[john-users] Custom Windows build 1.8.0.9 - What happened to zip2john?

[Glen B]

Greetings,

I was having issues with earlier builds and getting a hash of a ZIP file
read properly (according to zip2john at the time, it was a pkzip2
format). I've downloaded the latest Windows build from the wiki, John
the Ripper v1.8.0.9-jumbo-1-bleeding (Bleeding version on 2017-03-06).
Something that's new to me is that the zip2john executable seems to have
been replaced with a different file. The text initially reads "symlink"
with some non-text characters following. I'm assuming this is a linux
symlink file, which neither Windows nor I know how to interpret.

I'm not having much luck searching GitHub for an explanation of this
change. Can anyone offer any tips on how I'm supposed to proceed with
crackin

[magnum]

Post by Glen B
I was having issues with earlier builds and getting a hash of a ZIP file
read properly (according to zip2john at the time, it was a pkzip2
format). I've downloaded the latest Windows build from the wiki, John
the Ripper v1.8.0.9-jumbo-1-bleeding (Bleeding version on 2017-03-06).
Something that's new to me is that the zip2john executable seems to have
been replaced with a different file. The text initially reads "symlink"
with some non-text characters following. I'm assuming this is a linux
symlink file, which neither Windows nor I know how to interpret.
I'm not having much luck searching GitHub for an explanation of this
change. Can anyone offer any tips on how I'm supposed to proceed with
cracking a zip file at this point?

I believe you need to run from a Cygwin shell, not the CMD.EXE Windows
shell. If you can find a MinGW build instead I guess the problem will be
gone.

magnum

[Solar Designer]

Post by magnum

Post by Glen B
I was having issues with earlier builds and getting a hash of a ZIP file
read properly (according to zip2john at the time, it was a pkzip2
format). I've downloaded the latest Windows build from the wiki, John
the Ripper v1.8.0.9-jumbo-1-bleeding (Bleeding version on 2017-03-06).
Something that's new to me is that the zip2john executable seems to have
been replaced with a different file. The text initially reads "symlink"
with some non-text characters following. I'm assuming this is a linux
symlink file, which neither Windows nor I know how to interpret.
I'm not having much luck searching GitHub for an explanation of this
change. Can anyone offer any tips on how I'm supposed to proceed with
cracking a zip file at this point?

I believe you need to run from a Cygwin shell, not the CMD.EXE Windows
shell.

That's what I think, too.

However, the reported problem indicates that something went wrong with
our Cygwin builds, and if it's still the case then we need to fix that.
We should have continued using the symlink.c wrapper instead of relying
on Cygwin's symlinks in that build. Now, even more recent changes (as
discussed on a GitHub issue on fuzzing) may have changed that further.
Either way, our future Cygwin builds should be such that they'd be
usable without Cygwin installed, as long as the DLLs are included.

Alexander

[Glen B]

I really liked the earlier versions of JtR that were self-contained and didn't require downloading anything else to be honest. If this is just a symlink though, what is it symlink-ing to? The john binary? If so, couldn't I just run john directly?

I'm loading an Ubuntu VM right now to hopefully get to the bottom of this (and crack this bloody zip file that I've been working at for the past few days, lol)

Glen

----- Reply message -----
From: "Solar Designer" <***@openwall.com>
To: "john-***@lists.openwall.com" <john-***@lists.openwall.com>
Subject: [john-users] Custom Windows build 1.8.0.9 - What happened to zip2john?
Date: Fri, Aug 18, 2017 10:11 AM

Post by magnum

Post by Glen B
I was having issues with earlier builds and getting a hash of a ZIP file
read properly (according to zip2john at the time, it was a pkzip2
format). I've downloaded the latest Windows build from the wiki, John
the Ripper v1.8.0.9-jumbo-1-bleeding (Bleeding version on 2017-03-06).
Something that's new to me is that the zip2john executable seems to have
been replaced with a different file. The text initially reads "symlink"
with some non-text characters following. I'm assuming this is a linux
symlink file, which neither Windows nor I know how to interpret.
I'm not having much luck searching GitHub for an explanation of this
change. Can anyone offer any tips on how I'm supposed to proceed with
cracking a zip file at this point?

I believe you need to run from a Cygwin shell, not the CMD.EXE Windows
shell.

That's what I think, too.

However, the reported problem indicates that something went wrong with
our Cygwin builds, and if it's still the case then we need to fix that.
We should have continued using the symlink.c wrapper instead of relying
on Cygwin's symlinks in that build. Now, even more recent changes (as
discussed on a GitHub issue on fuzzing) may have changed that further.
Either way, our future Cygwin builds should be such that they'd be
usable without Cygwin installed, as long as the DLLs are included.

Alexander

[Solar Designer]

Post by Glen B
I really liked the earlier versions of JtR that were self-contained and didn't require downloading anything else to be honest.

This build wasn't meant to require anything extra either. According to
what you said, it's just a bug.

Post by Glen B
If this is just a symlink though, what is it symlink-ing to? The john binary? If so, couldn't I just run john directly?

Yes. You could run "john" directly if you copy or rename it so that
it'd be called "zip2john".

Alexander

[Glen B]

Ah, interesting! If you don't mind me changing the subject slightly, I'm
really surprised by what came out of zip2john now. Originally when I ran
it on my zip file, it would return a typical hash line. Now however, it
creates a massive (~7.1MB) hash file from a ~1.7MB zip file, and john
still says it can't read the hash. Here's the beginning of the output:
GBLabs.zip:$pkzip2$1*1*2*0*1c0f72*1ea40d*7830b902*0*29*8*1c0f72*7830*7eee*4d989f74b755ae9409f8da4da1fbb97cd3aa0cf5a9a9f07b7a92fd01d0c3223cab6253af1cbcf6322a6e22edf1bd082c03ed0b083fb35e853c36cff3c3ac355814

And it continues on with this massive hexadecimal string, where it

89670717610473b4fd3510962114f86*$/pkzip2$:::::..\GBLabs.zip

I'm recognizing parts of this as a typical hash, but what's with this
new massive hex string? Could this contribute to why john says it can't
find a hash string out of this?

Glen

Post by Glen B
I really liked the earlier versions of JtR that were self-contained and didn't require downloading anything else to be honest.

This build wasn't meant to require anything extra either. According to
what you said, it's just a bug.

