In cases where a zip file contains a dubious file path, john would fail to parse the hash file generated by zip2john.
The hash output generated by zip2john does not appear to apply any kind of escaping. So it is not clear to me wether john fails to parse it properly or zip2john fails to escape it.
I created a poc as a bash script such that the issue can be reproduced.
My system:
Ubuntu 22.04.5 LTS
John the Ripper 1.9.0-jumbo-1+bleeding-67fcf9fe5a 2025-09-04 23:50:10 +0200 OMP [linux-gnu 64-bit x86_64 AVX AC]
Script to reproduce the issue
#!/bin/bash
# Create a file to zip with a dubious path
mkdir "test\" && C:"
echo 'hello world' > "test\" && C:/file.txt"
# embed it into an encrypted zip
zip -P abc123 archive.zip "test\" && C:/file.txt"
# extract hash
john/run/zip2john archive.zip > hash.txt
# running john now fails in the sense, that it can not find any password hash in the file
# even though there is one hash present
john/run/john hash.txt
cat hash.txt
In cases where a zip file contains a dubious file path,
johnwould fail to parse the hash file generated byzip2john.The hash output generated by
zip2johndoes not appear to apply any kind of escaping. So it is not clear to me wetherjohnfails to parse it properly orzip2johnfails to escape it.I created a poc as a bash script such that the issue can be reproduced.
My system:
Ubuntu 22.04.5 LTS
John the Ripper 1.9.0-jumbo-1+bleeding-67fcf9fe5a 2025-09-04 23:50:10 +0200 OMP [linux-gnu 64-bit x86_64 AVX AC]
Script to reproduce the issue