I have an encrypted file and the program.exe through which it was encrypted. When I want decrypt file, I need to know the password with which the file was encrypted. Can you help me some tool for brute-force attack to this password, which will be usable for .exe file? When I paste wrong password, I get a popup window displaying message: wrong password.


The oldy but goldy one is John the Ripper which is open source and can be extended to your "program.exe". Needless to say, you need to know how the executable was encrypted. You cannot use John, or even your own extended version, to decrypt container formats for which the format and choice of algorithms isn't known.

Kerckhoff's principle states that the security of a crypto-system should not depend on static information such as the algorithm. Unfortunately that does not mean that it is necessarily easy to decrypt if the protocol or algorithm is not known or kept secret.

You may be able to identify the format of the file by using the Unix file command, other tools or even a text or hex editor. Looking at the header of the file does indeed make most sense initially, as safesploit muses.

  • I can send you this file and program with source code through which file was encrypted if it helps. – Brian Nov 18 '18 at 21:40
  • 1
    Thanks but I've got enough files on my computer as it is. I don't need any new ones. – Maarten Bodewes Nov 18 '18 at 21:43
  • So can you give me some contact to someone who can help me if I send him this files? – Brian Nov 18 '18 at 22:20

Without more information about how the file was encrypted, I cannot give specifics. Forgot password to 7-Zip archive, may give insight.

Beyond this, I would suggest extracting the file header information. This should contain the hash of the password. Then you could identify the encryption algorithm and rounds used by program.exe and use the same KDF to brute force the hash to identify the password.

  • 1
    "...the file header information. This should contain the hash of the password" - why should any properly encrypted file contain a hash of the password? Some might do this to quickly check if the password is valid before trying to decrypt but this information is not really needed for decryption so most formats will not include such information. Also, how exactly can the file header and the position of a maybe hashed password in it be found if the format is unknown in the first place? And why should the file even have a header? – Steffen Ullrich Nov 18 '18 at 14:02
  • @SteffenUllrich It was merely a suggestion from when I needed to brute force a LUKS encrypted partition. Like I stated, 'without more information about how the file was encrypted, I cannot give specifics'. – safesploit Nov 18 '18 at 15:02
  • 1
    I'm a bit two-faced about this question myself. For one it contains good info, such as the requirement to first identify the format / algorithms used. On the other hand the part about the hash and the fact that you can always identify the format using the header is simply incorrect. Small hint: writing in third person (so forgoing "I" and possibly even "you") gives a more neutral and scientific feel to answers (but that's just a writing hint). – Maarten Bodewes Nov 18 '18 at 15:03
  • @MaartenBodewes This is why I spoke in a passive tone, and used the words like 'suggest' and 'should'. As I was creating a generalised idea. While I do appreciate your point if misleading the readers, I would hope readers would appreciate that I mention about not giving 'specifics'! – safesploit Nov 18 '18 at 15:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.