Zip Plaintext Attack
Zip Plaintext Attack¶
ZipCrypto Attack¶
Setup BKCrack:
git clone https://github.com/kimci86/bkcrack/
cd bkcrack
cmake .
make
View Example Zip:
>>> 7z l example/secrets.zip
7-Zip [64] 17.04 : Copyright (c) 1999-2021 Igor Pavlov : 2017-08-28
p7zip Version 17.04 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,16 CPUs x64)
Scanning the drive for archives:
1 file, 56263 bytes (55 KiB)
Listing archive: example/secrets.zip
--
Path = example/secrets.zip
Type = zip
Physical Size = 56263
Date Time Attr Size Compressed Name
------------------- ----- ------------ ------------ ------------------------
2012-08-14 08:51:04 ..... 54799 54700 advice.jpg
2018-12-20 08:33:50 ..... 1265 1277 spiral.svg
------------------- ----- ------------ ------------ ------------------------
2018-12-20 08:33:50 56064 55977 2 files
>>> 7z l -slt example/secrets.zip
7-Zip [64] 17.04 : Copyright (c) 1999-2021 Igor Pavlov : 2017-08-28
p7zip Version 17.04 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,16 CPUs x64)
Scanning the drive for archives:
1 file, 56263 bytes (55 KiB)
Listing archive: example/secrets.zip
--
Path = example/secrets.zip
Type = zip
Physical Size = 56263
----------
Path = advice.jpg
Folder = -
Size = 54799
Packed Size = 54700
Modified = 2012-08-14 08:51:04
Created = 2021-05-22 11:39:56
Accessed = 2021-05-13 17:12:33
Attributes = _ -rw-rw-r--
Encrypted = +
Comment =
CRC = 7CA9F10A
Method = ZipCrypto Deflate
Characteristics = NTFS : Encrypt
Host OS = Unix
Version = 20
Volume Index = 0
Offset = 0
Path = spiral.svg
Folder = -
Size = 1265
Packed Size = 1277
Modified = 2018-12-20 08:33:50
Created = 2021-05-22 11:39:56
Accessed = 2021-05-22 11:39:57
Attributes = _ -rw-rw-r--
Encrypted = +
Comment =
CRC = A99F1D0D
Method = ZipCrypto Store
Characteristics = NTFS : Encrypt
Host OS = Unix
Version = 20
Volume Index = 0
Offset = 54740
Since the svg images start with <?xml version="1.0" this is known plaintext
Get the Encryption Key:
>>> echo -n '<?xml version="1.0" ' > plain.txt
>>> ./src/bkcrack -C example/secrets.zip -c spiral.svg -p plain.txt
bkcrack 1.5.0 - 2023-11-03
[12:42:47] Z reduction using 13 bytes of known plaintext
100.0 % (13 / 13)
[12:42:48] Attack on 542303 Z values at index 6
Keys: c4490e28 b414a23d 91404b31
33.9 % (183770 / 542303)
[12:47:43] Keys
c4490e28 b414a23d 91404b31
Decrypt the rest of the Zip:
>>> ./src/bkcrack -C example/secrets.zip -c spiral.svg -k c4490e28 b414a23d 91404b31 -d spiral_deciphered.svg
>>> ./src/bkcrack -C example/secrets.zip -c advice.jpg -k c4490e28 b414a23d 91404b31 -d advice_deciphered
bkcrack 1.5.0 - 2023-11-03
[12:48:37] Writing deciphered data advice_deciphered (maybe compressed)
Wrote deciphered data.
generalzero@dev:bkcrack [master] 16A
>>> file advice_deciphered
advice_deciphered: data
generalzero@dev:bkcrack [master] 16A
>>> python3 tools/inflate.py < advice_deciphered > advice.out
generalzero@dev:bkcrack [master] 17A
>>> file advice.out
advice.out: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 250x250, components 3
Get the Password from the Key:
>>> ./src/bkcrack -k c4490e28 b414a23d 91404b31 --bruteforce "?p" --length 0..12
bkcrack 1.5.0 - 2023-11-03
[12:50:14] Recovering password
length 0-6...
length 7...
length 8...
length 9...
length 10...
length 11...
length 12...
Password: W4sF0rgotten
58.1 % (5246 / 9025)
[12:51:59] Password
as bytes: 57 34 73 46 30 72 67 6f 74 74 65 6e
as text: W4sF0rgotten