Post by Glen B
If this is just a symlink though, what is it symlink-ing to? The john binary? If so, couldn't I just run john directly?

Yes. You could run "john" directly if you copy or rename it so that
it'd be called "zip2john".
Alexander

[magnum]

Post by Glen B
Ah, interesting! If you don't mind me changing the subject slightly, I'm
really surprised by what came out of zip2john now. Originally when I ran
it on my zip file, it would return a typical hash line. Now however, it
creates a massive (~7.1MB) hash file from a ~1.7MB zip file, and john

That's weird. I think it should be at most double the original size (one
byte -> two hex digits). Perhaps your zip file is broken/truncated but
zip2john should detect that and say so.

Post by Glen B
GBLabs.zip:$pkzip2$1*1*2*0*1c0f72*1ea40d*7830b902*0*29*8*1c0f72*7830*7eee*4d989f74b755ae9409f8da4da1fbb97cd3aa0cf5a9a9f07b7a92fd01d0c3223cab6253af1cbcf6322a6e22edf1bd082c03ed0b083fb35e853c36cff3c3ac355814
And it continues on with this massive hexadecimal string, where it

89670717610473b4fd3510962114f86*$/pkzip2$:::::..\GBLabs.zip

I'm recognizing parts of this as a typical hash, but what's with this
new massive hex string? Could this contribute to why john says it can't
find a hash string out of this?

You weren't using an older version of John than of zip2john, were you?

magnum

[Glen B]

I hope not... I just copied john to "zip2john" and ran it that way as
Alexander suggested. Running john with no parameters outputs "John the
Ripper 1.8.0.9-jumbo-1-bleeding MPI + OMP [cygwin 64-bit SSE4.1-ac]".

Post by magnum

Post by Glen B
GBLabs.zip:$pkzip2$1*1*2*0*1c0f72*1ea40d*7830b902*0*29*8*1c0f72*7830*7eee*4d989f74b755ae9409f8da4da1fbb97cd3aa0cf5a9a9f07b7a92fd01d0c3223cab6253af1cbcf6322a6e22edf1bd082c03ed0b083fb35e853c36cff3c3ac355814
And it continues on with this massive hexadecimal string, where it

89670717610473b4fd3510962114f86*$/pkzip2$:::::..\GBLabs.zip

I'm recognizing parts of this as a typical hash, but what's with this
new massive hex string? Could this contribute to why john says it can't
find a hash string out of this?

You weren't using an older version of John than of zip2jo

[magnum]

Post by Glen B
I hope not... I just copied john to "zip2john" and ran it that way as
Alexander suggested. Running john with no parameters outputs "John the
Ripper 1.8.0.9-jumbo-1-bleeding MPI + OMP [cygwin 64-bit SSE4.1-ac]".

Perhaps your zip file is thrashed some way. Any chance you can share it
with us (off-list if needed) so we can investigate?

magnum

Post by Glen B

Post by magnum

Post by Glen B
GBLabs.zip:$pkzip2$1*1*2*0*1c0f72*1ea40d*7830b902*0*29*8*1c0f72*7830*7eee*4d989f74b755ae9409f8da4da1fbb97cd3aa0cf5a9a9f07b7a92fd01d0c3223cab6253af1cbcf6322a6e22edf1bd082c03ed0b083fb35e853c36cff3c3ac355814
And it continues on with this massive hexadecimal string, where it

89670717610473b4fd3510962114f86*$/pkzip2$:::::..\GBLabs.zip

I'm recognizing parts of this as a typical hash, but what's with this
new massive hex string? Could this contribute to why john says it can't
find a hash string out of this?

You weren't using an older version of John than of zip2john, were you?
magnum

[Glen B]

It's been sitting as an email attachment since the beginning of the
year, I wonder if it may have been corrupted at some point (although I
did open it before, when I had the password). It has some of my medical
records in it, I don't feel very confident about sharing it... Is there
any other way I can help you?

Post by magnum

Post by Glen B
I hope not... I just copied john to "zip2john" and ran it that way as
Alexander suggested. Running john with no parameters outputs "John the
Ripper 1.8.0.9-jumbo-1-bleeding MPI + OMP [cygwin 64-bit SSE4.1-ac]".

Perhaps your zip file is thrashed some way. Any chance you can share
it with us (off-list if needed) so we can investigate?
magnum

Post by Glen B

Post by magnum

Post by Glen B
GBLabs.zip:$pkzip2$1*1*2*0*1c0f72*1ea40d*7830b902*0*29*8*1c0f72*7830*7eee*4d989f74b755ae9409f8da4da1fbb97cd3aa0cf5a9a9f07b7a92fd01d0c3223cab6253af1cbcf6322a6e22edf1bd082c03ed0b083fb35e853c36cff3c3ac355814
And it continues on with this massive hexadecimal string, where it

89670717610473b4fd3510962114f86*$/pkzip2$:::::..\GBLabs.zip

I'm recognizing parts of this as a typical hash, but what's with this
new massive hex string? Could this contribute to why john says it can't
find a hash string out of this?

You weren't using an older version of John than of zip2john, were you?

[Rich Rumble]

Post by Glen B
It's been sitting as an email attachment since the beginning of the
year, I wonder if it may have been corrupted at some point (although I
did open it before, when I had the password). It has some of my medical
records in it, I don't feel very confident about sharing it... Is there
any other way I can help you?

Post by magnum

Post by Glen B
I hope not... I just copied john to "zip2john" and ran it that way as
Alexander suggested. Running john with no parameters outputs "John the
Ripper 1.8.0.9-jumbo-1-bleeding MPI + OMP [cygwin 64-bit SSE4.1-ac]".

Perhaps your zip file is thrashed some way. Any chance you can share
it with us (off-list if needed) so we can investigate?
magnum

Post by Glen B

Post by magnum

Post by Glen B
GBLabs.zip:$pkzip2$1*1*2*0*1c0f72*1ea40d*7830b902*0*29*8*

1c0f72*7830*7eee*4d989f74b755ae9409f8da4da1fbb9
7cd3aa0cf5a9a9f07b7a92fd01d0c3223cab6253af1cbcf6322a6e22edf1
bd082c03ed0b083fb35e853c36cff3c3ac355814

Post by magnum

Post by Glen B

Post by magnum

Post by Glen B
And it continues on with this massive hexadecimal string, where it

89670717610473b4fd3510962114f86*$/pkzip2$:::::..\GBLabs.zip

I'm recognizing parts of this as a typical hash, but what's with this
new massive hex string? Could this contribute to why john says it can't
find a hash string out of this?

