2

I have allfiles.zip contains only file allfiles.exe and is password protected. I heard about pkcrack, it is possible to get the file from a zip file which is encrypted if we have some part of encrypted zip.(Correct me if I'm wrong)

So, with that statement, I have add a plaintext file(words.txt) to allfiles.zip, created another zip file wordfiles.zip which contains only plaintext file words.txt and run pcrack.(You can see below step-by-step)

  1. Initially we have password protected zip
allfiles.zip
  -> allfiles.exe
  1. Add a dummy plaintext file to allfiles.zip. Now the file allfiles.zip contains 2 files
allfiles.zip
  -> allfiles.exe
  -> words.txt
  1. Create a zip file contains only words.txt
wordfiles.zip
  -> words.txt
  1. Run pkcrack on those files
./pkcrack -C allfiles.zip -c words.txt -P wordfiles.zip -p words.txt -d allfiles.exe1 -a
Warning! Plaintext is longer than Ciphertext!
Files read. Starting stage 1 on Thu Feb 28 11:39:48 2019
Generating 1st generation of possible key2_255982 values...done.
Found 4194304 possible key2-values.

---OUTPUT REMOVED----

Lowest number: 93 values at offset 246121
Done. Left with 93 possible Values. bestOffset is 246121.
Stage 1 completed. Starting stage 2 on Thu Feb 28 11:40:10 2019
Stage 2 completed. Starting zipdecrypt on Thu Feb 28 11:40:15 2019
No solutions found. You must have chosen the wrong plaintext.
Finished on Thu Feb 28 11:40:15 2019

Is this a right way to crack? What is the best way to crack?(Other than fcrackzip)

Improve this question
5
  • 1
    I think you're confusing a known-plaintext attack (KPA) with cracking a random file. So zip 1 contains two files: the file you want to crack and your known plaintext (you called it words.txt). Zip 2 contains only the plaintext (words.txt). In a KPA, the known file in zip 1 would be encrypted and zip 2 is only so pkcrack knows what the plaintext version of it is. But because you never encrypted words.txt in zip 1 (since you don't have the password), you are basically giving pkcrack two identical files, so it cannot find any solutions.
    – Luc
    Feb 28, 2019 at 12:06
  • 1
    In layman's terms, you're using an attack that you cannot do because you don't have the plaintext of allfiles.exe. If you did, then you could recover the encryption pattern (the 'keystream') and apply it to other files, of which you might not have the plaintext (e.g. if allfiles.zip contains another file which you don't yet know the contents of, but it doesn't: there is only allfiles.exe).
    – Luc
    Feb 28, 2019 at 12:08
  • @Luc Understood. I just came to know whatever I was doing is not possible
    – Veerendra K
    Feb 28, 2019 at 12:10
  • I realized what I said is a little too long for a comment, so I tried to write it in a more structured way as an answer. Sorry I can't help you further!
    – Luc
    Feb 28, 2019 at 12:16
  • 1
    your words.txt has to be encrypted in a same way as allfiles.exe to make this trick work
    – Tejas Pandya
    Feb 28, 2019 at 12:21

1 Answer 1

Reset to default
3

PKCrack does a known-plaintext attack (KPA). So you need to know the plaintext of a file in the zip archive before you can decrypt other files in the same zip file. But there are no other files in your archive, so you cannot do the attack.

One might ask "What is the point of doing a KPA, if you already need to know the answer?" Well, imagine you have a zip archive with the files "passwords.txt" and "usernames.txt". You could have obtained the plaintext of "usernames.txt" through other means (like asking the sysadmin) because it's not secret. By comparing the known contents of the usernames file with the encrypted version, you can (using pkcrack) recover the keystream. Then, you can use that keystream to decrypt the other file ("passwords.txt"). Note that you never learn the password, but you can decrypt the other file(s) in the archive.

In your case, "passwords.txt" is "allfiles.exe" (the file you don't know the contents of, but you want to decrypt it). To try to simulate the attack, you added "words.txt" to the zip archive, but you can't encrypt "words.txt" with the same keystream as "allfiles.exe" because you don't know the password (so you can't generate that keystream). So the attack is impossible this way.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .