$ bkcrack -C archive.zip -c 'logo_acceis.svg' -p plain.bin -x -1 19

It takes a long time (~24 min for this example) but we are able to recover the encryption keys.Ī wordlist attack would be more efficient for weak passwords but this method can help recover files protected with very complex passwords.

-x: Additional plaintext in hexadecimal starting at the given offset.

-p: File containing the known plaintext.

-c: File containing the ciphertext (the one we target in the archive).

$ bkcrack -C archive.zip -c logo_acceis.svg -p plain.svg -x -1 19 In this archive we can see there is a SVG image, we know that any SVG image will begin with or and maybe will be followed by plain.svg What’s nice is that the Zip format can’t protect the filenames so even is the archive is encrypted we can still list filenames, retrieve the extension to understand what kind of document is stored and target fixed file signature (aka magic bytes) if you don’t know any content from the encrypted files. The larger the contiguous known plaintext, the faster the attack. To conduct this attack, it requires at least 12 bytes of known plaintext and at least 8 of them must be contiguous. Note: to generate a ZIP archive using ZipCrypto Store we can use the old zip utility: zip -e -0 archive.zip logo_acceis.svg or 7z: 7z a -tzip -mx0 -p -mem=ZipCrypto archive.zip logo_acceis.svg. To check which encryption algorithm is used you can use 7z: $ 7z l -slt archive.zip | grep Method It is also possible if the archive use ZipCrypto Deflate but it is harder since files are compressed before encryption. Older encrypted ZIP archives can suffer from Biham and Kocher plaintext attack if they use the ZipCrypto Store encryption method. Note: This article is also available in french 🇫🇷. This is because the Microsoft Windows operating system does not allow to generate (without installing a third party software) encrypted Zip files and can only decrypt Zip archives using ZipCrypto, which makes this old and depreciated encryption method still used today. While most of the software use only AES encrypted ZIPs (or use AES encryption by default), some software still generate ZipCrypto encrypted archives by default.

Using classic wordlist attack on other encrypted archives: Zip archives (WinZip) using encryption method AES (128,192,256), 7-Zip and RAR.

Using Biham and Kocher plaintext attack on Zip archives (PKZIP) using encryption method ZipCrypto Store (can be extended to ZipCrypto Deflate).

In this article we’ll see how to crack encrypted archive protected with a password:

7z password cracker