Press 'q' or Ctrl-C to abort, almost any other key for status
    Almost done: Processing the remaining buffered candidate passwords, if any.
    Warning: Only 30 candidates buffered for the current salt, minimum 32 needed for performance.
    Proceeding with wordlist:password.lst, rules:Wordlist
    Proceeding with incremental:ASCII
    0g 0:00:13:10  3/3 0g/s 19129p/s 19129c/s 19129C/s rynz2w..ry1581
    0g 0:00:13:13  3/3 0g/s 19134p/s 19134c/s 19134C/s rh18mr..rhs158

How do I convert the zip2john output to something hashcat can use?

Improve this question
2
  • Could you supply the output of file <zipfile> as well as zip2john <zipfile>? That would include the detected details of the file. Helps to speak directly about what is being detected so context can be provided around the hash.
    – signus
    Commented Mar 7 at 4:01
  • link @signus . This is the output of the zip2john
    – GMike
    Commented Mar 7 at 6:41

1 Answer 1

Reset to default
1

The output of zip2john is the correct format for hashcat. However, hashcat has a size limitation when cracking Winzip hashes, and it seems your file is too big.

More info:

Improve this answer
2
  • 'Hashfile 'C:\Users\Admin\Desktop\test.txt' on line 1 (try.zi...7af39bec0bdeda837a92f51f113b97d3): Separator unmatched' 'Hashfile 'C:\Users\Admin\Desktop\test.txt' on line 2 (try.zi...ced2c2c0258ebe6388911c83d32c91fd): Signature unmatched'
    – GMike
    Commented Mar 7 at 16:04
  • those are the result in hashcat that is why I thought that the hash is not compatible.
    – GMike
    Commented Mar 7 at 16:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .