I'm taking part in a capture-the-flag exercise; the level of difficulty is competent, but non-expert. I'm not a security practitioner, but I do have a development background and a reasonable knowledge of standard tools and techniques.
One task involves a number of steps to recover an encrypted zip file, which I have done. The zip then contains a single file, flag.txt - the target. The final step is to break the encryption.
The zip file is small, 190 bytes in total, and analysis of the zip file header with a hex editor shows it was created with the v2.0 PKzip format (which I understand is relatively insecure). The target file itself is 28 bytes long.
I've run a dictionary attack with the rockyou wordlist, and a brute-force attack of the full lowercase/uppercase/numeric/special character set up to five characters, without any luck (both with fcrackzip on kali Linux). The challenge is not at a level where we should be using specialist kit (e.g. GPU-based cracking), so if brute-force was the answer then i'd expect a very simple password.
So I must be missing a trick. Can anybody suggest what it could be? I'm aware that the PKZip v2 format has a known-plaintext attack, but I believe this is most commonly used in the case that the zip contains one or more commonly-available files (e.g. a widely-available jpg or jar file) that can be found elsewhere to provide the plaintext, and I don't have that here. Are there other attacks that I haven't found? Or is known-plaintext the only remaining answer, and I need to try and figure out what could be in the file? As I understand it, it is just about large enough for known-plaintext to be applied?
Thank you for any thoughts