4

I am trying to recover a 7z file, but have forgotten the password. It's completely AES-256 encrypted (i.e. not even the filenames are available).

Steps:

  1. Generated hash file with 7z2hashcat.pl
  2. Ran a mask attack using hashcat -a 3 -m 11600 my.hash masks\rockyou-7-2592000.hcmask
  3. After ~55 hours, hashcat completed with status cracked
  4. The password identified in the hashcat.potfile is rejected by 7-zip

I found a discussion on hash collisions with old Office files here: https://security.stackexchange.com/a/211924

Is 7zip similarly vulnerable to hash collisions?

I would just try the steps in the linked post and see if I could generate more passwords, but given it could tie up my GPU for weeks, I'd appreciate any thoughts!

3
  • And, the version of 7-Zip?
    – kelalaka
    Commented Aug 26, 2020 at 14:08
  • Unknown, the file was created in 2016, so not a recent version
    – Ben Owen
    Commented Aug 26, 2020 at 14:29
  • Is the password in the potifile maybe saved in Hex Format and not as a normal string? Commented Sep 13, 2022 at 15:41

1 Answer 1

2

Short answer is yes, it suffers with hash collision

You should (in this case) use: --keep-guessing

Since with 7z passwords may have false positives, you need to keep guessing to see other alternatives. To save progress on hashcat you should use

--session SESSION_NAME [and any other commands like -w -a]

Then to restore from last checkpoint:

--session SESSION_NAME --restore

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .