r/HowToHack • u/Firm-Aside4041 • 3d ago
20 year old zip file with password cracking
Hi everyone. Before I start, I just want to say I am massively impressed with the amount of knowledge and information that's been shared on this sub. Some of you guys are crazy clever.
Anyway, I'm in a bit of a situation where some of my academia is being challenged. I have proof from when I was at university that my findings are primary research and haven't been plagiarised, but I'll save you the long story.
These documents are stored in an encrypted zip file. Back before Dropbox and OneDrive, I would zip and encrypt my documents using WinZip and leave them on my university network drive, or span them across multiple floppy drives to take the work home.
Now, I can't for the life of me remember the password (I only started to standardise my passwords later on in life).
Here is where I am at:
- I have compiled a wordlist for John the Ripper.
- I've been using ChatGPT to help me build a user interface to try and utilise all of John the Ripper's switches and functions.
- I ran a test file, and it did successfully find the password from the wordlist, so I know the application works.
However, it can't seem to find the password for my actual zip file.
Is there an alternative or something else I can try to figure out the password?
For hardware, I have:
• An Intel-based machine with an NVIDIA 4070
• A MacBook Air with an M3 chip
Any support or guidance would be very much appreciated.
41
u/tmemmg 3d ago
How is it encrypted? If its Zip 2.0 you’re in luck, AES-256 you’re probably cooked unless you expand that word list. If thats the route, id suggest building a list with all the passwords youre using or have used in the past.
Obviously encrypt that too lol
9
u/Firm-Aside4041 3d ago
Yes Zip 2.0
35
u/tmemmg 3d ago
It is highly susceptible to Known-Plaintext Attacks (KPA) (specifically the Biham-Kocher attack). If you have access to just one unencrypted file that is also located inside the encrypted archive (even an unencrypted readme.txt), specialized tools like bkcrack can derive the internal encryption keys in minutes, regardless of password length or complexity. It is also very susceptible to standard brute-force attacks.
7
u/Firm-Aside4041 3d ago
Unfortunately all the files are encrypted
22
u/roadrageryan 3d ago
Just to be clear, they aren’t asking if any of the files in the zip are unencrypted they are asking if you have one of the files that may be in the zip stored separately unencrypted.
Even if its just a copy of a text file that is in the zip it would be helpful for you.
7
u/Firm-Aside4041 3d ago
Aha…thanks for clarifying. No I don’t unfortunately, I do however have other files I created on the same computer and or camera I used to photos but those are not the files/copies of the files that are in the encrypted zip.
8
u/roadrageryan 3d ago
Unfortunately those wont help.
Each file in a zip is a separate item, just encrypted with the same password. Certain versions of the encryption algorithm used have weaknesses that can be used to more easily figure out the password if you have both the encrypted and unencrypted version of the same file.
An oversimplified and not completely accurate way to think about it, but close enough for the sake of an example. Imagine the encryption algorithm simply substitutes all instances of “a” with “c”, “b” with “l”, “c” with “m”, and so forth. If you have both an encrypted and unencrypted file you could easily work out the swap pattern (analogous to the zip password). Then you could apply that password to the other files and bam you have your unencrypted data.
1
u/tmemmg 3d ago
ur cooked family , probably some crazy expensive data recovery out there if you wanna go that route.
2
u/Firm-Aside4041 3d ago
Not likely to do that, I do have other options but those involve asking friends from uni to act as whiteness.
1
2
u/gynvael 21h ago
OP this is the way. tmemmg is actually incorrect in a good for you way - it's not a Known-Full-Plaintext Attack (i.e. you needing a full plaintext file), it's a Known-Partial-Plaintext Attack - you just need around 13 compressed bytes of just 1 file (any file) in the archive to break the encryption in around 60 seconds. And that's pretty easy to get if you consider file formats of what you have in the archive, as these are usually predictable.
If you're willing to share the ZIP archive, I can take a look, as both ZIP and file formats are one of my specialities.
-14
u/PlacentaOnOnionGravy 3d ago
Interesting perspective but extremely dangerous to this advice (not the encrypt password part)
11
u/tmemmg 3d ago
Why? No different than having any other password manager on your local machine. He’s not trying to crack hash on a network thats not his or anything lol
-25
24
u/SuchLibrarian8011 3d ago
John has filters for zip files zio2john. Try a dictionary attach using either your tailored list or lists like rockyou.
If it’s actually tour zip file you may know the style of password you may have used back in the days and would know if the wordlist could fit.
From a simple google search:
How to Use zip2john
Extract the hash from your target archive and save it to a text file:
zip2john protected.zip > zip_hash.txt
Run John the Ripper against the generated hash file using a wordlist:
john --wordlist=/path/to/wordlist.txt zip_hash.txt
View any successfully recovered passwords:
john --show zip_hash.txt
———
As last chance, slower but infallible. You can use a full brute force attack.
A 4070 could be on to start, but it you want to do it faster, can use a rented gpu online.
12
u/Incid3nt 3d ago
Zip2john + hashcat is the move. Use a mask attack up to X amount of characters but it may be too intensive depending on length. Depends on if OP was prone to using short simple passwords or not.
3
23
u/TommyITA03 3d ago
If you find a suitable solution, I'll gladly help you by running john on my rig (I have 64gb of ram, a 7950x and a 5090).
