Aloxaf / rbkcrack

Crack legacy zip encryption with Biham and Kocher's known plaintext attack. 使用明文攻击破解加密的 zip 文件
Other
99 stars 18 forks source link

这个文件用rbkcrack解出来的密码不对,但是bkcrack可以。 #85

Open diablov opened 2 years ago

diablov commented 2 years ago

O16:/mnt/f/MISC/DESKTOP/ctf3/25.file $ /mnt/x/SecurityTools/@zip-rar-crack/@rbkcrack-zip-plaintext/rbkcrack-bkcrack/bkcrack1.3.3 -C file.zip -P ReadMe-7z.zip -c ReadMe.txt -p ReadMe.txt bkcrack 1.3.3 - 2021-11-08 [11:00:08] Z reduction using 266 bytes of known plaintext 100.0 % (266 / 266) [11:00:08] Attack on 32356 Z values at index 12 Keys: 58b8bfef 0882493d 1bc9bc1b 54.9 % (17753 / 32356) [11:00:17] Keys 58b8bfef 0882493d 1bc9bc1b O16:/mnt/f/MISC/DESKTOP/ctf3/25.file $ /mnt/x/SecurityTools/@zip-rar-crack/@rbkcrack-zip-plaintext/rbkcrack-bkcrack/rbkcrack0.2.1.exe -C file.zip -P ReadMe-7z.zip -c ReadMe.txt -p ReadMe.txt Generated 4194304 Z values. [11:00:32] Z reduction using 262 extra bytes of known plaintext 100.00 % (262 / 262) 32356 values remaining. [11:00:33] Attack on 32356 Z values at index 12 45.02 % (14568 / 32356) [11:00:54] Keys b0f50f1e d0ad2752 e4b92d26

25.file.zip

kimci86 commented 2 years ago

Running an exhaustive attack with rbkcrack (flag -e) gives both an invalid solution b0f50f1e d0ad2752 e4b92d26 and the valid one 58b8bfef 0882493d 1bc9bc1b. This is happening because bkcrack is doing more checks than rbkcrack on the candidates to filter them. Only the valid one remains with bkcrack. Those additional checks were added to bkcrack after rbcrack was written and rbkcrack was not updated.