I have video files stacked in zip and I forgot the password.
I want to use hashcat, because john will take much longer, but the hash from hash zip2john isn't compatible and I don't know how to convert it
Hash from zip2john:
$zip2$*0*3*0*XX7486X3X6X2XX74ebba3e9f6119b6f9*5894*28e5fc64*e5c44a6a3ce075a7a6f1073d1d80b28e17f7ddf7fcb70878613b3b1befa227af9d81120b21f107d918b1429eb1b0f3dba8a54e4de794a4077bf84b3289cf378b3459a867929e08be9c0b0bdcf5a8aac51964286b5a302d83e31e357181e3a661ec79c266bbc93e0475654a1780447c53a11a524b5cc3258f31f9f0130f60c640e1ce52e6609e2c264c4f9db993bab4b1cf986be203a729c3fd9adf6965997c2eec6101f8389bf574bcdac0c329cc37343e824a7fb6184a9f6a5527bde48e8f0392df8f5cdfbbc72b3003dd646572b262c3498c5dab90e1fb88f573cb98d8312d90a6ec90d7ed29f4b7e49d997a7daf6e5e35c41424df962e613ca10b6f31c1d4bbffeb0e2b7a06259a90cf80279fa0e1e4e03ab4dc74d72598cbd944a21010952d57d10280e1e3014db6c71b99f9494398d30db2e797b8ebd105056e0a3187abc74c708f6b6b45e27f0d757c6adede97407564d4962c31e3eaa535f08a2f098cf9d6835b4da3f8245b130ba0b7bbb735d6081413af8b1d86b100264341a3c1059f64c22c535cde3d6989738cc8ae7af0d3db3d99cdd5fab9e92b437fe2c95291d9100322067c5c84bd4be1d2f3c00980f62d6c24cb599216341aff26ec88e8fe4b91cd42b4120a17951d127dbd6b1397730dac275634644714e3d1d0ac2c0d0ccbce0b1248dc04bf8733e33dc0d11b0973875dd306d925e56e8fb9074400787540e326625426a1be1d2ec5dd49e56e0094e5b580dc3309bc3239f797b3409e962cabc6ccd22647e7436dcc4db5ad2b894cb24f4f8a2643cc223223e45c05e72c7b99789aa0f9552e40c42a85d0a49457712754758350b24b23e6b78f3b1ee6f9d90539ed5936a52b76e9743bf170a32b656a24fc7aa4933f6a120b346c6afedf047fed780e852115293d2a8db48959bd1b672be7b7b20b43cade72837f02628b35c8cb536815e89a3c67ffc577b4510e49deb00432115333f0adb812113d991587285159ff86db119863ccc420e209e96b63b915a7dd47f77a6c35d458b6a05e07a0bd02d567016e26ca1714c22bf338a1649a897abeb74a38dde4f07916901b249f4db64b2904f1ec09b167b87ef2e656211ad855515c ... Hashcat:
C:\Users\Admin\Desktop\hashcat-6.2.6>hashcat "C:\Users\Admin\Desktop\try.txt" hashcat (v6.2.6) starting in autodetect mode And this is the result:
Oversized line detected! Truncated 1355545096 bytes Oversized line detected! Truncated 1355545144 bytes Oversized line detected! Truncated 1355545096 bytes Oversized line detected! Truncated 1355545144 bytes Oversized line detected! Truncated 1355545096 bytes Oversized line detected! Truncated 1355545144 bytes Oversized line detected! Truncated 1355545096 bytes these continues and I do not know if it is working.
However, john works
C:\Users\Admin\Desktop\john-1.9.0-jumbo-1-win64\john-1.9.0- jumbo-1-win64\run>john "C:\Users\Admin\Desktop\try.txt" Warning: detected hash type "ZIP", but the string is also recognized as "ZIP-opencl" Use the "--format=ZIP-opencl" option to force loading these as that type instead Using default input encoding: UTF-8 Loaded 1 password hash (ZIP, WinZip [PBKDF2-SHA1 256/256 AVX2 8x]) Will run 4 OpenMP threads Proceeding with single, rules:Single Press 'q' or Ctrl-C to abort, almost any other key for status Almost done: Processing the remaining buffered candidate passwords, if any. Warning: Only 30 candidates buffered for the current salt, minimum 32 needed for performance. Proceeding with wordlist:password.lst, rules:Wordlist Proceeding with incremental:ASCII 0g 0:00:13:10 3/3 0g/s 19129p/s 19129c/s 19129C/s rynz2w..ry1581 0g 0:00:13:13 3/3 0g/s 19134p/s 19134c/s 19134C/s rh18mr..rhs158 How do I convert the zip2john output to something hashcat can use?
file <zipfile>as well aszip2john <zipfile>? That would include the detected details of the file. Helps to speak directly about what is being detected so context can be provided around the hash.