---
name: crack-7z-hash
description: This skill provides guidance for cracking 7z archive password hashes. It should be used when tasked with recovering passwords from 7z encrypted archives, extracting and cracking 7z hashes, or working with password-protected 7z files in CTF challenges, security testing, or authorized recovery scenarios.
---

# Crack 7z Hash

## Overview

This skill provides a systematic approach for extracting and cracking password hashes from 7z encrypted archives. It covers hash extraction, tool selection, attack strategies, and verification procedures for password recovery tasks.

## When to Use This Skill

- Recovering passwords from encrypted 7z archives
- CTF challenges involving 7z password cracking
- Authorized penetration testing or security assessments
- Forensic analysis requiring access to protected 7z files

## Workflow

### Step 1: Identify and Analyze the Target

Before attempting to crack any hash, gather information about the target:

1. **Verify the file type**: Confirm the target is actually a 7z archive
   ```bash
   file target.7z
   ```

2. **Check archive properties**: Examine encryption method and compression settings
   ```bash
   7z l -slt target.7z
   ```

3. **Note the encryption type**: 7z typically uses AES-256 encryption. Understanding the encryption method informs tool selection and expected cracking time.

### Step 2: Extract the Hash

Extract the password hash from the 7z archive for offline cracking:

**Using 7z2john (John the Ripper utility):**
```bash
7z2john target.7z > hash.txt
```

**Using 7z2hashcat (Hashcat utility):**
```bash
7z2hashcat.pl target.7z > hash.txt
# Or if using the Python version:
7z2hashcat.py target.7z > hash.txt
```

**Verify hash extraction:**
- The extracted hash should contain recognizable 7z hash format markers
- For John the Ripper format: `$7z$...`
- For Hashcat format: Hash mode 11600

### Step 3: Select Cracking Tool and Approach

Choose the appropriate tool based on available resources:

**John the Ripper:**
- Good for CPU-based cracking
- Excellent wordlist and rule support
- Works well with smaller wordlists and rule-based attacks

**Hashcat:**
- Superior GPU acceleration
- Hash mode 11600 for 7z archives
- Better for large-scale brute force attacks

### Step 4: Execute the Attack

**Dictionary Attack (Start Here):**
```bash
# John the Ripper
john --wordlist=/path/to/wordlist.txt hash.txt

# Hashcat
hashcat -m 11600 -a 0 hash.txt /path/to/wordlist.txt
```

**Rule-Based Attack:**
```bash
# John the Ripper
john --wordlist=wordlist.txt --rules hash.txt

# Hashcat
hashcat -m 11600 -a 0 hash.txt wordlist.txt -r rules/best64.rule
```

**Brute Force (Last Resort):**
```bash
# Hashcat mask attack (example: 4-digit PIN)
hashcat -m 11600 -a 3 hash.txt ?d?d?d?d

# John the Ripper incremental
john --incremental hash.txt
```

### Step 5: Verify the Result

After obtaining a candidate password:

1. **Test with the archive directly:**
   ```bash
   7z x -p"recovered_password" target.7z -o./output/
   ```

2. **Check extraction success:**
   - Verify files extracted without errors
   - Confirm file contents are readable and uncorrupted

3. **Document the result:**
   - Save the recovered password to the solution file
   - Note the method used for future reference

## Common Pitfalls and Mistakes

### Hash Extraction Errors
- **Wrong tool version**: Ensure 7z2john/7z2hashcat matches the cracking tool version
- **Malformed hash**: Verify the hash file contains complete, properly formatted output
- **Missing dependencies**: Check that all required Perl/Python modules are installed

### Tool Configuration Issues
- **Wrong hash mode**: Hashcat mode 11600 is specifically for 7z; using wrong mode will fail silently
- **Memory limitations**: 7z hashes can be memory-intensive; adjust workload settings if needed
- **Character encoding**: Ensure wordlists use correct encoding for the target password

### Attack Strategy Mistakes
- **Starting with brute force**: Always begin with dictionary attacks; brute force is computationally expensive
- **Ignoring common patterns**: Try common password patterns, keyboard walks, and variations first
- **Not using rules**: Rule-based attacks significantly expand wordlist coverage efficiently

### Verification Oversights
- **Not testing recovered password**: Always verify by actually extracting the archive
- **Partial extraction**: Ensure all files extract successfully, not just the first one
- **Case sensitivity**: 7z passwords are case-sensitive; verify exact case of recovered password

## Verification Checklist

Before marking the task complete, verify:

- [ ] Hash was extracted successfully and is properly formatted
- [ ] Cracking tool recognized and processed the hash
- [ ] Recovered password successfully extracts the archive
- [ ] Extracted files are intact and readable
- [ ] Solution file contains the correct password
- [ ] All steps and methodology are documented

## Recommended Wordlists

For 7z password cracking, consider these wordlist sources (in order of priority):

1. **rockyou.txt**: Standard first-choice wordlist
2. **SecLists**: Comprehensive password collections
3. **Custom wordlists**: Based on context clues from the challenge/target
4. **Keyboard patterns**: Common keyboard walks and patterns
5. **Numeric sequences**: PINs, dates, phone numbers

## Documentation Best Practices

Always log the cracking process for transparency and reproducibility:

1. **Record tool selection rationale**: Why was this tool chosen?
2. **Document attack progression**: What attacks were tried and in what order?
3. **Note configuration parameters**: What wordlists, rules, and settings were used?
4. **Log timing information**: How long did each attack phase take?
5. **Save intermediate results**: Keep partial progress and cracking session data