You weren't using an older version of John than of zip2john, were you?
magnum

Don't forget too that there are community builds that would still have the
behavior you're looking for (zip2john.exe)
http://openwall.info/wiki/john/custom-builds the one from 2015 I think
has the exe still but will lack any new fixes or updates

[Glen B]

I’ve tried several older builds, including the official 1.7.9 and 1.8.0 jumbo builds. I believe some of the fixes I needed for working with ZIP files would only have made it to the 1.8.0.9 build unless someone can do a more updated windows build?

From: Rich Rumble<mailto:***@gmail.com>
Sent: Saturday, August 19, 2017 5:45 PM
To: john-***@lists.openwall.com<mailto:john-***@lists.openwall.com>
Subject: Re: [john-users] Custom Windows build 1.8.0.9 - What happened to zip2john?

Post by Glen B
It's been sitting as an email attachment since the beginning of the
year, I wonder if it may have been corrupted at some point (although I
did open it before, when I had the password). It has some of my medical
records in it, I don't feel very confident about sharing it... Is there
any other way I can help you?

Post by magnum

Post by Glen B
I hope not... I just copied john to "zip2john" and ran it that way as
Alexander suggested. Running john with no parameters outputs "John the
Ripper 1.8.0.9-jumbo-1-bleeding MPI + OMP [cygwin 64-bit SSE4.1-ac]".

Perhaps your zip file is thrashed some way. Any chance you can share
it with us (off-list if needed) so we can investigate?
magnum

Post by Glen B

Post by magnum

Post by Glen B
GBLabs.zip:$pkzip2$1*1*2*0*1c0f72*1ea40d*7830b902*0*29*8*

1c0f72*7830*7eee*4d989f74b755ae9409f8da4da1fbb9
7cd3aa0cf5a9a9f07b7a92fd01d0c3223cab6253af1cbcf6322a6e22edf1
bd082c03ed0b083fb35e853c36cff3c3ac355814

Post by magnum

Post by Glen B

Post by magnum

Post by Glen B
And it continues on with this massive hexadecimal string, where it

89670717610473b4fd3510962114f86*$/pkzip2$:::::..\GBLabs.zip

I'm recognizing parts of this as a typical hash, but what's with this
new massive hex string? Could this contribute to why john says it can't
find a hash string out of this?

You weren't using an older version of John than of zip2john, were you?
magnum

Don't forget too that there are community builds that would still have the
behavior you're looking for (zip2john.exe)
http://openwall.info/wiki/john/custom-builds the one from 2015 I think
has the exe still but will lack any new fixes or updates

[r***@netscape.net]

Hey, I'm Robert and the one who contributes almost all of the builds on the
custom build site.

I think there was something definitely wrong with the bleeding version in
March 2017, and possibly now, when building with cygwin.

See below for more details.

I tested all of the symbolic link files in the Windows build from March 2017
that I did and I can confirm there seems to be a problem with them.

These all fail to run:

base64conv
gpg2john
hccap2john
keepass2john
putty2john
racf2john
rar2john
unafs
undrop
unique
unshadow

I then checked the previous version I made
"John-the-Ripper-v1.8.0-jumbo-1-Win-64".
In this version there are no files that are symbolic links. These all run
fine.

base64conv.exe
calc_stat.exe
cprepair.exe
dmg2john.exe
genmkvpwd.exe
gpg2john.exe
hccap2john.exe
john.exe
keepass2john.exe
keychain2john.exe
keyring2john.exe
keystore2john.exe
kwallet2john.exe
luks2john.exe
mkvcalcproba.exe
pfx2john.exe
putty2john.exe
pwsafe2john.exe
racf2john.exe
rar2john.exe
raw2dyna.exe
ssh2john.exe
tgtsnarf.exe
truecrypt_volume2john.exe
uaf2john.exe
unafs.exe
undrop.exe
unique.exe
unshadow.exe
wpapcap2john.exe
zip2john.exe

-- Robert B. Harris from VA

-----Original Message-----
From: Solar Designer [mailto:***@openwall.com]
Sent: Friday, August 18, 2017 3:55 PM
To: john-***@lists.openwall.com
Subject: Re: [john-users] Custom Windows build 1.8.0.9 - What happened to
zip2john?

Post by Glen B
I really liked the earlier versions of JtR that were self-contained and

didn't require downloading anything else to be honest.

This build wasn't meant to require anything extra either. According to what
you said, it's just a bug.

Post by Glen B
If this is just a symlink though, what is it symlink-ing to? The john

binary? If so, couldn't I just run john directly?

Yes. You could run "john" directly if you copy or rename it so that it'd be
called "zip2john".

Alexander


---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

[r***@netscape.net]

Hey, I'm Robert and the one who contributes almost all of the builds on the
custom build site.

I think there was something definitely wrong with the bleeding version in
March 2017, and possibly now, when building with cygwin.

See below for more details.

I tested all of the symbolic link files in the Windows build from March 2017
that I did and I can confirm there seems to be a problem with them.

These all fail to run:

base64conv
gpg2john
hccap2john
keepass2john
putty2john
racf2john
rar2john
unafs
undrop
unique
unshadow

I then checked the previous version I made
"John-the-Ripper-v1.8.0-jumbo-1-Win-64".
In this version there are no files that are symbolic links. These all run
fine.

base64conv.exe
calc_stat.exe
cprepair.exe
dmg2john.exe
genmkvpwd.exe
gpg2john.exe
hccap2john.exe
john.exe
keepass2john.exe
keychain2john.exe
keyring2john.exe
keystore2john.exe
kwallet2john.exe
luks2john.exe
mkvcalcproba.exe
pfx2john.exe
putty2john.exe
pwsafe2john.exe
racf2john.exe
rar2john.exe
raw2dyna.exe
ssh2john.exe
tgtsnarf.exe
truecrypt_volume2john.exe
uaf2john.exe
unafs.exe
undrop.exe
unique.exe
unshadow.exe
wpapcap2john.exe
zip2john.exe

-- Robert B. Harris from VA

-----Original Message-----
From: Solar Designer [mailto:***@openwall.com]
Sent: Friday, August 18, 2017 3:55 PM
To: john-***@lists.openwall.com
Subject: Re: [john-users] Custom Windows build 1.8.0.9 - What happened to
zip2john?

