[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAOqDCkmRLqVg1X+M_mY4_HO4ee3Nm8Ez+Q1-YPzmrmsLPt8isQ@mail.gmail.com>
Date: Wed, 25 Mar 2020 14:17:45 -0700
From: sam harris <cheeseandwine5@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: Error in john.conf at line 1
My last message I forgot to mention it is John 1.8-jumbo
On Wed, Mar 25, 2020 at 1:42 PM sam harris <cheeseandwine5@...il.com> wrote:
> Thanks for the reply...I will put an attachment in here.Its a simple
> command that use to work..It is a very simple password but can not crack it
> anymore.My password is "peach" , very straight forward but i keep getting
> the "error in john.config on line one" I have deleted John and reloaded it
> and works but only till I get another john.config error.Also...the.rec file
> sometimes is there and not even after the default rule of recording session
> after an allotted amount of time.Such a pain to keep uninstalling and
> losing all my password list just to reinstall again..Help on that
> john.config for sure
>
> On Tue, Mar 24, 2020 at 12:21 PM magnum <john.magnum@...hmail.com> wrote:
>
>> On 2020-03-17 19:13, magnum wrote:
>> > On 2020-03-17 08:25, Jonathan A wrote:
>> >> I have a sample of an encrypted 7Zip file (I know the password). When
>> >> I use
>> >> 7z2john.pl on it, I get *a long hash (492 kb)*. Then when I try using
>> >> john
>> >> with the known password (i.e. through stdin or wordlist) - it finishes
>> >> unsuccessfully.
>> >
>> > So it does accept it? We hate false negatives :-(
>> >
>> >> The only difference I could see myself between the two is that 7Zip
>> says
>> >> the first file is encrypted with *LZMA2:768k BCJ 7zAES*.
>> >
>> >> (I can share the first sample, but it has malware in it (I'm a malware
>> >> researcher), so it can't go in this email).
>> >
>> > I guess we don't support BCJ. I should be able to fix that. Please mail
>> > med the sample!
>>
>> This was indeed the case. This is now an issue with upstream 7z2hashcat.
>> It has to be fixed first, then John (and hashcat) need to be fixed as
>> well.
>>
>> https://github.com/magnumripper/JohnTheRipper/issues/4234
>>
>> NOTE: If you need to be able to crack 7z with BCJ *before* those issues
>> are fixed, There's a work-around possible (just ignore CRC if LZMAx
>> decompression passed - it *might* give a few false positives but they
>> should be scarce as hen's teeth and anyway it's better than false
>> negatives).
>>
>> Many thanks for reporting. It took me a good while understanding what
>> was happening but it will eventually be sorted.
>>
>> magnum
>>
>>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
