DOCSEARCHbyAlgolia
Submit Docs

bkcrack

repository·master·Indexed 24 days ago

https://github.com/kimci86/bkcrack

A command-line tool for cracking legacy ZipCrypto (traditional PKWARE) encryption using known plaintext attacks. It enables users to recover internal keystream generator states, decipher files, remove or change passwords, and brute-force original passwords using masks or custom charsets.

Tokens
3.9K
Snippets
9
Records
33
Agent score
69%

What's inside bkcrack

  2. Install bkcrack

    master

    You can install bkcrack using one of the following methods:

    Precompiled packages

    Download the latest official release from GitHub. Precompiled packages are available for Ubuntu, MacOS, and Windows. Note: Windows users must install the latest Microsoft Visual C++ Redistributable package.

    Compile from source

    Use CMake to build the project. Run these commands in the source tree to create an installation in the install folder:

    cmake -S . -B build -DCMAKE_INSTALL_PREFIX=install
cmake --build build --config Release
cmake --build build --config Release --target install

    Third-party packages

    bkcrack is available in various package repositories maintained by external contributors.

    cmake -S . -B build -DCMAKE_INSTALL_PREFIX=install
cmake --build build --config Release
cmake --build build --config Release --target install

  3. Recover files using recovered keys

    master

    Once you have the three 32-bit keys, you can use them to recover the original data in several ways:

    1. Create a new ZIP without a password

    Use the -k flag with the keys and the -D flag to output a new, unencrypted archive.

    ../bkcrack -C secrets.zip -k c4490e28 b414a23d 91404b31 -D secrets_without_password.zip

    2. Create a new ZIP with a new password

    Use the -U flag followed by the new password.

    ../bkcrack -C secrets.zip -k c4490e28 b414a23d 91404b31 -U secrets_with_new_password.zip easy

    3. Decipher individual files

    Use the -d flag to output the deciphered file. Warning: If the original file was compressed (e.g., using Deflate), the output will be the compressed data and must be manually uncompressed (inflated) using a tool like inflate.py.

  4. Run a known-plaintext attack to recover keys

    master

    To recover the internal encryption keys, you need at least 12 bytes of known plaintext. You can provide the plaintext via a file using the -p flag.

    Note: bkcrack automatically adds a 1-byte check byte to your known plaintext, effectively giving you one extra byte of verification.

  5. Recover internal keys using known plaintext

    master

    The attack requires at least 12 bytes of known plaintext, with at least 8 of them being contiguous. Larger contiguous blocks speed up the attack.

    Load data from ZIP archives

    If you have an encrypted ZIP (encrypted.zip) containing a ciphertext entry (cipher) and a plain ZIP (plain.zip) containing the known plaintext entry (plain):

    bkcrack -C encrypted.zip -c cipher -P plain.zip -p plain

    Load data from files

    If you have raw files for the ciphertext (cipherfile) and the plaintext (plainfile):

    bkcrack -c cipherfile -p plainfile

    Using offsets

    If the plaintext does not start at the beginning of the ciphertext, use the -o flag. The offset can be negative if the plaintext includes part of the encryption header.

    bkcrack -c cipherfile -p plainfile -o offset

    Using sparse plaintext

    If you have fewer than 8 contiguous bytes but know other bytes at specific offsets, use the -x flag followed by the offset and the bytes in hexadecimal.

    bkcrack -c cipherfile -p plainfile -x 25 4b4f -x 30 21
    bkcrack -C encrypted.zip -c cipher -P plain.zip -p plain

  6. Remove or change ZIP archive passwords

    master

    You can manipulate encrypted archives using recovered internal keys without knowing the original password.

    Remove password (Decrypt archive)

    Generate a new archive with the same content but without encryption. This assumes all entries used the same password.

    bkcrack -C encrypted.zip -k 12345678 23456789 34567890 -D decrypted.zip

    Change password

    Generate a new encrypted archive with a password of your choice:

    bkcrack -C encrypted.zip -k 12345678 23456789 34567890 -U unlocked.zip new_password

    Alternatively, define the new password using its internal key representation:

    bkcrack -C encrypted.zip -k 12345678 23456789 34567890 --change-keys unlocked.zip 581da44e 8e40167f 50c009a0
    bkcrack -C encrypted.zip -k 12345678 23456789 34567890 -D decrypted.zip

  7. Recover password using brute force or masks

    master

    Given internal keys, bkcrack can attempt to recover the original password.