Post by Glen B
I really liked the earlier versions of JtR that were self-contained and

didn't require downloading anything else to be honest.

This build wasn't meant to require anything extra either. According to what
you said, it's just a bug.

Post by Glen B
If this is just a symlink though, what is it symlink-ing to? The john

binary? If so, couldn't I just run john directly?

Yes. You could run "john" directly if you copy or rename it so that it'd be
called "zip2john".

Alexander


---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

[Glen B]

Hey Robert,

I can confirm what you've found, the earlier build did have the proper
executables. I hope I can test a build from you soon if you won't mind!

Glen

Post by r***@netscape.net
Hey, I'm Robert and the one who contributes almost all of the builds on the
custom build site.
I think there was something definitely wrong with the bleeding version in
March 2017, and possibly now, when building with cygwin.
See below for more details.
I tested all of the symbolic link files in the Windows build from March 2017
that I did and I can confirm there seems to be a problem with them.
base64conv
gpg2john
hccap2john
keepass2john
putty2john
racf2john
rar2john
unafs
undrop
unique
unshadow
I then checked the previous version I made
"John-the-Ripper-v1.8.0-jumbo-1-Win-64".
In this version there are no files that are symbolic links. These all run
fine.
base64conv.exe
calc_stat.exe
cprepair.exe
dmg2john.exe
genmkvpwd.exe
gpg2john.exe
hccap2john.exe
john.exe
keepass2john.exe
keychain2john.exe
keyring2john.exe
keystore2john.exe
kwallet2john.exe
luks2john.exe
mkvcalcproba.exe
pfx2john.exe
putty2john.exe
pwsafe2john.exe
racf2john.exe
rar2john.exe
raw2dyna.exe
ssh2john.exe
tgtsnarf.exe
truecrypt_volume2john.exe
uaf2john.exe
unafs.exe
undrop.exe
unique.exe
unshadow.exe
wpapcap2john.exe
zip2john.exe
-- Robert B. Harris from VA
-----Original Message-----
Sent: Friday, August 18, 2017 3:55 PM
Subject: Re: [john-users] Custom Windows build 1.8.0.9 - What happened to
zip2john?

Post by Glen B
I really liked the earlier versions of JtR that were self-contained and

didn't require downloading anything else to be honest.
This build wasn't meant to require anything extra either. According to what
you said, it's just a bug.

Post by Glen B
If this is just a symlink though, what is it symlink-ing to? The john

binary? If so, couldn't I just run john directly?
Yes. You could run "john" directly if you copy or rename it so that it'd be
called "zip2john".
Alexander
---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

[r***@netscape.net]

So seeing how this problem was just discovered, I'd like to hear that
someone has either worked on the code to fix it, or they believe it is no
longer a problem with the code.

Then I'll compile a new bleeding for Windows, test this to confirm or deny
the problem's current status. Once the new version is confirmed fixed, I'll
put on the custom build site.

--Robert B. Harris

-----Original Message-----
From: Glen B [mailto:***@msn.com]
Sent: Thursday, August 24, 2017 10:22 PM
To: john-***@lists.openwall.com
Subject: Re: [john-users] Custom Windows build 1.8.0.9 - What happened to
zip2john?

Hey Robert,

I can confirm what you've found, the earlier build did have the proper
executables. I hope I can test a build from you soon if you won't mind!

Glen

Post by r***@netscape.net
Hey, I'm Robert and the one who contributes almost all of the builds
on the custom build site.
I think there was something definitely wrong with the bleeding version
in March 2017, and possibly now, when building with cygwin.
See below for more details.
I tested all of the symbolic link files in the Windows build from
March 2017 that I did and I can confirm there seems to be a problem with

them.

Post by r***@netscape.net
base64conv
gpg2john
hccap2john
keepass2john
putty2john
racf2john
rar2john
unafs
undrop
unique
unshadow
I then checked the previous version I made
"John-the-Ripper-v1.8.0-jumbo-1-Win-64".
In this version there are no files that are symbolic links. These all
run fine.
base64conv.exe
calc_stat.exe
cprepair.exe
dmg2john.exe
genmkvpwd.exe
gpg2john.exe
hccap2john.exe
john.exe
keepass2john.exe
keychain2john.exe
keyring2john.exe
keystore2john.exe
kwallet2john.exe
luks2john.exe
mkvcalcproba.exe
pfx2john.exe
putty2john.exe
pwsafe2john.exe
racf2john.exe
rar2john.exe
raw2dyna.exe
ssh2john.exe
tgtsnarf.exe
truecrypt_volume2john.exe
uaf2john.exe
unafs.exe
undrop.exe
unique.exe
unshadow.exe
wpapcap2john.exe
zip2john.exe
-- Robert B. Harris from VA
-----Original Message-----
Sent: Friday, August 18, 2017 3:55 PM
Subject: Re: [john-users] Custom Windows build 1.8.0.9 - What happened
to zip2john?

Post by Glen B
I really liked the earlier versions of JtR that were self-contained and

didn't require downloading anything else to be honest.
This build wasn't meant to require anything extra either. According
to what you said, it's just a bug.

Post by Glen B
If this is just a symlink though, what is it symlink-ing to? The john

binary? If so, couldn't I just run john directly?
Yes. You could run "john" directly if you copy or rename it so that
it'd be called "zip2john".
Alexander
---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

[r***@netscape.net]

The symbolic link issue mentioned below in Cygwin is still broken, if you
configure with:
"--enable-ln-s ", which Use ln -s vs symlink.c wrappers (Cygwin only)

So, I tested my configure without this, and all executables are working now.

I'm almost done with my testing and I'm about the release a new version for
Windows x64 on the custom build site.

-Robert B. Harris from VA

-----Original Message-----
From: ***@netscape.net [mailto:***@netscape.net]
Sent: Friday, August 25, 2017 11:24 PM
To: john-***@lists.openwall.com
Subject: RE: [john-users] Custom Windows build 1.8.0.9 - What happened to
zip2john?

So seeing how this problem was just discovered, I'd like to hear that
someone has either worked on the code to fix it, or they believe it is no
longer a problem with the code.

