[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 30 Aug 2016 20:21:33 +0000 (UTC)
From: Sebastian Heyn <sebastian.heyn@...oo.de>
To: <john-users@...ts.openwall.com>
Subject: Re: Which is the correct hash?
Thanks! Wow this is quite a speed enchancement
However I gave up the idea of using many orange pi one's - the core i7 is much faster ;-)
So I keep the fingers crossed that it will find the pass in a reasonable amount of time ;-)
Thanks
--------------------------------------------
magnum <john.magnum@...hmail.com> schrieb am Di, 30.8.2016:
Betreff: Re: [john-users] Which is the correct hash?
An: john-users@...ts.openwall.com
Datum: Dienstag, 30. August, 2016 20:40 Uhr
On 2016-08-30 09:59,
Sebastian Heyn wrote:
> The file has a
weird structure.
>
>
backup.zip <- password encrypted
> ver
1.0 Pic.zip->Neu Textdatei.txt PKZIP Encr: cmplen=12,
decmplen=0, crc=0
> ver 1.0
Pic.zip->bilder.zip PKZIP Encr: cmplen=16969698,
decmplen=16969686, crc=7F501B9D <- the file itself is
also password encrypted
We
can't know that. The fact it has a CRC doesn't mean
it's encrypted.
>
and zip2john doesn't seem to know the -m option. Do I
need to enable anything when configuring it?
>
> ./zip2john -m
../../Backup.zip >backup.hash
>
./zip2john: invalid option -- 'm'
Ouch. I see now we have a tiny
little (literally, one bit!) bug there.
Will commit a fix within minutes.
magnum
>
--------------------------------------------
> magnum <john.magnum@...hmail.com>
schrieb am Mo, 29.8.2016:
>
> Betreff: Re: [john-users] Which is the
correct hash?
> An: john-users@...ts.openwall.com
> Datum: Montag, 29. August, 2016 22:37
Uhr
>
> On
2016-08-29 21:00,
> Sebastian Heyn
wrote:
> > I'm trying to
> bruteforce an old backup.zip file that i
found after over 10
> years and I
wanted to have a look at. Now I obviously forgot
> the password.
>
> My problem is that with
>
john-1.7.9 (gentoo) the zip2john script gives a pkzip
hash
> which is a 92 byte file
($PKZIP$). However when I use
>
jumbo-john from git, zip2john gives a
>
>
> 32mb hashfile containing a
$PKZIP2 hash. which is the
> correct
one? is there any known bugs in either version?
> >
> > ->
the pkzip hash
> brutes at 19k/sec
> > -> the pkzip2 hash
> brutes at 100/sec (--fork=32 gives x32
speed)
> >
>
> any idea which is
> correct hash
to brute force?
>
>
Generic answer: Obviously the newer version.
> The 1.7.9 version is so
> very old you
>
shouldn't use it other than for curious comparisons.
I
>
> can't even
recall all changes to this
> format but
some serious issues
> have been
> addressed, and quite possibly some
performance
> improvements.
>
> A more
> specific answer for your case is that
the difference in
> speed you
> mention MAY be due to the older
> version defaulting to "file
magic"
> whereas the newer does
not. Does this zip file
> contains just
one (or
> few) large file and
> no small ones? You can use -m as in
"zip2john -m
> backup.zip >
OUTFILE" to enable file
> magic
and see where that gets you.
> Just
> beware that resorting to file magic can
be error prone (you
> might
> end up with false negatives) and that
> is why we don't default to it
anymore.
>
>
magnum
>
>
>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
