Is it possible to reverse engineer ZIP file with password, and get the password or the data that is containing. I'm wondering because there is challenge in hacking lab which is to extract file from ZIP with passwd protection, and it's category is reverse engineering but when I look at the HEX dump I only see the file name.

  • 8
    Password cracking is not reverse engineering. – 0xC0000022L May 3 '14 at 20:05
  • If you have the file name, you may guess the file type, and then may be able to make good assumptions on the initial bytes of the plain content ("magic numbers") – Hagen von Eitzen May 4 '14 at 13:56
  • obviously a miss-categorization from them. unless you have extra files to get the password from. – Ange May 4 '14 at 15:00

From http://www.elcomsoft.com/archpr.html -

Certain ZIP and ARJ archives can be unlocked and decrypted in just minutes, provided that you have at least one unprotected file from that archive at your discretion. It does not matter how long and complex the password is! If you have a file from the encrypted ZIP archive in your hands, the whole archive can be usually unlocked in minutes by applying the known-plaintext attack.

After carefully analyzing the algorithms and implementations of password protection in different versions of WinZip, ElcomSoft developed a work-around solution to allow quick guaranteed decryption of certain ZIP archives instead of performing lengthy attacks. If an encrypted ZIP archive was created with WinZip version 8 or earlier, and if the archive contains 5 or more files, Advanced Archive Password Recovery can unlock the archive and decrypt its content – guaranteed! A modern PC takes just under one hour to finish the job.

If those special cases don't apply, you'd need to apply standard brute-force techniques. Either way, you'd want to use Advanced Archive Password Recovery or a similar tool.

  • They don't apply. Also I had finish my dictionary attack on it(top 10000 use passwords). They only way I have is brute force which is extremely slow. I think there is other way to get the password via RE because the challenge is in the section or RE. – user4536 May 3 '14 at 17:42
  • I assure you, if you're not given any other context (like password clues), then either the special cases apply or brute forcing applies :) – Jason Geffner May 3 '14 at 17:49
  • No, but too many peoples have solve it to be brute forcing. Anyway since you are the only one who answer I will give you "best answer". Thanks for trying to help. – user4536 May 3 '14 at 17:51

If this is a class competition, and it's filed under Reverse Engineering, the chances are the tutor has compiled this package themselves and has used techniques you've learnt in previous lessons to store the password somewhere within the executable.

Look back on the techniques you've already learnt, and try those.

Judging by the question I'll assume that you've not covered advanced Reverse Engineering techniques so the first place to start would be to view all the strings in the executable - provided no encryption is used, again I'm assuming not.

If you're using Windows you can use Sys Internals Strings (http://technet.microsoft.com/en-gb/sysinternals/bb897439.aspx). IDA Pro also allows you to do this.

Use a PE viewer to check whether it's a valid zip file created with WinZip, WinRar etc. It could have been created with a different program that contains a vulnerability to extract/crack the password.

Failing that, and not knowing the level of your experience or class the only option left is to brute force.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.