Password Attacks | protected Archives zip2john

25

yeah i am lost as well. what file are we suppose to use to crack the Notes.zip file?

26

you used some mutated file to work on Kira earlier, use the same

28

I used the previously mutated password file but it doesn’t work

29

hydra -l ‘kira’ -P love.list ssh://ip

hope this command helps

the ‘love.list’ file its mutated already with the custom rule

30

three issues:

  1. download all the files from the ‘resources’

  2. ssh into box as ‘kira’ (LoveYou1 is from previous module i believe)

echo 'LoveYou1' | hashcat --force -r custom.rule --stdout | sort -u > mutated-passwords
hydra -l kira -P mutated-passwords xx.xxx.xxx.xx ssh -vv -t32
  1. crack the zip hash using ‘zip2john’
cat password.list | hashcat --force -r custom.rule --stdout | sort -u > mutated-passwords
john --wordlist=mutated-passwords 2john.hash

:heart:

3 Likes
31

Why does HTB like to force the download of strange custom rules and resources? It is a pointless detour.

2 Likes
33

Did you ever figure this out? I have this same problem.

35

This is awesome!
Thank you.

36

L0vey0u1! is the pw for kira

37

this making me so mad, because I don’t remember kira’s pw and now I have to redo that module all over again

38

It is a bit frustrating, but this reminds to make notes :slight_smile:

1 Like
39

hello my friend can you explain please what is the password of the root and how you got it

40

You dont need the password of the root. The Notes.zip is also on the Documents folder

41

Thats’s worked guys !

42

Password for kira is L0vey0u1!

43

same

44

Try python upload server

46

Uff it is hidden behind the “Hint” button of the question?!
Shall this be a lesson on reading everything carefully?

Without this post I would never have found this :rofl:

47

Uh the Notes.zip file comes up as empty when I try to zip2john Notes.zip > notes.hash. Stuck and Can’t find anything on this. Really agitated with this.