telegram2john.py [Errno 21] Is a directory

[MrNonoss]

Hi there,

I am trying to create a hash of a Telegram Desktop install on a Windows 10 forensic image. My working computer is also a Windows 10 machine, with wsl2 and a kali subsystem

Steps to reproduce

I mounted my forensic image into a dd like and mounted the windows partition to /mnt/ewf. The command is : /usr/share/john/./telegram2john.py "/mnt/ewf/Users/XXXXX/AppData/Roaming/Telegram Desktop" It returns the following error: IsADirectoryError: [Errno 21] Is a directory: '/mnt/ewf/Users/XXXXX/AppData/Roaming/Telegram Desktop'. According to my understanding, the path should point to a directory, but why this error?

I can confirm the data is well seen in this directory.

System configuration

Attach details about your OS and about JtR, including:

• └─$ john --list=build-info Version: 1.9.0-jumbo-1 Build: linux-gnu 64-bit x86_64 AVX512BW AC OMP SIMD: AVX512BW, interleaving: MD4:3 MD5:3 SHA1:1 SHA256:1 SHA512:1 System-wide exec: /usr/lib/john System-wide home: /usr/share/john Private home: ~/.john CPU tests: AVX512BW CPU fallback binary: john-avx512f-omp OMP fallback binary: john-avx512bw-non-omp $JOHN is /usr/share/john/ Format interface version: 14 Max. number of reported tunable costs: 4 Rec file version: REC4 Charset file version: CHR3 CHARSET_MIN: 1 (0x01) CHARSET_MAX: 255 (0xff) CHARSET_LENGTH: 24 SALT_HASH_SIZE: 1048576 SINGLE_IDX_MAX: 32768 SINGLE_BUF_MAX: 4294967295 Effective limit: Max. KPC 32768 Max. Markov mode level: 400 Max. Markov mode password length: 30 gcc version: 9.2.1 GNU libc version: 2.28 (loaded: 2.31) Crypto library: OpenSSL OpenSSL library version: 01010103f (loaded: 01010109f) OpenSSL 1.1.1c 28 May 2019 (loaded: OpenSSL 1.1.1i 8 Dec 2020) GMP library version: 6.1.2 (loaded: 6.2.1) File locking: fcntl() fseek(): fseek ftell(): ftell fopen(): fopen memmem(): System's

Many thanks for your help

[claudioandre-br]

Could you please try to run it using the latest version from here (github repository)?

[MrNonoss]

My bad. I thought I had the latest version already. Many thanks ;)