SQLite

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-06 | Status: Solved Techniques: ascii_decoding, known_plaintext_attack, sqlite_forensics, zipcrypto_cracking

Summary

Task: Password-protected ZIP archive with sqlitebrowser project files and db.sqlite. Solution: Known-plaintext attack on ZipCrypto using bkcrack with original files from GitHub, then ASCII decoding of flag from SQLite database.

SQLite - HackerLab

Description

"Даю Вам разрешение на использование Google в этом задании :)" (I give you permission to use Google in this task)

File: sqlitebrowser.zip

Analysis

Step 1: Archive Investigation

 bash read-only • copy allowed Copy
$ 7z l -slt sqlitebrowser.zip | head -50

The archive contains files from the open source sqlitebrowser project, as well as a db.sqlite file.

Key observations:

• Archive is password-protected using ZipCrypto (weak encryption)
• Files are dated 2017-09-20 - this is the release date of v3.10.1
• The hint "use Google" suggests searching for original files ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Attack Vector Identification

ZipCrypto is vulnerable to known-plaintext attack. For a successful attack we need:

1. Find an original file from the archive
2. The file must be large enough (minimum 12 bytes of known plaintext)
3. CRC32 must match

Step 3: Finding Known Plaintext

Checking the version by file dates and finding release v3.10.1 on GitHub:

 bash read-only • copy allowed Copy
# Download original file from repository
curl -o bullet_arrow_down.png \
  "https://raw.githubusercontent.com/sqlitebrowser/sqlitebrowser/v3.10.1/src/icons/bullet_arrow_down.png"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Check CRC32
crc32 bullet_arrow_down.png
# 78f3c363

Comparing with CRC32 in the archive - it matches!

Solution

Step 1: Preparing Plaintext Archive

 bash read-only • copy allowed Copy
# Create ZIP with known file (no compression for exact match)
zip -0 plain_png.zip bullet_arrow_down.png

Step 2: bkcrack Attack

 bash read-only • copy allowed Copy
# Run known-plaintext attack
bkcrack -C sqlitebrowser.zip \
        -c "src/icons/bullet_arrow_down.png" \
        -P plain_png.zip \
        -p bullet_arrow_down.png

Result:

[+] Keys: 72639a5b 620c7a00 6caae23a

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Decrypting the Archive

 bash read-only • copy allowed Copy
# Create decrypted archive
bkcrack -C sqlitebrowser.zip \
        -k 72639a5b 620c7a00 6caae23a \
        -D decrypted.zip

# Extract files
unzip decrypted.zip

Step 4: Database Analysis

 bash read-only • copy allowed Copy
$ sqlite3 db.sqlite
sqlite> .tables
Flags

sqlite> .schema Flags
CREATE TABLE Flags (id INTEGER PRIMARY KEY, Name TEXT, Flag TEXT);

sqlite> SELECT * FROM Flags;
1|Fake Flag|CODEBY{fake_flag_lol}
2|Real Flag|67 79 68 69 66 89 123 117 95 107 110 48 119 95 116 104 49 115 95 112 108 97 105 110 116 51 120 116 125

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 5: ASCII Decoding

 python read-only • copy allowed Copy
#!/usr/bin/env python3
ascii_codes = "67 79 68 69 66 89 123 117 95 107 110 48 119 95 116 104 49 115 95 112 108 97 105 110 116 51 120 116 125"
flag = ''.join(chr(int(c)) for c in ascii_codes.split())
print(flag)

Theory: Known-Plaintext Attack on ZipCrypto

ZipCrypto uses a stream cipher based on three 32-bit keys. The attack works as follows:

1. Requirements: minimum 12 bytes of known plaintext
2. Process: bkcrack brute-forces possible values of internal keys
3. Result: found keys allow decrypting the entire archive ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Important: the file must be compressed with the same method (Store/Deflate) as in the original archive.

Alternative Approaches

1. Other files for plaintext: LICENSE, README.md, .travis.yml
2. Version identification: by file contents or commit history
3. Partial plaintext: for some formats (PNG, PDF) magic bytes are known

References

• bkcrack - attack tool
• sqlitebrowser v3.10.1 - source repository
• ZipCrypto Vulnerability - vulnerability description ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