I would like to open a mysterious old file that I found on my Hard Disk, the contents of which I do not know nor can I guess from its name (PB-mp4-rar.axx).
The file was password-protected with the program AxCrypt (as intuitable from the extension), whose installer I found on the same Hard Disk. The version is definitely <= 1.7.3180.0, let's say it's 1.x.
I assume the password is not something extremely hard so I would like to try opening it with JtR (or HashCat which I never used yet) using combinations of a wordlist I created and, in case of failure, trying brute force.
I found this script and with the following command
sudo python3 axcrypt2john.py PB-mp4-rar.axx > PB.hash
I had the hash below written to a file (PB.hash).
PB-mp4-rar.axx:$axcrypt$*1*15000*d0747f65343a5d2325a8aba62b74e0fa*3be9c7eb033345078c8646b8657e2345de69cb2d3457e300
I launched
sudo john --format=AxCrypt --verbosity=5 PB.hash
and received this output
initUnicode(UNICODE, UTF-8/ISO-8859-1)
UTF-8 -> UTF-8 -> UTF-8
Using default input encoding: UTF-8
Loaded 1 password hash (AxCrypt [PBKDF2-SHA512/SHA1 AES 32/64])
Cost 1 (iteration count) is 15000 for all loaded hashes
Will run 2 OpenMP threads
Loaded 9 hashes with 9 different salts to test db from test vectors
Proceeding with single, rules:Single
but so far it hasn't yielded any results and I don't know if it ever will.
I tried to use HashCat too launching
hashcat -m 13200 -a 3 PB.hash
but returns
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Hashfile 'PB.hash' on line 1 (PB-mp4...8c8646b8657e2345de69cb2d3457e300): Signature unmatched
No hashes loaded.
The hashid
command returns
Unknown hash
Any idea what's wrong here?
john --format=AxCrypt PB.hash
is running without error (you said "so far it hasn't yielded any results"?) ... then you're on the right track - you just have to try different attacks (wordlists, etc.)