[InsertEnd]

I have a password protected zip archive that contains 2 files, a.txt (4GB/60GB) and b.txt (2KB/4KB) (compressed/uncompressed)

I can see the files name, but not the content.

I have a copy of b.txt uncompressed and decrypted from when I knew the password

What approaches do you recommend?

For now, I'm trying to find out how to use hashcat, I was able to crack some test files.

thanks in advance

[InsertEnd]

I'm almost giving up...

First, the zip2hashcat tool continues to error when trying to use in this archive, even though it has worked in other archives.

I moved to zip2john, made sure that hashcat can understand (hashcat --identify) the hash generated by the z2j (with some minor output modifications), I did some crack tests and succeeded.

But Hashcat cannot identify the z2j hash for this file.

ver 4.5 efh 9901 efh 0001 zip.zip/a.txt PKZIP64 Encr: cmplen=4615782974, decmplen=60120607476, crc=814EDE77
ver 2.0 efh 9901 zip.zip/b.txt PKZIP Encr: cmplen=1772, decmplen=3963, crc=F2147600
NOTE: It is assumed that all files in each archive have the same password.
If that is not the case, the hash may be uncrackable. To avoid this, use
option -o to pick a file at a time.

So I decided to arbitrarily use the 17220 mode (PKZIP|compacted multi-file) and now the hashcat says this has a type of compression unsupported for the current mode

Then I started using John the Ripper, assuming the problem is the compatibility with the hash generated by z2j.

Once again, I did some tests, cracked some files that I created

And when I use

$ john hash

says

Using default input encoding: UTF-8
No password hashes loaded (see FAQ)

My last attempt is a dictionary that I created with hashcat, using some keywords

for pass in $(cat dict.txt); do { 7z x -aoa -ooutput -p$pass zip.zip; if (($? == 0)); then break; fi; }; done;

If that doesn't work, I'll give up, at least for a while.

[joepa]

https://security.stackexchange.com/quest...tected-zip

zip2john

[linbobo668899]

https://security.stackexchange.com/quest...to-hashcat
https://hashcat.net/forum/thread-11466.html
https://github.com/hashcat/hashcat/issues/2302

You might be stuck. 

1. Hashcat does not support all current zip/7zip/rar.
   
2. Hashcat does not support cracking hashes from very large zip files.