3

I've been fumbling through the world of Information Security by going through the HTB challenges, and I've come across an issue I just can't seem to find an answer for. During one of the challenges I'm trying to crack a zip password using JTR using the rockyou.txt wordlist as when I use the standard one it goes to incremental. However, JTR finishes in 0.01s with a message that I can't seem to find the meaning for. I first started by getting the hash:

zip2john username.zip > user.txt

ver 1.0 efh 5455 efh 7875 username.zip/username/password.zip PKZIP Encr: 2b chk, TS_chk, cmplen=261, decmplen=249, crc=CFA48832

I have then ran the following:

john -wordlist=/usr/share/wordlists/rockyou.txt user.txt    
                                                                                                                                                                         
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:01 DONE (2021-04-25 12:32) 0g/s 9497Kp/s 9497Kc/s 9497KC/s !!rebound!!..*7¡Vamos!
Session completed

I want to mainly understand what it means with the message !!rebound!!..*7¡Vamos!

I have already done the following:

Checked around for other issues and their fixes, my john.pot file is empty and my log file is as follows:

0:00:00:00 Starting a new session                                                                                                                                                                                                      
23457 0:00:00:00 Loaded a total of 1 password hash                                                                                                                                                                                           
23458 0:00:00:00 Command line: john --wordlist=/usr/share/wordlists/rockyou.txt user.txt                                                                                                                                                     
23459 0:00:00:00 - UTF-8 input encoding enabled                                                                                                                                                                                              
23460 0:00:00:00 - Passwords will be stored UTF-8 encoded in .pot file                                                                                                                                                                       
23461 0:00:00:00 - Hash type: PKZIP (min-len 0, max-len 10 [worst case UTF-8] to 31 [ASCII])                                                                                                                                                 
23462 0:00:00:00 - Algorithm: 32/64                                                                                                                                                                                                          
23463 0:00:00:00 - Will reject candidates longer than 31 bytes                                                                                                                                                                               
23464 0:00:00:00 - Candidate passwords will be buffered and tried in chunks of 4096                                                                                                                                                          
23465 0:00:00:00 Proceeding with wordlist mode                                                                                                                                                                                               
23466 0:00:00:00 - Wordlist file: /usr/share/wordlists/rockyou.txt                                                                                                                                                                           
23467 0:00:00:00 - memory mapping wordlist (139921507 bytes)                                                                                                                                                                                 
23468 0:00:00:00 - No word mangling rules                                                                                                                                                                                                    
23469 0:00:00:00 - No stacked rules                                                                                                                                                                                                          
23470 0:00:00:01 Session completed 

I'm still very new to this world and still learning so forgive me is this blatantly obvious to you and I'm just being silly, but any pointers in the right direction and any help will be greatly appreciated!

1
  • Maybe that was the challenge- that it isn’t in Rockyou! Because in reality if you ask a bank for their admin password- they’re not gonna say “it begins with ‘P’ and ends with ‘D’ ,” are they?! Commented Jun 4 at 21:30

1 Answer 1

0

Normally John would take longer to run through rockyou.txt with a zip hash. I don't know why it takes so short but I guess that you may only have a cropped version of rockyou.txt.

The string !!rebound!!..*7¡Vamos! means, that John is currently trying all passwords in rockyou.txt from !!rebound!! to *7¡Vamos!.


John is not cracking the hash and not giving you a password, either because the hash got corrupted by bash being confused with some special characters or simply because the plaintext is not in rockyou.txt.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .