ZipLock

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-26 | Status: Solved Techniques: AES-256 encrypted archive extraction with 7z, Dictionary attack with John the Ripper, ZIP password hash extraction with zip2john

Summary

Task: Recover password from encrypted ZIP archive. Solution: Extract hash with zip2john, crack with John the Ripper using rockyou.txt dictionary, extract with 7z.

ZipLock — Hackerlab

Description

Забыл пароль от архива с важной инфой, пожалуйста помоги восстановить

File: secret.zip

Analysis

1. Archive investigation:

   • Archive secret.zip is password-protected
   • Contains two files: secret.jpg and flag.txt
   • Uses AES-256 encryption (standard unzip doesn't support it)

2. Encryption type:

   • ZIP with AES-256 requires special tools for extraction
   • Standard unzip utility throws an error when trying to extract

Solution

Step 1: Extracting the password hash

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Using zip2john to extract the hash from the encrypted archive:

 bash read-only • copy allowed Copy
/opt/homebrew/share/john/zip2john secret.zip > hash.txt

Result — hash in John the Ripper format, containing encryption information.

Step 2: Cracking the password

Running John the Ripper with wordlist attack:

 bash read-only • copy allowed Copy
john --wordlist=rockyou.txt hash.txt

Result:

santiago4433     (secret.zip)

Password found: santiago4433

Step 3: Extracting the archive

Using 7z for extraction (supports AES-256):

 bash read-only • copy allowed Copy
7z x -psantiago4433 secret.zip

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Parameters:

• x — extract preserving directory structure
• -p — password (no space after the flag!)

Step 4: Getting the flag

 bash read-only • copy allowed Copy
cat flag.txt

Theory

ZIP Encryption

Why was AES-256 still cracked?

AES-256 is a cryptographically strong algorithm. But a weak password (santiago4433) from the popular rockyou.txt dictionary makes the protection useless. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

rockyou.txt Dictionary

• ~14 million passwords
• Leaked from RockYou social network (2009)
• Contains real user passwords
• Standard dictionary for password cracking

Tools

zip2john

Extracts password hash from ZIP archive:

 bash read-only • copy allowed Copy
zip2john archive.zip > hash.txt

John the Ripper

Universal password cracker:

 bash read-only • copy allowed Copy
# Dictionary attack
john --wordlist=rockyou.txt hash.txt

# Show found passwords
john --show hash.txt

# Incremental bruteforce
john --incremental hash.txt

7z (7-Zip)

Supports all ZIP encryption types:

 bash read-only • copy allowed Copy
# Extract with password
7z x -pPASSWORD archive.zip
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# View contents
7z l archive.zip

Alternative Tools

• hashcat — GPU-accelerated password cracker
• fcrackzip — specialized tool for ZIP
• pkcrack — known-plaintext attack on ZipCrypto ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