Then I'll compile a new bleeding for Windows, test this to confirm or deny
the problem's current status. Once the new version is confirmed fixed, I'll
put on the custom build site.

--Robert B. Harris

-----Original Message-----
From: Glen B [mailto:***@msn.com]
Sent: Thursday, August 24, 2017 10:22 PM
To: john-***@lists.openwall.com
Subject: Re: [john-users] Custom Windows build 1.8.0.9 - What happened to
zip2john?

Hey Robert,

I can confirm what you've found, the earlier build did have the proper
executables. I hope I can test a build from you soon if you won't mind!

Glen

Post by r***@netscape.net
Hey, I'm Robert and the one who contributes almost all of the builds
on the custom build site.
I think there was something definitely wrong with the bleeding version
in March 2017, and possibly now, when building with cygwin.
See below for more details.
I tested all of the symbolic link files in the Windows build from
March 2017 that I did and I can confirm there seems to be a problem with

them.

Post by r***@netscape.net
base64conv
gpg2john
hccap2john
keepass2john
putty2john
racf2john
rar2john
unafs
undrop
unique
unshadow
I then checked the previous version I made
"John-the-Ripper-v1.8.0-jumbo-1-Win-64".
In this version there are no files that are symbolic links. These all
run fine.
base64conv.exe
calc_stat.exe
cprepair.exe
dmg2john.exe
genmkvpwd.exe
gpg2john.exe
hccap2john.exe
john.exe
keepass2john.exe
keychain2john.exe
keyring2john.exe
keystore2john.exe
kwallet2john.exe
luks2john.exe
mkvcalcproba.exe
pfx2john.exe
putty2john.exe
pwsafe2john.exe
racf2john.exe
rar2john.exe
raw2dyna.exe
ssh2john.exe
tgtsnarf.exe
truecrypt_volume2john.exe
uaf2john.exe
unafs.exe
undrop.exe
unique.exe
unshadow.exe
wpapcap2john.exe
zip2john.exe
-- Robert B. Harris from VA
-----Original Message-----
Sent: Friday, August 18, 2017 3:55 PM
Subject: Re: [john-users] Custom Windows build 1.8.0.9 - What happened
to zip2john?

Post by Glen B
I really liked the earlier versions of JtR that were self-contained and

didn't require downloading anything else to be honest.
This build wasn't meant to require anything extra either. According
to what you said, it's just a bug.

Post by Glen B
If this is just a symlink though, what is it symlink-ing to? The john

binary? If so, couldn't I just run john directly?
Yes. You could run "john" directly if you copy or rename it so that
it'd be called "zip2john".
Alexander
---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

[Glen B]

Hi Robert et. al.,

Sorry for taking so long to respond - I've downloaded the updated
September build of 1.8.0.9. I'm happy to see that zip2john.exe is back!
Running it on my zip file produces the following ouput:

ver 2.0 Labs.zip->Labs.pdf PKZIP Encr: cmplen=1838962, decmplen=2008077,
crc=7830B902

So that seems to be working well? The output hash is kind of odd - the
file I saved it to is 7,184KB in size, but the output format seems
normal enough? When I run john, however...

.\run\john.exe --show .\zip.hash
Warning: '/dev/shm' does not exists or is not a directory.

POSIX shared memory objects require the existance of this directory.
Create the directory '/dev/shm' and set the permissions to 01777.
For instance on the command line: mkdir -m 01777 /dev/shm
Warning: invalid UTF-8 seen reading .\zip.hash
0 password hashes cracked, 0 left

It seems like john is having trouble reading the output of zip2john?

Glen

Post by r***@netscape.net
The symbolic link issue mentioned below in Cygwin is still broken, if you
"--enable-ln-s ", which Use ln -s vs symlink.c wrappers (Cygwin only)
So, I tested my configure without this, and all executables are working now.
I'm almost done with my testing and I'm about the release a new version for
Windows x64 on the custom build site.
-Robert B. Harris from VA
-----Original Message-----
Sent: Friday, August 25, 2017 11:24 PM
Subject: RE: [john-users] Custom Windows build 1.8.0.9 - What happened to
zip2john?
So seeing how this problem was just discovered, I'd like to hear that
someone has either worked on the code to fix it, or they believe it is no
longer a problem with the code.
Then I'll compile a new bleeding for Windows, test this to confirm or deny
the problem's current status. Once the new version is confirmed fixed, I'll
put on the custom build site.
--Robert B. Harris
-----Original Message-----
Sent: Thursday, August 24, 2017 10:22 PM
Subject: Re: [john-users] Custom Windows build 1.8.0.9 - What happened to
zip2john?
Hey Robert,
I can confirm what you've found, the earlier build did have the proper
executables. I hope I can test a build from you soon if you won't mind!
Glen

Post by r***@netscape.net
Hey, I'm Robert and the one who contributes almost all of the builds
on the custom build site.
I think there was something definitely wrong with the bleeding version
in March 2017, and possibly now, when building with cygwin.
See below for more details.
I tested all of the symbolic link files in the Windows build from
March 2017 that I did and I can confirm there seems to be a problem with

them.

Post by r***@netscape.net
base64conv
gpg2john
hccap2john
keepass2john
putty2john
racf2john
rar2john
unafs
undrop
unique
unshadow
I then checked the previous version I made
"John-the-Ripper-v1.8.0-jumbo-1-Win-64".
In this version there are no files that are symbolic links. These all
run fine.
base64conv.exe
calc_stat.exe
cprepair.exe
dmg2john.exe
genmkvpwd.exe
gpg2john.exe
hccap2john.exe
john.exe
keepass2john.exe
keychain2john.exe
keyring2john.exe
keystore2john.exe
kwallet2john.exe
luks2john.exe
mkvcalcproba.exe
pfx2john.exe
putty2john.exe
pwsafe2john.exe
racf2john.exe
rar2john.exe
raw2dyna.exe
ssh2john.exe
tgtsnarf.exe
truecrypt_volume2john.exe
uaf2john.exe
unafs.exe
undrop.exe
unique.exe
unshadow.exe
wpapcap2john.exe
zip2john.exe
-- Robert B. Harris from VA
-----Original Message-----
Sent: Friday, August 18, 2017 3:55 PM
Subject: Re: [john-users] Custom Windows build 1.8.0.9 - What happened
to zip2john?

