AxCrypt .AXX filety...
 
Notifications
Clear all

AxCrypt .AXX filetype

5 Posts
5 Users
0 Reactions
2,244 Views
vsantola
(@vsantola)
New Member
Joined: 20 years ago
Posts: 3
Topic starter  

Hi fellows,

i have a suspect system with a bunch of .axx files produced by AxCrypt (http//www.axantum.com/AxCrypt/).

Anyone experienced a bruteforce attack against this files and could help me out ?

thanks


   
Quote
DonnieW
(@donniew)
Active Member
Joined: 18 years ago
Posts: 18
 

Based on AES, the 'powers' would be against you ever cracking this. In my admittedly limited password cracking experience, I have had better luck trying to establish (or otherwise find) passwords from evidence than I have been able to brute-force.

I did see this note on another site "AxCrypt maintains an in-memory cache of used passphrases" - although I don't know if its obscured. Have you done a search of swap space for anything AxCryp-related?


   
ReplyQuote
obi-wan
(@obi-wan)
New Member
Joined: 18 years ago
Posts: 1
 

Hi vsantola,
On try worth is also to make an additional copy of the evidence HDD and start the PC with this one.
Now use "cain & abel" and dump the "lsa secrets" and other chached credentials (IE stored Passwords, Outlook etc.).
Sometimes you will find usefull hints for the "missing secret"
Mostly, when you found one password, it will be easy to find more of them.
So far i found, most of the suspect (maybe you do so, too) uses password from the same "architectur" like favorit actress, phrases from movies, names of pets, childrens, cars or what ever.
So when you got one password, the the chance will be great to find the missing ones.

may the force be with you
——————————
Obi-Wan


   
ReplyQuote
(@jmundy)
Eminent Member
Joined: 6 years ago
Posts: 25
 

I have a few ancient .axx files encrypted by AxCrypt. I dont know the password and have no "pointers" such as length, number of words etc to go off.

Their site mentions an in-house brute force program but it seems you need a combination  of a short password and known pointers, for it to be of any use.

Any other reliable way to get round this and decrypt these files guys?

Thanks


   
ReplyQuote
(@rich2005)
Honorable Member
Joined: 19 years ago
Posts: 541
 

Assuming you have a half decent GPU I'd try hashcat after extracting the hash with:

https://github.com/magnumripper/JohnTheRipper/blob/bleeding-jumbo/run/axcrypt2john.py

Might have some luck if it isn't a long password or with dictionary attacks.


   
ReplyQuote
Share: