8000 Testing recovery using advice.jpg · Issue #83 · kimci86/bkcrack · GitHub
[go: up one dir, main page]
Skip to content

Testing recovery using advice.jpg #83

New issue
New issue
Open
Open
Testing recovery using advice.jpg#83
Labels
documentation

Description

@palmerc
palmerc
opened on Nov 29, 2022

As an exercise in understanding how to work with known plaintext that is compressed I unzipped the zip file and did the following:

python3 ../tools/deflate.py < advice.jpg > advice.deflate
../bkcrack -C secrets.zip -c advice.jpg -p ./advice.deflate -t 12

Could not find the keys.

This suggests that the compression settings are wrong. I've tried changing the compression settings, but nothing seems to work. I think this would be a useful example for the tutorial

Activity

  1. kimci86
    added
    documentation
    on Nov 29, 2022

  2. kimci86 commented on Nov 29, 2022

    @kimci86
    kimci86
    on Nov 29, 2022
    Owner

    You are right, using the deflate python script (using zlib deflate compressor under the hood) does not generate correct compressed data for that example. I created the example secrets.zip archive using 7zip with compression level 9.
    You can get the same compression with this command: 7z a -mx=9 plain.zip advice.jpg

    That information could be a nice addition to the tutorial, thank you for the suggestion.
    Let's keep this issue open to remind me to eventually add it.

  3. palmerc commented on Nov 29, 2022

    @palmerc
    palmerc
    on Nov 29, 2022
    Author

    Tested and works!

    palmerc@foxtrot example % 7z a -mx=9 plain.zip advice.jpg
palmerc@foxtrot example % ../bkcrack -C secrets.zip -c advice.jpg -P plain.zip -p advice.jpg 
bkcrack 1.5.0 - 2022-11-29
[19:56:51] Z reduction using 54681 bytes of known plaintext
16.0 % (8732 / 54681)
[19:56:51] Attack on 141 Z values at index 46518
Keys: c4490e28 b414a23d 91404b31
36.9 % (52 / 141)
[19:56:51] Keys
c4490e28 b414a23d 91404b31

  4. palmerc commented on Nov 29, 2022

    @palmerc
    palmerc
    on Nov 29, 2022
    Author

    Even with only 12 bytes of 'plain text' it results in victory.

    palmerc@foxtrot example % ../bkcrack -C secrets.zip -c advice.jpg -P plain.zip -p advice.jpg -t 12 
bkcrack 1.5.0 - 2022-11-29
[20:05:02] Z reduction using 5 bytes of known plaintext
100.0 % (5 / 5)
[20:05:02] Attack on 1046104 Z values at index 6
Keys: c4490e28 b414a23d 91404b31
63.5 % (664022 / 1046104)
[20:13:02] Keys
c4490e28 b414a23d 91404b31

  5. palmerc commented on Nov 30, 2022

    @palmerc
    palmerc
    on Nov 30, 2022
    Author

    You can also leverage the fact that 7z can give you the CRC on a binary file. I saw a post that used this fact to find the released version of putty - this allowed them to find the original plaintext by downloading each one until they hit the one with a matching CRC. Then it becomes a matter of compression settings.

    palmerc@foxtrot example % 7z h advice.jpg 

7-Zip [64] 17.04 : Copyright (c) 1999-2021 Igor Pavlov : 2017-08-28
p7zip Version 17.04 (locale=utf8,Utf16=on,HugeFiles=on,64 bits,10 CPUs LE)

Scanning
1 file, 54799 bytes (54 KiB)

CRC32             Size  Name
-------- -------------  ------------
7CA9F10A         54799  advice.jpg
-------- -------------  ------------
7CA9F10A         54799  

Size: 54799

CRC32  for data:              7CA9F10A

Everything is Ok

    palmerc@foxtrot example % ../bkcrack -L secrets.zip 
bkcrack 1.5.0 - 2022-11-29
Archive: secrets.zip
Index Encryption Compression CRC32    Uncompressed  Packed size Name
----- ---------- ----------- -------- ------------ ------------ ----------------
    0 ZipCrypto  Deflate     7ca9f10a        54799        54700 advice.jpg
    1 ZipCrypto  Store       a99f1d0d         1265         1277 spiral.svg

  6. Bang1338 commented on May 12, 2026

    @Bang1338
    Bang1338
    on May 12, 2026

    4 years late, but I can confirm that it works

    >bkcrack -L secret.zip
bkcrack 1.8.1 - 2025-10-25
Archive: secret.zip
Index Encryption Compression CRC32    Uncompressed  Packed size Name
----- ---------- ----------- -------- ------------ ------------ ----------------
    0 None       Store       00000000            0            0 secret/
    1 None       Store       00000000            0            0 secret/Codes/
    2 ZipCrypto  Deflate     b6e7312e         6576         1954 secret/Codes/Encdecsim.cpp
    3 ZipCrypto  Deflate     ac8e2558         1189          464 secret/Codes/Encdecsim.h

>7z a -mx=9 plain.zip Encdecsim.cpp

7-Zip 26.00 (x86) : Copyright (c) 1999-2026 Igor Pavlov : 2026-02-12

Scanning the drive:
1 file, 6576 bytes (7 KiB)

Creating archive: plain.zip

Add new data to archive: 1 file, 6576 bytes (7 KiB)


Files read from disk: 1
Archive size: 2102 bytes (3 KiB)
Everything is Ok

>bkcrack -C secretzip.zip -c secret/Codes/Encdecsim.cpp -P plain.zip -p Encdecsim.cpp
bkcrack 1.8.1 - 2025-10-25
[20:08:19] Z reduction using 1935 bytes of known plaintext
100.0 % (1935 / 1935)
[20:08:21] Attack on 6309 Z values at index 729
Keys: 491d7144 6bc8d36f e1917e7c
10.2 % (645 / 6309)
Found a solution. Stopping.
You may resume the attack with the option: --continue-attack 645
[20:08:25] Keys
491d7144 6bc8d36f e1917e7c

>bkcrack -C secretzip.zip -k 491d7144 6bc8d36f e1917e7c -D secretzip-nopass.zip
bkcrack 1.8.1 - 2025-10-25
[20:09:34] Writing decrypted archive secretzip-nopass.zip
100.0 % (252 / 252)

>bkcrack -L secretzip-nopass.zip
bkcrack 1.8.1 - 2025-10-25
Archive: secretzip-nopass.zip
Index Encryption Compression CRC32    Uncompressed  Packed size Name
----- ---------- ----------- -------- ------------ ------------ ----------------
    0 None       Store       00000000            0            0 secret/
    1 None       Store       00000000            0            0 secret/Codes/
    2 None       Deflate     b6e7312e         6576         1942 secret/Codes/Encdecsim.cpp
    3 None       Deflate     ac8e2558         1189          452 secret/Codes/Encdecsim.h
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    documentation

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions
      0