0

I have a zip file containing a JPEG image of size 3.5 MB, encrypted with AES-256. I used WinZip for the creation of the zip file. In order to create the hash of the zip file, I used John The Ripper's zip2john which created 2 hashes, where the hashes starts and ends like this:

$zip2$*0*3*0*7076f893dbcdc27f228fa179ff990807*86eb*b0920*   ...   *$/zip2$

$pkzip2$1*1*2*0*b093c*b3abd*705a9e08*0*50*63*b093c*705a*6cf1*   ...   *$/pkzip2$

Now when i saved the hash to a textfile, the file size became 14.9 MB. In order to crack the password I have downloaded and compiled the latest hashcat (v5.1.0-1631-gcc4fd48a) from GitHub and PRINCE processor for word generation. Now when I start hashcat I get following error:

root@sam-workstation:~/Desktop/dddd# ./princeprocessor-0.22/pp64.bin < wl/mywords.txt --pw-min=8 --pw-max=20 | /installs/apps/hashcat/hashcat -a 0 -m 13600 -w 4 northern-lights-hash.txt 
hashcat (v5.1.0-1631-gcc4fd48a) starting...

* Device #1: WARNING! Kernel exec timeout is not disabled.
             This may cause "CL_OUT_OF_RESOURCES" or related errors.
             To disable the timeout, see: https://hashcat.net/q/timeoutpatch
* Device #3: WARNING! Kernel exec timeout is not disabled.
             This may cause "CL_OUT_OF_RESOURCES" or related errors.
             To disable the timeout, see: https://hashcat.net/q/timeoutpatch
nvmlDeviceGetFanSpeed(): Not Supported

CUDA API (CUDA 10.2)
====================
* Device #1: GeForce GTX 1660 Ti, 5092/5944 MB, 24MCU

OpenCL API (OpenCL 2.1 ) - Platform #1 [Intel(R) Corporation]
=============================================================
* Device #2: Intel(R) Gen9 HD Graphics NEO, 12671/12735 MB (4095 MB allocatable), 24MCU

OpenCL API (OpenCL 1.2 CUDA 10.2.115) - Platform #2 [NVIDIA Corporation]
========================================================================
* Device #3: GeForce GTX 1660 Ti, skipped

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Counted lines in northern-lights-hash.txt...
Oversized line detected! Truncated 14179435 bytes

Oversized line detected! Truncated 14179435 bytes
Hashfile 'northern-lights-hash.txt' on line 1 ($zip2$...9d33a3321d1f1654688b199af944ad41): Separator unmatched
No hashes loaded.

But, hashcat doesn't return any error if the zip file contains a small txt file, of which the hash generated was also very small in size.

I couldn't figure out where the problem is. I am confused between whether JTR producing the wrong hash, or is hashcat designed to crack hashes with some max hash length.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.