The libzc library is a simple zip cracking library. It also comes with a command line tool called 'yazc' (Yet Another Zip Cracker).
The following packages are required (following example is for Ubuntu):
sudo apt install -y autoconf libtool zlib1g-dev pkg-config
Just clone, configure, compile and install.
git clone https://github.com/mferland/libzc.git
cd libzc
./autogen.sh
./configure CFLAGS='-Ofast -march=native -mtune=native'
make
sudo make install
There are currently 3 attack modes available:
This mode tries all possible passwords from the given character set. It supports multi-threading.
Example: Try all passwords in [a-z0-9] up to 8 characters with 4 threads:
yazc bruteforce -a -n -l8 -t4 archive.zip
This mode tries all passwords from the given dictionary file. If no password file is given as argument it reads from stdin.
Examples: Try all password from words.dict:
cat words.dict | yazc dictionary archive.zip
Use John The Ripper to generate more passwords:
john --wordlist=words.dict --rules --stdout | yazc dictionary archive.zip
This mode uses a known vulnerability in the pkzip stream cipher to find the internal representation of the encryption key. Once the internal representation of the key has been found, we try to find the actual (or an equivalent) password.
Example 1: Try to find archive.zip password by using plaintext bytes from plain.bin (map bytes 100-650 of plain.bin to bytes 112-662 of archive.zip, first cipher byte is at offset 64):
yazc plaintext -o plain.bin 100 650 archive.zip 112 662 64
Example 2: Try to find the password by mapping the plaintext bytes of document.txt from plaintext.zip to the encrypted version found in encrypted.zip:
yazc plaintext plaintext.zip document.txt encrypted.zip document.txt
Example 3: Use plaintext bytes from plaintextfile and map them to the bytes from cipherfile. We assume that the first 12 bytes from cipherfile is the encryption header. If some bytes cannot be mapped, they are ignored (can happen if either the plaintext or the cipher file is smaller):
yazc plaintext -f plaintextfile cipherfile
The info sub-command lists the content of the zip file. It can help
you get the needed information needed for the plaintext or other
attack modes. Example:
yazc info data/noradi.zip
Result:
INDEX NAME OFFSETS SIZE CSIZE ENCRYPTED HEADER
0 TEXT1.TXT 39 51 155 110 116 875dee36d843e98819faae48
1 TEXT2.TXT 194 206 302 99 108 4fa3648cd55cdbdc071bfae1
2 TEXT3.TXT 341 353 439 88 98 0d9507f1cd95d217c8cadb11
- The first column (INDEX) is the index of the file in the archive.
- The second column (NAME) is the name of the file taken from the zip header.
- The third column (OFFSETS) are some interesting indexes for the plaintext attack (when using the offset '-o' option). The first number is the index of the first byte of the encrypted header, the second number is the first byte of the compressed file and the third number is the index of the last byte of the compressed file.
- The fourth column (SIZE) is the original file size in bytes.
- The fifth column (CSIZE) is the compressed file size including the encrypted header (always 12 bytes).
- The sixth column (ENCRYPTED HEADER) is the encrypted header.
Distributed under the GPLv3+ license. See COPYING for more information.
Marc Ferland - [email protected]