[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAOqDCkmSM9ZgWQFbWRfB1B2pii+zFb1yN4_hDJVYJar78fsedA@mail.gmail.com>
Date: Wed, 25 Mar 2020 13:42:36 -0700
From: sam harris <cheeseandwine5@...il.com>
To: john-users@...ts.openwall.com
Subject: Error in john.conf at line 1
Thanks for the reply...I will put an attachment in here.Its a simple
command that use to work..It is a very simple password but can not crack it
anymore.My password is "peach" , very straight forward but i keep getting
the "error in john.config on line one" I have deleted John and reloaded it
and works but only till I get another john.config error.Also...the.rec file
sometimes is there and not even after the default rule of recording session
after an allotted amount of time.Such a pain to keep uninstalling and
losing all my password list just to reinstall again..Help on that
john.config for sure
On Tue, Mar 24, 2020 at 12:21 PM magnum <john.magnum@...hmail.com> wrote:
> On 2020-03-17 19:13, magnum wrote:
> > On 2020-03-17 08:25, Jonathan A wrote:
> >> I have a sample of an encrypted 7Zip file (I know the password). When
> >> I use
> >> 7z2john.pl on it, I get *a long hash (492 kb)*. Then when I try using
> >> john
> >> with the known password (i.e. through stdin or wordlist) - it finishes
> >> unsuccessfully.
> >
> > So it does accept it? We hate false negatives :-(
> >
> >> The only difference I could see myself between the two is that 7Zip says
> >> the first file is encrypted with *LZMA2:768k BCJ 7zAES*.
> >
> >> (I can share the first sample, but it has malware in it (I'm a malware
> >> researcher), so it can't go in this email).
> >
> > I guess we don't support BCJ. I should be able to fix that. Please mail
> > med the sample!
>
> This was indeed the case. This is now an issue with upstream 7z2hashcat.
> It has to be fixed first, then John (and hashcat) need to be fixed as well.
>
> https://github.com/magnumripper/JohnTheRipper/issues/4234
>
> NOTE: If you need to be able to crack 7z with BCJ *before* those issues
> are fixed, There's a work-around possible (just ignore CRC if LZMAx
> decompression passed - it *might* give a few false positives but they
> should be scarce as hen's teeth and anyway it's better than false
> negatives).
>
> Many thanks for reporting. It took me a good while understanding what
> was happening but it will eventually be sorted.
>
> magnum
>
>
Content of type "text/html" skipped
View attachment "New Text Document.txt" of type "text/plain" (239 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
