3

I am trying to recover a 7z file, but have forgotten the password. It's completely AES-256 encrypted (i.e. not even the filenames are available).

Steps:

  1. Generated hash file with 7z2hashcat.pl
  2. Ran a mask attack using hashcat -a 3 -m 11600 my.hash masks\rockyou-7-2592000.hcmask
  3. After ~55 hours, hashcat completed with status cracked
  4. The password identified in the hashcat.potfile is rejected by 7-zip

I found a discussion on hash collisions with old Office files here: https://security.stackexchange.com/a/211924

Is 7zip similarly vulnerable to hash collisions?

I would just try the steps in the linked post and see if I could generate more passwords, but given it could tie up my GPU for weeks, I'd appreciate any thoughts!

Ben Owen
  • 31
  • 2

1 Answers1

1

Short answer is yes, it suffers with hash collision

You should (in this case) use: --keep-guessing

Since with 7z passwords may have false positives, you need to keep guessing to see other alternatives. To save progress on hashcat you should use

--session SESSION_NAME [and any other commands like -w -a]

Then to restore from last checkpoint:

--session SESSION_NAME --restore
dyp1xy
  • 21
  • 3