Переработки стоит держать в секрете (Overtime Should Be Kept Secret)

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-06 | Status: Solved Techniques: zip_password_cracking, mask_attack, charset_bruteforce, pkzip_hash_extraction

Summary

Переработки стоит держать в секрете — Hackerlab

Description

При анализе жесткого диска злоумышленника, был найден запароленный архив secret_text.zip. В других файлах часто встречается слово codeby, различные цифры и пароли по 8 символов. Коллеги уже прогнали архив через 2 миллиарда паролей, но безуспешно. Слышал, что у тебя есть ферма видеокарт. Сможешь помочь?

Analysis

Step 1: Archive Investigation

 bash read-only • copy allowed Copy
7z l -slt secret_text.zip

Result:

Method = ZipCrypto Store
Size = 42 bytes
Encrypted = +

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The ZIP archive uses ZipCrypto encryption without compression (Store). This is important for selecting the correct hashcat mode.

Step 2: Hash Extraction

 bash read-only • copy allowed Copy
zip2john secret_text.zip > hash.txt

We get a hash in the format:

$pkzip2$1*2*2*0*36*2a*e4da874c*0*49*0*36*e4da*7458*...

For hashcat, we need only the hash without the filename:

$pkzip2$1*2*2*0*36*2a*e4da874c*0*49*0*36*e4da*7458*6026730d236e0e65872f505fef3a844dc551d8c067b0600cd89faa71e91ed4b25ecd42018ff184d721b489e2cc6a99b0c82919628209*$/pkzip2$

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 3: Hint Analysis

From the task description:

• The word codeby appears frequently
• Passwords are 8 characters long
• 2 billion passwords already checked unsuccessfully
• The title "Переработки" (Overtime/Reworked) — hints at a reworked/shuffled password

Step 4: Failed Attempts

Tried multiple approaches:

• Dictionary codeby + 2 digits (codeby00-codeby99)
• Leet speak variants (c0d3by, c0deby, cod3by, etc.)
• ROT13 and letter permutations
• Anagrams of codeby
• Hashcat rules (leetspeak.rule, best66.rule) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Nothing worked — the hint "2 billion passwords" meant that standard dictionary attacks were useless.

Solution

Bruteforce with Limited Charset

Key idea: "Переработки" (Reworked) = password contains letters from codeby, but in a different order with digits. Need full bruteforce of 8 characters using a limited charset.

 bash read-only • copy allowed Copy
hashcat -m 17210 -a 3 hashcat_hash.txt -1 '?l?d' '?1?1?1?1?1?1?1?1'

Parameters:

• -m 17210 — PKZIP (Uncompressed) — for ZipCrypto Store
• -a 3 — mask attack (bruteforce by mask)
• -1 '?l?d' — custom charset (a-z + 0-9 = 36 characters)
• '?1?1?1?1?1?1?1?1' — 8 characters from charset ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Keyspace: 36^8 = 2,821,109,907,456 combinations (~2.8 trillion)

Result

Status...........: Cracked
Time.Started.....: Tue Jan  6 19:46:52 2026 (32 secs)
Candidates.#02...: 822yr498 -> pqqbu2ia

$pkzip2$...:cce9yd89

Password found in 32 seconds: cce9yd89

Flag Extraction

 bash read-only • copy allowed Copy
7z x -pcce9yd89 secret_text.zip
cat secret_text.txt

Password Analysis

The password cce9yd89 contains:

• Letters: c, c, e, y, d (4 out of 6 letters from "codeby")
• Digits: 9, 8, 9 (three digits)
• Length: 8 characters (as stated in the description) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The title "Переработки" (Reworked) hinted at a "reworked" password — letters from codeby shuffled with digits.

Lessons

1. Task title — key hint ("Переработки" = reworked password)
2. "2 billion passwords" — dictionary attacks are useless, need bruteforce
3. Limited charset (lowercase + digits) makes bruteforce feasible
4. GPU acceleration is critical — 2.8 trillion combinations in 32 seconds
5. Flag REDACTED confirms: unusual dictionary for bruteforce

Useful Commands

 bash read-only • copy allowed Copy
# Check ZIP encryption type
7z l -slt archive.zip | grep Method
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Extract hash for hashcat
zip2john archive.zip | cut -d: -f2 > hash.txt

# Bruteforce lowercase + digits, 8 characters
hashcat -m 17210 -a 3 hash.txt -1 '?l?d' '?1?1?1?1?1?1?1?1'

# Verify found password
7z x -p<password> archive.zip

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