4

I created test DB file (.kdbx) using KeePassX, after that used keepass2john Python port from this site, but changed line 88:

index += 2

to

index += 4

because the size of this field is 4 bytes instead of 2 (program will show wrong results without this change). It outputs test.hash:

$keepass$*2*0*253*e73cfb2502b6e543902ec7db45c751195c3dd8b8531b744537cbeebd8c641ecd**59ac17e7e0a201e1fae906371d65f6c6**8753d87e52c88988d168c9a4c75e76febecc74fd6ba40c7254d1c47f672d5bbf

After that, I used hashcat, v. 5.1.0 with:

hashcat -a 0 -m 13400 test.hash example.dict

In output i see an error:

Hashfile 'test.hash' on line 1 ($keepa...becc74fd6ba40c7254d1c47f672d5bbf): 
Token length exception
No hashes loaded.

What's wrong? Keepass changed format of DB file and hashcat can't correctly crack it?

Improve this question
7
  • In this case, you need to know what hashcat expects to be the length. They provide examples for the different formats here: hashcat.net/wiki/doku.php?id=example_hashes
    – schroeder ♦
    Sep 25, 2019 at 9:45
  • yeah, and i 've changed *0* to *6000*. like they advice but still got this error.
    – MrSetplus
    Sep 25, 2019 at 9:54
  • are the rest of the fields within the size expectations? one of them won't be
    – schroeder ♦
    Sep 25, 2019 at 9:55
  • unfortunately, no, cause some fields are empty (there are no such parameters in .kdbx file)
    – MrSetplus
    Sep 25, 2019 at 9:58
  • and that's your likely problem
    – schroeder ♦
    Sep 25, 2019 at 9:58

1 Answer 1

Reset to default
3

This question was cross-posted on the hashcat GitHub and answered here.

The relevant keepass2john comments say that only versions prior to KeePass 2.36 are supported for conversion.

Newer versions may use Argon2 or ChaCha20, but hashcat does not support these at this writing. See also related posts on the John the Ripper GitHub issue.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .