Link to this headingZip Plaintext Attack

Link to this headingZipCrypto Attack

Setup BKCrack:

git clone https://github.com/kimci86/bkcrack/ cd bkcrack cmake . make

View Example Zip:

>>> 7z l example/secrets.zip 7-Zip [64] 17.04 : Copyright (c) 1999-2021 Igor Pavlov : 2017-08-28 p7zip Version 17.04 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,16 CPUs x64) Scanning the drive for archives: 1 file, 56263 bytes (55 KiB) Listing archive: example/secrets.zip -- Path = example/secrets.zip Type = zip Physical Size = 56263 Date Time Attr Size Compressed Name ------------------- ----- ------------ ------------ ------------------------ 2012-08-14 08:51:04 ..... 54799 54700 advice.jpg 2018-12-20 08:33:50 ..... 1265 1277 spiral.svg ------------------- ----- ------------ ------------ ------------------------ 2018-12-20 08:33:50 56064 55977 2 files >>> 7z l -slt example/secrets.zip 7-Zip [64] 17.04 : Copyright (c) 1999-2021 Igor Pavlov : 2017-08-28 p7zip Version 17.04 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,16 CPUs x64) Scanning the drive for archives: 1 file, 56263 bytes (55 KiB) Listing archive: example/secrets.zip -- Path = example/secrets.zip Type = zip Physical Size = 56263 ---------- Path = advice.jpg Folder = - Size = 54799 Packed Size = 54700 Modified = 2012-08-14 08:51:04 Created = 2021-05-22 11:39:56 Accessed = 2021-05-13 17:12:33 Attributes = _ -rw-rw-r-- Encrypted = + Comment = CRC = 7CA9F10A Method = ZipCrypto Deflate Characteristics = NTFS : Encrypt Host OS = Unix Version = 20 Volume Index = 0 Offset = 0 Path = spiral.svg Folder = - Size = 1265 Packed Size = 1277 Modified = 2018-12-20 08:33:50 Created = 2021-05-22 11:39:56 Accessed = 2021-05-22 11:39:57 Attributes = _ -rw-rw-r-- Encrypted = + Comment = CRC = A99F1D0D Method = ZipCrypto Store Characteristics = NTFS : Encrypt Host OS = Unix Version = 20 Volume Index = 0 Offset = 54740

Since the svg images start with <?xml version="1.0" this is known plaintext

Get the Encryption Key:

>>> echo -n '<?xml version="1.0" ' > plain.txt >>> ./src/bkcrack -C example/secrets.zip -c spiral.svg -p plain.txt bkcrack 1.5.0 - 2023-11-03 [12:42:47] Z reduction using 13 bytes of known plaintext 100.0 % (13 / 13) [12:42:48] Attack on 542303 Z values at index 6 Keys: c4490e28 b414a23d 91404b31 33.9 % (183770 / 542303) [12:47:43] Keys c4490e28 b414a23d 91404b31

Decrypt the rest of the Zip:

>>> ./src/bkcrack -C example/secrets.zip -c spiral.svg -k c4490e28 b414a23d 91404b31 -d spiral_deciphered.svg >>> ./src/bkcrack -C example/secrets.zip -c advice.jpg -k c4490e28 b414a23d 91404b31 -d advice_deciphered bkcrack 1.5.0 - 2023-11-03 [12:48:37] Writing deciphered data advice_deciphered (maybe compressed) Wrote deciphered data. generalzero@dev:bkcrack [master] 16A >>> file advice_deciphered advice_deciphered: data generalzero@dev:bkcrack [master] 16A >>> python3 tools/inflate.py < advice_deciphered > advice.out generalzero@dev:bkcrack [master] 17A >>> file advice.out advice.out: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 250x250, components 3

Get the Password from the Key:

>>> ./src/bkcrack -k c4490e28 b414a23d 91404b31 --bruteforce "?p" --length 0..12 bkcrack 1.5.0 - 2023-11-03 [12:50:14] Recovering password length 0-6... length 7... length 8... length 9... length 10... length 11... length 12... Password: W4sF0rgotten 58.1 % (5246 / 9025) [12:51:59] Password as bytes: 57 34 73 46 30 72 67 6f 74 74 65 6e as text: W4sF0rgotten