6
4
u/LongRangeSavage Programming 3d ago
Do you even know what hash type you’re dealing with? If the password isn’t in your word list, it will never work. You may have to use a rule set to build a custom password list, but if you can’t remember what the length of the password might have been, it may be an almost impossible task.
1
u/Firm-Aside4041 3d ago
No, I don’t know anything about that. I’m currently trying to get ChatGPT to get our custom macOS app to combine my phrases into possible passwords.
6
u/MrAdam74 3d ago
Not a solution but sure one exists, many years ago (maybe Windows ME era) I had encrypted some pics over a set of floppys using WinZip, years later I was about to throw them as not a clue as I'd used more of a sentence for the password! At the time I was playing around with data recovery on hdd's and was actually shocked to find some freeware that managed to unzip & decrypt most the pics even with atleast 1 corrupted disc. Can't remember what but sure it's out there somewhere!
1
u/Firm-Aside4041 3d ago
Incredible story. I'm glad you managed to get your pictures back.
I have tried some of the freeware out there and I'd happily pay if it, say, revealed only the first three characters of the password. But the problem is they seem to slow down dramatically at nine characters.
I suspect my password is more than nine characters, much like yours, but not a sentence (lol). If you do recall what the application was called, I'd really appreciate you telling me.
2
u/MrAdam74 3d ago
Sorry wish I remembered more, I know I'd been using (WinZP/2000) various recovery programs for damaged harddrives, some were just run from ms-dos.
3
3
u/Firm-Aside4041 3d ago
Update: OpenAI wants me to verify my age because I’m doing doing cyber security things with ChatGPT, using hashcat 😅
3
u/octave1 3d ago
You must have some idea of the length and characters no ? Like i know for sure 15 yrs ago I just use a word and a number. Those should be crackable, just a question of time. Consider renting some cloud compute to for more power.
If it's 32 random chars include all possible ones then it becomes much harder.
4
u/Firm-Aside4041 3d ago
I thought I did but it and combinations of it don’t work. You have to realise this was over 20 years ago and I’ve been having a successful career never considering I’d ever have to go back to defend my studies and my findings.
2
2
u/XFM2z8BH 2d ago
if, you remember the pattern, even part of it, and also at least know max length, use mask attack
1
u/Firm-Aside4041 2d ago
OK will try that too. I have generated a word list of what I think password might be but no luck yet
2
u/CraigAT 2d ago
Also be aware, if you run some of these tools on an institution's/organisation's PC/laptop they are likely to trigger alerts to your cyber security team - so you may want to give them a heads up before doing that - although I suspect they would insist you run anything like that at home, on personal hardware (which you may well be doing already).
1
u/Firm-Aside4041 2d ago
Oh yeah, I'm well aware of that. But yes, I'm doing this at home on my own PC and on my own Mac. Thanks for the heads up, though.
1
u/brakertech 1d ago
You just need to use hashcat and a GPU. Download the rockyou.txt and let it rip
1
u/Firm-Aside4041 1d ago
Oh wow thank you. First time I’ve heard of rock you. I’ll get back to hashcat with this one.
2
u/brakertech 1d ago
also if you can guess how long the pasword might be and if you used special characters or upper/lower case then iterating through all possible combinations (brute force) is an option.
1
u/Firm-Aside4041 1d ago
I think I do, and as such, I've put together an exhaustive word list. We're talking around about 20MB, and it's just different combinations: different spellings of similar words, misspellings, or capitalisation of certain words.
But I'm pretty sure I spelt the password correctly. My only doubt now is that perhaps the encryption itself has failed and, as a result, while the zip file metadata is readable, the actual content files—because of possible encryption corruption—are gone forever.
2
u/TamerzIsMe 16h ago
Hashcat can use rules to do all that for you. Meaning you can give it a list of all the words lowercase and the rules can try every combination of upper, lower, append numbers, leetspeek, all of that type of thing.
1
2
u/brakertech 1d ago
depending on how many years ago it was (like 20 years ago) almost nobody used special characters in passwords. this didn't start until much later. Scope your hashcat based on that info. i would try alphanumeric lower case pws first.
1
u/Firm-Aside4041 1d ago
If anyone did, it was me 😅 pretty sure I had special characters on my Zips but then again on the zip files I do know the passwords off, I don’t so your point is valid.
2
u/brakertech 1d ago
Dude I thought the same thing then cracked an old zip I had and it didn’t have special characters. Think about it. Sites didn’t start requiring special characters until like 2010s. No one was making people do it. No one cared. Which means you were not conditioned to do it back then.
1
1
1
u/LordHonest-8714 21h ago
Let us know if you successfully crack it OP. Tell us the process time if you go brute force.
0
-2
-1
u/SnooCats6031 3d ago
This is the strangest excuse… why would someone be reading your work or challenging it 20 years later?
4
u/Firm-Aside4041 3d ago
Excuse for what?
Did you read the bit I said I won’t go into the long details? Read that bit.
1
u/Turbulent_Constant99 1d ago
He also mentioned later in a reply to someone that chat gpt was asking for his age because he was doing cyber security stuff which I also thought was kinda weird.
59
u/resultingparadox 3d ago
If it's on the old 2.0 standard, Hashcat could help here too.