1

I would like to open a mysterious old file that I found on my Hard Disk, the contents of which I do not know nor can I guess from its name (PB-mp4-rar.axx).

The file was password-protected with the program AxCrypt (as intuitable from the extension), whose installer I found on the same Hard Disk. The version is definitely <= 1.7.3180.0, let's say it's 1.x.

I assume the password is not something extremely hard so I would like to try opening it with JtR (or HashCat which I never used yet) using combinations of a wordlist I created and, in case of failure, trying brute force.
I found this script and with the following command

sudo python3 axcrypt2john.py PB-mp4-rar.axx > PB.hash

I had the hash below written to a file (PB.hash).

PB-mp4-rar.axx:$axcrypt$*1*15000*d0747f65343a5d2325a8aba62b74e0fa*3be9c7eb033345078c8646b8657e2345de69cb2d3457e300

I launched

sudo john --format=AxCrypt --verbosity=5 PB.hash

and received this output

initUnicode(UNICODE, UTF-8/ISO-8859-1)
UTF-8 -> UTF-8 -> UTF-8
Using default input encoding: UTF-8
Loaded 1 password hash (AxCrypt [PBKDF2-SHA512/SHA1 AES 32/64])
Cost 1 (iteration count) is 15000 for all loaded hashes
Will run 2 OpenMP threads
Loaded 9 hashes with 9 different salts to test db from test vectors
Proceeding with single, rules:Single

but so far it hasn't yielded any results and I don't know if it ever will.

I tried to use HashCat too launching

hashcat -m 13200 -a 3 PB.hash

but returns

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Hashfile 'PB.hash' on line 1 (PB-mp4...8c8646b8657e2345de69cb2d3457e300): Signature unmatched
No hashes loaded.

The hashid command returns

Unknown hash

Any idea what's wrong here?

5
  • If john --format=AxCrypt PB.hash is running without error (you said "so far it hasn't yielded any results"?) ... then you're on the right track - you just have to try different attacks (wordlists, etc.) Nov 17, 2022 at 20:44
  • 1
    I thought I had made a mistake because I found this
    – user285664
    Nov 17, 2022 at 21:47
  • Indeed, if there is no built-in way to distinguish between 128 and 256, it might silently fail. This hashcat forum thread may be useful: hashcat.net/forum/thread-9450.html Nov 17, 2022 at 22:04
  • Before using hashcat, did you format the hash the way it expects? hashcat.net/wiki/doku.php?id=example_hashes
    – schroeder
    Nov 18, 2022 at 8:58
  • I'm not sure about what format it expects so I have not manipulated the created file in any way. The string inside is the one posted above and I have given it as input to HashCat exactly as you see it
    – user285664
    Nov 18, 2022 at 13:29

0

You must log in to answer this question.