Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 19 Aug 2017 11:44:51 +0200
From: magnum <john.magnum@...hmail.com>
To: john-users@...ts.openwall.com
Subject: Re: Custom Windows build 1.8.0.9 - What happened to
 zip2john?

On 2017-08-18 23:09, Glen B wrote:
> Ah, interesting! If you don't mind me changing the subject slightly, I'm
> really surprised by what came out of zip2john now. Originally when I ran
> it on my zip file, it would return a typical hash line. Now however, it
> creates a massive (~7.1MB) hash file from a ~1.7MB zip file, and john

That's weird. I think it should be at most double the original size (one 
byte -> two hex digits). Perhaps your zip file is broken/truncated but 
zip2john should detect that and say so.

> still says it can't read the hash. Here's the beginning of the output:
> 
>   >
> GBLabs.zip:$pkzip2$1*1*2*0*1c0f72*1ea40d*7830b902*0*29*8*1c0f72*7830*7eee*4d989f74b755ae9409f8da4da1fbb97cd3aa0cf5a9a9f07b7a92fd01d0c3223cab6253af1cbcf6322a6e22edf1bd082c03ed0b083fb35e853c36cff3c3ac355814
> 
> And it continues on with this massive hexadecimal string, where it
> eventually ends with this:
> 
>   > 89670717610473b4fd3510962114f86*$/pkzip2$:::::..\GBLabs.zip
> 
> I'm recognizing parts of this as a typical hash, but what's with this
> new massive hex string? Could this contribute to why john says it can't
> find a hash string out of this?

You weren't using an older version of John than of zip2john, were you?

magnum

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.