axcrypt2john & AxCrypt

An .axx file is an encrypted container, even when the underlying filename includes .zip. The report recovers an AxCrypt backup password and opens the backup before reviewing the contents.

Extract and crack a copy

file backup.zip.axx
python3 /usr/share/john/axcrypt2john.py backup.zip.axx > backup.john
john --wordlist=lab-candidates.txt backup.john
john --show backup.john

Use a jumbo build containing the extractor. Read stderr and confirm that a nonempty AxCrypt record was produced. Container version and cipher support matter; a filename is not sufficient identification. Never send the encrypted .axx directly to unzip and treat an error as an invalid recovered password.

Validate the opening step

Open a copy in a compatible AxCrypt application and enter the recovered file password. Application account sign-in and file decryption are separate checks. Use a clean evidence directory for the resulting archive, list its contents first, and do not execute programs recovered from it.

Success: the original encrypted container opens and yields the expected inner file. An extracted hash or a John potfile entry alone is not final validation. Password-protected documents inside the archive need their own format check and extractor. Restrict backup access, use strong unique protection and rotate any exposed enclosed credentials.

Build a file-to-record inventory

umask 077
mkdir -p evidence/axcrypt
cp backup.zip.axx evidence/axcrypt/backup.zip.axx
sha256sum evidence/axcrypt/backup.zip.axx > evidence/axcrypt/input.sha256
python3 /usr/share/john/axcrypt2john.py evidence/axcrypt/backup.zip.axx \
  > evidence/axcrypt/backup.john 2> evidence/axcrypt/extract-errors.txt
wc -c evidence/axcrypt/backup.john

Keep the encrypted input, extracted record and tool stderr together. Record the extractor revision when using a source checkout. Work on one file first so unsupported versions or truncated containers are obvious before processing a directory.

AxCrypt versions and password roles

Item	Why it changes the workflow
Container format/version	Determines extractor and application compatibility
Encryption password	Opens the file if the format uses password-derived protection
Account sign-in	Can be required by the application without proving file decryption
Additional key material	May be needed by the original encryption setup
Inner `.zip`, document or database	Can have independent password protection

Do not infer compatibility from the installed application’s marketing version. The extractor’s accepted headers and emitted record are the useful evidence. Use John with its recognised format before attempting a hashcat conversion.

Stop and resume candidate testing

john --session=lab-axcrypt --wordlist=lab-candidates.txt evidence/axcrypt/backup.john
john --status=lab-axcrypt
# Resume only after the original session has stopped
john --restore=lab-axcrypt
john --show evidence/axcrypt/backup.john

A passphrase can include spaces and punctuation. Enter the exact recovered value into the compatible opening application; avoid interpreting a colon-delimited display as a different password.

Inspect the decrypted archive

After AxCrypt produces an actual ZIP file:

file evidence/axcrypt/backup.zip
unzip -l evidence/axcrypt/backup.zip
sha256sum evidence/axcrypt/backup.zip

Check names and sizes before extracting selected contents into a separate directory. If it contains an encrypted Office document, use the John extractor guide for that document. Opening the outer container does not remove the inner document’s password.

Troubleshooting and reporting

Observation	Next check
Empty extraction	stderr, supported header and intact file copy
John reports no loaded hashes	Jumbo build and record format
Recovered value fails in AxCrypt	Same original digest, compatible reader and additional key requirements
File opens but ZIP fails	Actual inner file type; filename may be misleading
Archive contains reusable credentials	Record application/account context, then validate one scoped service

Report access to the encrypted backup and successful decryption as separate stages. Retain hashes of originals, redact secrets and describe the exact exposed contents rather than calling every recovered file a usable credential.

How attacks work. Examples use fictional lab values; replace placeholders only with values from the system you are testing.