Post by Glen B
I really liked the earlier versions of JtR that were self-contained and

didn't require downloading anything else to be honest.
This build wasn't meant to require anything extra either. According
to what you said, it's just a bug.

Post by Glen B
If this is just a symlink though, what is it symlink-ing to? The john

binary? If so, couldn't I just run john directly?
Yes. You could run "john" directly if you copy or rename it so that
it'd be called "zip2john".
Alexander
---
This email has been checked for viruses by Avast antivirus software.
https://www.

[Rich Rumble]

Post by Glen B
Hi Robert et. al.,
Sorry for taking so long to respond - I've downloaded the updated
September build of 1.8.0.9. I'm happy to see that zip2john.exe is back!
ver 2.0 Labs.zip->Labs.pdf PKZIP Encr: cmplen=1838962, decmplen=2008077,
crc=7830B902
So that seems to be working well? The output hash is kind of odd - the
file I saved it to is 7,184KB in size, but the output format seems
normal enough? When I run john, however...
.\run\john.exe --show .\zip.hash
Warning: '/dev/shm' does not exists or is not a directory.

I've had that error before, seems to be an environment issue, meaning if
you run John from a Cygwin environment the issue I believe goes away.
Otherwise there may have to be something done to the code to fix that
issue. I don't think it's a hard error, JtR should just move past it.

Post by Glen B
POSIX shared memory objects require the existance of this directory.
Create the directory '/dev/shm' and set the permissions to 01777.
For instance on the command line: mkdir -m 01777 /dev/shm

This is the real problem

Post by Glen B
Warning: invalid UTF-8 seen reading .\zip.hash
0 password hashes cracked, 0 left

The file seems to contain a non-UTF-8 string inside it, but again JtR
should move past that... The hash may not be correct, is it possible to
post it, perhaps privately to one of the developers (not me :)
Try the command without the SHOW.

Post by Glen B
It seems like john is having trouble reading the output of zip2john?
Glen

Post by r***@netscape.net
The symbolic link issue mentioned below in Cygwin is still broken, if you
"--enable-ln-s ", which Use ln -s vs symlink.c wrappers (Cygwin only)
So, I tested my configure without this, and all executables are working

now.

Post by r***@netscape.net
I'm almost done with my testing and I'm about the release a new version

for

Post by r***@netscape.net
Windows x64 on the custom build site.
-Robert B. Harris from VA
-----Original Message-----
Sent: Friday, August 25, 2017 11:24 PM
Subject: RE: [john-users] Custom Windows build 1.8.0.9 - What happened to
zip2john?
So seeing how this problem was just discovered, I'd like to hear that
someone has either worked on the code to fix it, or they believe it is no
longer a problem with the code.
Then I'll compile a new bleeding for Windows, test this to confirm or

deny

Post by r***@netscape.net
the problem's current status. Once the new version is confirmed fixed,

I'll

Post by r***@netscape.net
put on the custom build site.
--Robert B. Harris
-----Original Message-----
Sent: Thursday, August 24, 2017 10:22 PM
Subject: Re: [john-users] Custom Windows build 1.8.0.9 - What happened to
zip2john?
Hey Robert,
I can confirm what you've found, the earlier build did have the proper
executables. I hope I can test a build from you soon if you won't mind!
Glen

Post by r***@netscape.net
Hey, I'm Robert and the one who contributes almost all of the builds
on the custom build site.
I think there was something definitely wrong with the bleeding version
in March 2017, and possibly now, when building with cygwin.
See below for more details.
I tested all of the symbolic link files in the Windows build from
March 2017 that I did and I can confirm there seems to be a problem with

them.

Post by r***@netscape.net
base64conv
gpg2john
hccap2john
keepass2john
putty2john
racf2john
rar2john
unafs
undrop
unique
unshadow
I then checked the previous version I made
"John-the-Ripper-v1.8.0-jumbo-1-Win-64".
In this version there are no files that are symbolic links. These all
run fine.
base64conv.exe
calc_stat.exe
cprepair.exe
dmg2john.exe
genmkvpwd.exe
gpg2john.exe
hccap2john.exe
john.exe
keepass2john.exe
keychain2john.exe
keyring2john.exe
keystore2john.exe
kwallet2john.exe
luks2john.exe
mkvcalcproba.exe
pfx2john.exe
putty2john.exe
pwsafe2john.exe
racf2john.exe
rar2john.exe
raw2dyna.exe
ssh2john.exe
tgtsnarf.exe
truecrypt_volume2john.exe
uaf2john.exe
unafs.exe
undrop.exe
unique.exe
unshadow.exe
wpapcap2john.exe
zip2john.exe
-- Robert B. Harris from VA
-----Original Message-----
Sent: Friday, August 18, 2017 3:55 PM
Subject: Re: [john-users] Custom Windows build 1.8.0.9 - What happened
to zip2john?

Post by Glen B
I really liked the earlier versions of JtR that were self-contained and

didn't require downloading anything else to be honest.
This build wasn't meant to require anything extra either. According
to what you said, it's just a bug.

Post by Glen B
If this is just a symlink though, what is it symlink-ing to? The john

binary? If so, couldn't I just run john directly?
Yes. You could run "john" directly if you copy or rename it so that
it'd be called "zip2john".
Alexander
---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

[Glen B]

Pretty much confirming what you said, I've found some documentation on
Cygwin <https://cygwin.com/cygwin-ug-net/using-specialnames.html> in the
POSIX devices section saying that the /dev/shm directory is very
important for some programs. Additionally, there appears to be an
unanswered thread here on john-dev
<http://www.openwall.com/lists/john-dev/2014/06/06/3> talking about this
message in particular. Sounds like there may be a bug here?

About the non-UTF8, I just opened the output file in Notepad++, which
says it's encoded in UCS-2 LE. (I don't think I've heard of that one
before!) I'm running these commands from Windows PowerShell, perhaps
that's screwing with things?

I wouldn't mind sharing the hash with a developer although I would like
it to remain private, if there is a developer available to accept this file?

Running the command without show:

.\run\john.exe .\zip.hash
Warning: '/dev/shm' does not exists or is not a directory.

