[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <0e9a01db7522$0d2d6be0$278843a0$@us>
Date: Sat, 1 Feb 2025 21:25:04 -0600
From: "Scott Techlist" <techlist06@...a.us>
To: <john-users@...ts.openwall.com>
Subject: RE: Zip file assistance
Alexander, thank you for the friendly, very helpful reply. Just before your reply I figured out the mask business was an issue, from seeing that default and digging into what it meant. I found and used maskprocessor to vet my new mask.
I tried just the numerical digits I thought were there at the end and it didn't work so I included all type-able ASCII (I think) and figured out how to get it to increment, I think. It might maybe have a ")" or a "/" in it from an old hint I had.
Also, once I saw the GUI-generated syntax I just skipped the GUI and moved to the command line. The GUI helped me get over the how to get the Hash part. But I think I see how to do it without that helper now.
Right now it's working on:
john.exe --format=PKZIP --mask=MyKnwnPart?a?a?a?a?a?a?a?a?a?a?a --min-length=11 --max-length=20 C:/Users/scott/pw.lst
I forgot what the (16) means, I'm guessing the number of the increment? I'll give it some time. If that does not work (assuming I now have a proper mask), I'll update the version via the link you sent.
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:00 (13) 0g/s 0p/s 0c/s 0C/s
0g 0:00:00:00 1.04% (14) (ETA: 20:51:47) 0g/s 8693Kp/s 8693Kc/s 8693KC/s MyKnwnPartI}..MyKnwnPartH5aa
0g 0:00:00:05 1.05% (15) (ETA: 20:59:42) 0g/s 15248Kp/s 15248Kc/s 15248KC/s MyKnwnPart~!||..MyKnwnPartAEeaa
0g 0:00:00:28 5.79% (15) (ETA: 20:59:50) 0g/s 15812Kp/s 15812Kc/s 15812KC/s MyKnwnPartVs[Ho..MyKnwnPartt~^Ho
0g 0:00:08:34 1.05% (16) (ETA: 10:25:37) 0g/s 15214Kp/s 15214Kc/s 15214KC/s MyKnwnParty(}||..MyKnwnPart aaaa
0g 0:00:23:08 2.82% (16) (ETA: 10:32:22) 0g/s 15089Kp/s 15089Kc/s 15089KC/s MyKnwnPart$[ tZe..MyKnwnParty,VtZe
0g 0:00:24:07 2.94% (16) (ETA: 10:32:26) 0g/s 15087Kp/s 15087Kc/s 15087KC/s MyKnwnPartZy,1?e..MyKnwnPartce&1?e
Scott
>-----Original Message-----
>From: Solar Designer [mailto:solar@...nwall.com]
>Sent: Saturday, February 01, 2025 7:45 PM
>To: john-users@...ts.openwall.com
>Subject: Re: [john-users] Zip file assistance
>
>Hi Scott,
>
>What you're doing is almost right, but not exactly.
>
>On Sat, Feb 01, 2025 at 06:01:44PM -0600, Scott Techlist wrote:
>> JTR jumbo compiled for windows (1.9.0-jumbo-1 64-bit Windows)
>
>That's fine, but you could get better results by using a more recent
>Windows build over the "Download Windows Build" badge/link off our GitHub:
>
>https://github.com/openwall/john
>
>It currently links to:
>
>https://github.com/openwall/john-packages/releases
>
>There have been bug fixes related to PKZIP file support since the
>1.9.0-jumbo-1 release.
>
>That said, if you only need to crack one password, then you can continue
>with your currently installed version first - just correct its usage
>(see below). Only if that doesn't crack the password, you upgrade and
>try again.
>
>> Johnny Windows GUI (2.2)
>
>Few of us in here are familiar with Johnny (we normally use the
>command-line directly).
>
>> I have a couple of zip files I password protected several years ago, almost surely created with
>PKZip, file dates 2009 and 2015 , I've forgotten the tail end of what I am confident is a 1 word
>password. I have a high confidence in knowing the first 10 characters of the password, with the
>remainder probably up to 8 numbers.
>
>You can write this as a mask - first the 10 known characters verbatim,
>then ?d?d?d?d?d?d?d?d for 8 digits (adjust the number to try other than
>8 as well).
>
>> In the GUI, I enter a value for "guess password"
>
>You shouldn't. That's a weird feature, which merely tests _one_
>password guess you enter.
>
>> The command line generated is apparently:
>>
>> C:/Users/scott/Downloads/john-1.9.0-jumbo-1-win64/john-1.9.0-jumbo-1-win64/run/john.exe --
>format=PKZIP --mask= --session=C:/Users/scott/.john/sessions/02-01-25-17-34-36 C:/Users/scott/pw.lst
>
>It looks like you chose mask mode (good!) but did not specify a mask, so
>it's using the default mask instead of what you need. That's the main
>issue. You'll wan to enter your mask with the known portion and ?d's
>into the right Johnny input field in the Mask tab.
>
>> My questions are:
>>
>> 1) Does this look like the correct procedure and resulting command line for my single zip file
>password retrieval?
>
>Almost, but you need the correct mask.
>
>> 2) Is there anything I can do to improve my command? Particularly since I know the start of the
>password.
>
>Yes, see above.
>
>> 3) Any estimate on how long this would take with this single word password?
>
>With the correct mask and given the speed you show, it should take a few
>seconds to find the missing 8 digits.
>
>However, if you're wrong that it's 8 or that it's just digits, then
>it'll take longer for you and John to also try other possibilities.
>
>Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
