0

Some days ago I tried to found the password of a file encrypted with AxCrypt 1.x.
I tried John The Ripper and HashCat, but for unknown reason with the last one I failed, and I will open a new thread about this in the coming days.
Since I was not sure JtR could succeed, I made this thread while the brute-force was running and a user in comments left me with a doubt: if there is no built-in way to distinguish between 128 and 256, it might silently fail.
So I made a try encrypting another file with AxCrypt 1.x using this password:

abc123

I use this to find the hash and I ran JtR. After some time it succeded, but it didn't print the password he found.
So I ran it again but the output says

No password hashes left to crack

I made a screen of the terminal that explain better that me what happened. I tried months previously to find the password of a .rar file with JtR and I succedeed after 90 seconds, but in that case the password was shown in the terminal.
I tried also this following the guide with this regular expression

[\w]?[\w]?[\w]?[\d]?[\d]?[\d]?

and after about a couple of hours it succeeded printing the right password.
At least now I know that finding the password is possible and that JtR can crack my other file with a lot more time without silently failing.

Anyone knows why and how to solve this funny and bizarre problem? I made some mistake that I cannot see?

1 Answer 1

1

It's not really funny or bizarre at all. John is doing exactly what you're instructing

The default verbosity level is 3, you're reducing that to 1 which means some (most) messages (including cracked passwords) will be suppressed. Verbosity >= 2 will print the cracked passwords.

As a sidenote, John typically stores cracked password/hash pairs in the potfile. If you have a file with a hash(es) that has already been cracked and just want to see what the corresponding password is, you can simply do john --show <filename> to get that information.

1
  • I made the screen with verbosity=1 but in the first thread I tried =5 and it was not printed. That's why I made the thread. However --show works, that's the important.
    – user285664
    Commented Nov 28, 2022 at 14:30

You must log in to answer this question.