POSIX shared memory objects require the existance of this directory.
Create the directory '/dev/shm' and set the permissions to 01777.
For instance on the command line: mkdir -m 01777 /dev/shm
Warning: invalid UTF-8 seen reading .\zip.hash
Using default input encoding: UTF-8
No password hashes loaded (see FAQ)

Glen

Post by Rich Rumble

Post by Glen B
Hi Robert et. al.,
Sorry for taking so long to respond - I've downloaded the updated
September build of 1.8.0.9. I'm happy to see that zip2john.exe is back!
ver 2.0 Labs.zip->Labs.pdf PKZIP Encr: cmplen=1838962, decmplen=2008077,
crc=7830B902
So that seems to be working well? The output hash is kind of odd - the
file I saved it to is 7,184KB in size, but the output format seems
normal enough? When I run john, however...
.\run\john.exe --show .\zip.hash
Warning: '/dev/shm' does not exists or is not a directory.

I've had that error before, seems to be an environment issue, meaning if
you run John from a Cygwin environment the issue I believe goes away.
Otherwise there may have to be something done to the code to fix that
issue. I don't think it's a hard error, JtR should just move past it.

Post by Glen B
POSIX shared memory objects require the existance of this directory.
Create the directory '/dev/shm' and set the permissions to 01777.
For instance on the command line: mkdir -m 01777 /dev/shm

This is the real problem

Post by Glen B
Warning: invalid UTF-8 seen reading .\zip.hash
0 password hashes cracked, 0 left

The file seems to contain a non-UTF-8 string inside it, but again JtR
should move past that... The hash may not be correct, is it possible to
post it, perhaps privately to one of the developers (not me :)
Try the command without the SHOW.

Post by Glen B
It seems like john is having trouble reading the output of zip2john?
Glen

Post by r***@netscape.net
The symbolic link issue mentioned below in Cygwin is still broken, if you
"--enable-ln-s ", which Use ln -s vs symlink.c wrappers (Cygwin only)
So, I tested my configure without this, and all executables are working

now.

Post by r***@netscape.net
I'm almost done with my testing and I'm about the release a new version

for

Post by r***@netscape.net
Windows x64 on the custom build site.
-Robert B. Harris from VA
-----Original Message-----
Sent: Friday, August 25, 2017 11:24 PM
Subject: RE: [john-users] Custom Windows build 1.8.0.9 - What happened to
zip2john?
So seeing how this problem was just discovered, I'd like to hear that
someone has either worked on the code to fix it, or they believe it is no
longer a problem with the code.
Then I'll compile a new bleeding for Windows, test this to confirm or

deny

Post by r***@netscape.net
the problem's current status. Once the new version is confirmed fixed,

I'll

Post by r***@netscape.net
put on the custom build site.
--Robert B. Harris
-----Original Message-----
Sent: Thursday, August 24, 2017 10:22 PM
Subject: Re: [john-users] Custom Windows build 1.8.0.9 - What happened to
zip2john?
Hey Robert,
I can confirm what you've found, the earlier build did have the proper
executables. I hope I can test a build from you soon if you won't mind!
Glen

Post by r***@netscape.net
Hey, I'm Robert and the one who contributes almost all of the builds
on the custom build site.
I think there was something definitely wrong with the bleeding version
in March 2017, and possibly now, when building with cygwin.
See below for more details.
I tested all of the symbolic link files in the Windows build from
March 2017 that I did and I can confirm there seems to be a problem with

them.

Post by r***@netscape.net
base64conv
gpg2john
hccap2john
keepass2john
putty2john
racf2john
rar2john
unafs
undrop
unique
unshadow
I then checked the previous version I made
"John-the-Ripper-v1.8.0-jumbo-1-Win-64".
In this version there are no files that are symbolic links. These all
run fine.
base64conv.exe
calc_stat.exe
cprepair.exe
dmg2john.exe
genmkvpwd.exe
gpg2john.exe
hccap2john.exe
john.exe
keepass2john.exe
keychain2john.exe
keyring2john.exe
keystore2john.exe
kwallet2john.exe
luks2john.exe
mkvcalcproba.exe
pfx2john.exe
putty2john.exe
pwsafe2john.exe
racf2john.exe
rar2john.exe
raw2dyna.exe
ssh2john.exe
tgtsnarf.exe
truecrypt_volume2john.exe
uaf2john.exe
unafs.exe
undrop.exe
unique.exe
unshadow.exe
wpapcap2john.exe
zip2john.exe
-- Robert B. Harris from VA
-----Original Message-----
Sent: Friday, August 18, 2017 3:55 PM
Subject: Re: [john-users] Custom Windows build 1.8.0.9 - What happened
to zip2john?

Post by Glen B
I really liked the earlier versions of JtR that were self-contained and

didn't require downloading anything else to be honest.
This build wasn't meant to require anything extra either. According
to what you said, it's just a bug.

Post by Glen B
If this is just a symlink though, what is it symlink-ing to? The john

binary? If so, couldn't I just run john directly?
Yes. You could run "john" directly if you copy or rename it so that
it'd be called "zip2john".
Alexander
---
This email has been checked for viruses by Avast antivirus software.
https://ww

[Glen B]

Well, this feels kind of embarrassing. I changed the encoding via
Notepad++ to UTF-8 straight. I saved it, then ran john with just the
filename of the hash. Out came the password, in less than a millisecond
if I'm reading the output correctly. It was a super simple password, too...

I guess the lesson here is; all file input must be UTF-8!

Glen

Post by Glen B
Pretty much confirming what you said, I've found some documentation on
Cygwin <https://cygwin.com/cygwin-ug-net/using-specialnames.html> in the
POSIX devices section saying that the /dev/shm directory is very
important for some programs. Additionally, there appears to be an
unanswered thread here on john-dev
<http://www.openwall.com/lists/john-dev/2014/06/06/3> talking about this
message in particular. Sounds like there may be a bug here?
About the non-UTF8, I just opened the output file in Notepad++, which
says it's encoded in UCS-2 LE. (I don't think I've heard of that one
before!) I'm running these commands from Windows PowerShell, perhaps
that's screwing with things?
I wouldn't mind sharing the hash with a developer although I would like
it to remain private, if there is a developer available to accept this file?
.\run\john.exe .\zip.hash
Warning: '/dev/shm' does not exists or is not a directory.
POSIX shared memory objects require the existance of this directory.
Create the directory '/dev/shm' and set the permissions to 01777.
For instance on the command line: mkdir -m 01777 /dev/shm
Warning: invalid UTF-8 seen reading .\zip.hash
Using default input encoding: UTF-8
No password hashes loaded (see FAQ)
Glen

Post by Rich Rumble

Post by Glen B
Hi Robert et. al.,
Sorry for taking so long to respond - I've downloaded the updated
September build of 1.8.0.9. I'm happy to see that zip2john.exe is back!
ver 2.0 Labs.zip->Labs.pdf PKZIP Encr: cmplen=1838962, decmplen=2008077,
crc=7830B902
So that seems to be working well? The output hash is kind of odd - the
file I saved it to is 7,184KB in size, but the output format seems
normal enough? When I run john, however...
.\run\john.exe --show .\zip.hash
Warning: '/dev/shm' does not exists or is not a directory.