    Brute force recovery

    Use the -b flag with a charset to search for passwords. You can restrict length with -l.

    # Search using printable ASCII
bkcrack -k 1ded830c 24454157 7213b8c5 -b ?p

# Search for length 9
bkcrack -k 1ded830c 24454157 7213b8c5 -b ?p -l 9

# Search for length range 8 to 10
bkcrack -k 1ded830c 24454157 7213b8c5 -b ?p -l 8..10

# Shortcut for length and charset
bkcrack -k 1ded830c 24454157 7213b8c5 -r 10 ?p

    Mask-based recovery

    For long passwords, use the -m flag with a mask to significantly speed up recovery. Use ?l for lowercase, ?d for digits, etc.

    # Example: 8 lowercase letters, a hyphen, and 6 digits
bkcrack -k 1940e266 d3fd3d89 71ce9871 -m ?l?l?l?l?l?l?l?l-?d?d?d?d?d?d

    Custom charsets

    Define custom charsets using the -s flag. Custom charsets can reference predefined ones.

    # 10 letters (upper or lower) followed by 5 binary digits (0 or 1)
bkcrack -k b8c377a6 f63160f 1832a78b -m ?x?x?x?x?x?x?x?x?x?x?y?y?y?y?y -s x ?u?l -s y 01
    bkcrack -k 1940e266 d3fd3d89 71ce9871 -m ?l?l?l?l?l?l?l?l-?d?d?d?d?d?d

  8. Recover the original password via bruteforce

    master

    If you have the keys, you can attempt to recover the original password using the --bruteforce flag. You should specify a character set and a length range to optimize the search.

    Common charsets:

    • ?b: All bytes (0-255)
    • ?p: Printable ASCII
    • ?a: Alpha-numeric
    • ?u: Uppercase letters
    • ?l: Lowercase letters

    Example: Searching for a password between 10 and 11 printable ASCII characters:

    ../bkcrack -k c4490e28 b414a23d 91404b31 --bruteforce ?p --length 10..11

  9. Decipher data

    master

    Once the internal keys are recovered or known, you can decipher data.

    Decipher from plaintext attack

    If the attack was just performed using plaintext files, save the result with -d:

    bkcrack -c cipherfile -p plainfile -d decipheredfile

    Decipher using known keys

    If you already have the three 32-bit internal keys, use the -k flag:

    bkcrack -c cipherfile -k 12345678 23456789 34567890 -d decipheredfile

    Decompressing deciphered data

    If the original data used deflate compression, the deciphered output may still be compressed. Use the provided Python 3 script in the tools folder to decompress it:

    python3 tools/inflate.py < decipheredfile > decompressedfile
    bkcrack -c cipherfile -k 12345678 23456789 34567890 -d decipheredfile

  10. Recover the original password using a mask

    master

    For long passwords, use a mask to restrict the search space by defining a specific charset for each character position. Use the --mask flag to define the sequence of charsets and the -s flag to define custom charsets (aliases).

    Example: Recovering a password where the first 10 characters are letters (?u?l) and the next 5 are binary digits (01).

  11. Crack legacy zip encryption with bkcrack

    master
    bkcrack is a tool designed to crack legacy ZIP encryption (ZipCrypto) using Biham and Kocher's known plaintext attack. It allows users to recover internal password representations (keys), decipher files, decrypt entire archives, or recover the original password via brute-force or masking.

  12. How to use custom charsets in bkcrack

    master

    You can define custom character sets using the -s or --charset flag and reference them in a mask or bruteforce attempt using the ? escape character.

    1. Define a charset: -s <id> <charset_string>
    2. Use it in a mask: -m <mask_string> where ?<id> refers to your defined set.

    Built-in charsets include:

    • l: lowercase (a-z)
    • u: uppercase (A-Z)
    • d: digits (0-9)
    • a: alphanum (a-zA-Z0-9)
    • p: printable ( to ~)
    • s: punctuation (printable excluding alphanum)
    • b: all bytes (\x00 to \xff)
    • ?: a literal question mark