[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4b40d1b87d5bbe78c94243a6ec8acdcb@smtp.hushmail.com>
Date: Tue, 24 Mar 2020 20:20:56 +0100
From: magnum <john.magnum@...hmail.com>
To: john-users@...ts.openwall.com
Subject: Re: Some 7Zip hashes can't be cracked?
On 2020-03-17 19:13, magnum wrote:
> On 2020-03-17 08:25, Jonathan A wrote:
>> I have a sample of an encrypted 7Zip file (I know the password). When
>> I use
>> 7z2john.pl on it, I get *a long hash (492 kb)*. Then when I try using
>> john
>> with the known password (i.e. through stdin or wordlist) - it finishes
>> unsuccessfully.
>
> So it does accept it? We hate false negatives :-(
>
>> The only difference I could see myself between the two is that 7Zip says
>> the first file is encrypted with *LZMA2:768k BCJ 7zAES*.
>
>> (I can share the first sample, but it has malware in it (I'm a malware
>> researcher), so it can't go in this email).
>
> I guess we don't support BCJ. I should be able to fix that. Please mail
> med the sample!
This was indeed the case. This is now an issue with upstream 7z2hashcat.
It has to be fixed first, then John (and hashcat) need to be fixed as well.
https://github.com/magnumripper/JohnTheRipper/issues/4234
NOTE: If you need to be able to crack 7z with BCJ *before* those issues
are fixed, There's a work-around possible (just ignore CRC if LZMAx
decompression passed - it *might* give a few false positives but they
should be scarce as hen's teeth and anyway it's better than false
negatives).
Many thanks for reporting. It took me a good while understanding what
was happening but it will eventually be sorted.
magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