I've had that error before, seems to be an environment issue, meaning if
you run John from a Cygwin environment the issue I believe goes away.
Otherwise there may have to be something done to the code to fix that
issue. I don't think it's a hard error, JtR should just move past it.

Post by Glen B
POSIX shared memory objects require the existance of this directory.
Create the directory '/dev/shm' and set the permissions to 01777.
For instance on the command line: mkdir -m 01777 /dev/shm

This is the real problem

Post by Glen B
Warning: invalid UTF-8 seen reading .\zip.hash
0 password hashes cracked, 0 left

The file seems to contain a non-UTF-8 string inside it, but again JtR
should move past that... The hash may not be correct, is it possible to
post it, perhaps privately to one of the developers (not me :)
Try the command without the SHOW.

Post by Glen B
It seems like john is having trouble reading the output of zip2john?
Glen

Post by r***@netscape.net
The symbolic link issue mentioned below in Cygwin is still broken, if you
"--enable-ln-s ", which Use ln -s vs symlink.c wrappers (Cygwin only)
So, I tested my configure without this, and all executables are working

now.

Post by r***@netscape.net
I'm almost done with my testing and I'm about the release a new version

for

Post by r***@netscape.net
Windows x64 on the custom build site.
-Robert B. Harris from VA
-----Original Message-----
Sent: Friday, August 25, 2017 11:24 PM
Subject: RE: [john-users] Custom Windows build 1.8.0.9 - What happened to
zip2john?
So seeing how this problem was just discovered, I'd like to hear that
someone has either worked on the code to fix it, or they believe it is no
longer a problem with the code.
Then I'll compile a new bleeding for Windows, test this to confirm or

deny

Post by r***@netscape.net
the problem's current status. Once the new version is confirmed fixed,

I'll

Post by r***@netscape.net
put on the custom build site.
--Robert B. Harris
-----Original Message-----
Sent: Thursday, August 24, 2017 10:22 PM
Subject: Re: [john-users] Custom Windows build 1.8.0.9 - What happened to
zip2john?
Hey Robert,
I can confirm what you've found, the earlier build did have the proper
executables. I hope I can test a build from you soon if you won't mind!
Glen

Post by r***@netscape.net
Hey, I'm Robert and the one who contributes almost all of the builds
on the custom build site.
I think there was something definitely wrong with the bleeding version
in March 2017, and possibly now, when building with cygwin.
See below for more details.
I tested all of the symbolic link files in the Windows build from
March 2017 that I did and I can confirm there seems to be a problem with

them.

Post by r***@netscape.net
base64conv
gpg2john
hccap2john
keepass2john
putty2john
racf2john
rar2john
unafs
undrop
unique
unshadow
I then checked the previous version I made
"John-the-Ripper-v1.8.0-jumbo-1-Win-64".
In this version there are no files that are symbolic links. These all
run fine.
base64conv.exe
calc_stat.exe
cprepair.exe
dmg2john.exe
genmkvpwd.exe
gpg2john.exe
hccap2john.exe
john.exe
keepass2john.exe
keychain2john.exe
keyring2john.exe
keystore2john.exe
kwallet2john.exe
luks2john.exe
mkvcalcproba.exe
pfx2john.exe
putty2john.exe
pwsafe2john.exe
racf2john.exe
rar2john.exe
raw2dyna.exe
ssh2john.exe
tgtsnarf.exe
truecrypt_volume2john.exe
uaf2john.exe
unafs.exe
undrop.exe
unique.exe
unshadow.exe
wpapcap2john.exe
zip2john.exe
-- Robert B. Harris from VA
-----Original Message-----
Sent: Friday, August 18, 2017 3:55 PM
Subject: Re: [john-users] Custom Windows build 1.8.0.9 - What happened
to zip2john?

Post by Glen B
I really liked the earlier versions of JtR that were self-contained and

didn't require downloading anything else to be honest.
This build wasn't meant to require anything extra either. According
to what you said, it's just a bug.

Post by Glen B
If this is just a symlink though, what is it symlink-ing to? The john

binary? If so, couldn't I just run john directly?
Yes. You could run "john" directly if you copy or rename it so that
it'd be called "zip2john".
Alexander
---
This email has been checked for viruses by Avast antivirus software.
https://www

[r***@netscape.net]

You don't need cygwin to run the version I build because I include the appropriate DLL files.
As long as you put the 13 DLLs (seperate zip file) in the run folder you should be fine running john.exe or john-omp.exe.

The last time I compiled JtR, I was asked to put the DLLs in a separate .z file.


-- Robert B. Harris from VA

-----Original Message-----
From: magnum [mailto:***@hushmail.com]
Sent: Friday, August 18, 2017 12:44 PM
To: john-***@lists.openwall.com
Subject: Re: [john-users] Custom Windows build 1.8.0.9 - What happened to zip2john?

Post by Glen B
I was having issues with earlier builds and getting a hash of a ZIP
file read properly (according to zip2john at the time, it was a pkzip2
format). I've downloaded the latest Windows build from the wiki, John
the Ripper v1.8.0.9-jumbo-1-bleeding (Bleeding version on 2017-03-06).
Something that's new to me is that the zip2john executable seems to
have been replaced with a different file. The text initially reads "symlink"
with some non-text characters following. I'm assuming this is a linux
symlink file, which neither Windows nor I know how to interpret.
I'm not having much luck searching GitHub for an explanation of this
change. Can anyone offer any tips on how I'm supposed to proceed with
cracking a zip file at this point?

I believe you need to run from a Cygwin shell, not the CMD.EXE Windows shell. If you can find a MinGW build instead I guess the problem will be gone.

magnum



---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus