Странный ZIP-архив (Strange ZIP Archive)

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-05 | Status: Solved Techniques: CRC-32 comparison for identical file detection, PKZIP encryption key recovery, ZIP Known-Plaintext Attack (KPA)

Summary

Task: Password-protected ZIP archive with a file that also exists unencrypted. Solution: Known-Plaintext Attack using bkcrack to recover encryption keys and decrypt the archive.

Странный ZIP-архив (Strange ZIP Archive) - HackerLab

Description

Дедлайн завтра, а фрилансер кинул нас на бабки... Он прислал нам странный архив и перестал выходить на связь. Пожалуйста сделай что-нибудь с этим недоразумением!

"Deadline is tomorrow, and the freelancer scammed us... He sent us a strange archive and stopped responding. Please do something with this mess!"

Analysis

Step 1: Extracting the outer archive

 bash read-only • copy allowed Copy
unzip Strange_zip.zip
# Result: task.zip

Step 2: Analyzing task.zip

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 bash read-only • copy allowed Copy
unzip task.zip
# Result:
# - README.md (471 bytes, plaintext)
# - project.zip (password-protected)

Step 3: Analyzing project.zip

 bash read-only • copy allowed Copy
unzip -l project.zip
# Archive:  project.zip
#   Length      Date    Time    Name
# ---------  ---------- -----   ----
#        39  2024-12-01 12:00   flag.txt
#       331  2024-12-01 12:00   index.html
#       471  2024-12-01 12:00   README.md      <-- SAME SIZE!
#       313  2024-12-01 12:00   style.css

Step 4: Key observation - CRC-32

 bash read-only • copy allowed Copy
# Check CRC-32 for README.md in both archives
unzip -v task.zip | grep README
unzip -v project.zip | grep README
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Both files have CRC-32: 2741b1bb

Conclusion: The README.md file is identical in both archives. This opens the possibility for a Known-Plaintext Attack on ZIP encryption.

Theory: Known-Plaintext Attack on ZIP

ZIP archives with classic encryption (PKZIP/ZipCrypto) are vulnerable to known-plaintext attacks:

1. Condition: Need a file that exists in both encrypted and unencrypted form
2. Mechanism: Knowing the plaintext and ciphertext, internal encryption keys can be recovered
3. Result: With recovered keys, the entire archive can be decrypted ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Requirements:

• Minimum 12 bytes of known plaintext (for bkcrack)
• Files must be identical (verified by CRC-32)
• Archive must use ZipCrypto, not AES

Solution

Step 1: Recovering encryption keys

 bash read-only • copy allowed Copy
bkcrack -C project.zip -c README.md -P task.zip -p README.md

Parameters:

• -C project.zip - encrypted archive
• -c README.md - encrypted file inside the archive
• -P task.zip - archive with plaintext
• -p README.md - plaintext file

Result:

[+] Keys: c1bbe12c e02a403c 3c9c4e58

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 2: Decrypting the archive

 bash read-only • copy allowed Copy
bkcrack -C project.zip -k c1bbe12c e02a403c 3c9c4e58 -D decrypted.zip

Parameters:

• -k - recovered keys
• -D decrypted.zip - output decrypted archive

Step 3: Extracting the flag

 bash read-only • copy allowed Copy
unzip decrypted.zip
cat flag.txt

Tools

bkcrack

Installation:

 bash read-only • copy allowed Copy
# macOS
brew install bkcrack

# Linux (build from source)
git clone https://github.com/kimci86/bkcrack
cd bkcrack && cmake -S . -B build && cmake --build build

Main commands:

 bash read-only • copy allowed Copy
# Key recovery
bkcrack -C encrypted.zip -c file.txt -P plain.zip -p file.txt
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Decryption with keys
bkcrack -C encrypted.zip -k KEY1 KEY2 KEY3 -D output.zip

# Set new password
bkcrack -C encrypted.zip -k KEY1 KEY2 KEY3 -U newarchive.zip newpassword

Defense

1. Use AES-256 instead of ZipCrypto
2. Don't include publicly available files in encrypted archives
3. Use 7z or other formats with modern encryption

References

• bkcrack GitHub
• PKZIP Known Plaintext Attack (Biham & Kocher, 1994)
• ZIP File Format Specification ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