FCRACKZIP

Back To MAN Pages From BackTrack 5 R1 Master List  

NAME

SYNOPSIS

DESCRIPTION

OPTIONS

-h, --help

Prints the version number and (hopefully) some helpful insights.

-v, --verbose

Each -v makes the program more verbose.

-b, --brute-force

Select brute force mode. This tries all possible combinations of the letters you specify.

-D, --dictionary

Select dictionary mode. In this mode, fcrackzip will read passwords from a file, which must contain one password per line and should be alphabetically sorted (e.g. using sort(1)).

-c, --charset characterset-specification

Select the characters to use in brute-force cracking. Must be one of

  a   include all lowercase characters [a-z]
  A   include all uppercase characters [A-Z]
  1   include the digits [0-9]
  !   include [!:$%&/()=?{[]}+*~#]
  :   the following characters upto the end of the spe-
      cification string are included in the character set.
      This way you can include any character except binary
      null (at least under unix).

For example, a1:$% selects lowercase characters, digits and the dollar and percent signs.

-p, --init-password string

Set initial (starting) password for brute-force searching to string, or use the file with the name string to supply passwords for dictionary searching.

-l, --length min[-max]

Use an initial password of length min, and check all passwords upto passwords of length max (including). You can omit the max parameter.

-u, --use-unzip

Try to decompress the first file by calling unzip with the guessed password. This weeds out false positives when not enough files have been given.

-m, --method name

Use method number "name" instead of the default cracking method. The switch --help will print a list of available methods. Use --benchmark to see which method does perform best on your machine. The name can also be the number of the method to use.

-2, --modulo r/m

Calculate only r/m of the password. Not yet supported.

-B, --benchmark

Make a small benchmark, the output is nearly meaningless.

-V, --validate

Make some basic checks wether the cracker works.

ZIP PASSWORD BASICS

For each password that is tried, the first twelve bytes of the file are decrypted. Depending on the version of zip used to encrypt the file (more on that later), the first ten or eleven bytes are random, followed by one or two bytes whose values are stored elsewhere in the zip file, i.e. are known beforehand. If these last bytes don't have the correct (known) value, the password is definitely wrong. If the bytes are correct, the password might be correct, but the only method to find out is to unzip the file and compare the uncompressed length and crc's.

Earlier versions of pkzip (1.xx) (and, incidentally, many zip clones for other operating systems!) stored two known bytes. Thus the error rate was roughly 1/2^16 = 0.01%. PKWARE 'improved' (interesting what industry calls improved) the security of their format by only including one byte, so the possibility of false passwords is now raised to 0.4%. Unfortunately, there is no real way to distinguish one byte from two byte formats, so we have to be conservative.  

BRUTE FORCE MODE

The starting password given by the -p switch determines the length. fcrackzip will not currently increase the password length automatically, unless the -l switch is used.  

DICTIONARY MODE

CP MASK

The cpmask method can only cope with password composed of uppercase letters, so be sure to supply the --charset A or equivalent option, together with a suitable initialization password.  

EXAMPLES

fcrackzip -c a -p aaaaaa sample.zip

checks the encrypted files in sample.zip for all lowercase 6 character passwords (aaaaaa ... abaaba ... ghfgrg ... zzzzzz).

fcrackzip --method cpmask --charset A --init AAAA test.ppm

checks the obscured image test.ppm for all four character passwords. -TP fcrackzip -D -p passwords.txt sample.zip check for every password listed in the file passwords.txt.

PERFORMANCE

fcrackzip, being written in C and not in assembler, naturally is slower. Measured on a slightly loaded unix (same machine), it's 12 percent slower (the compiler used was pgcc, from http://www.gcc.ml.org/).

To remedy this a bit, I converted small parts of the encryption core to x86 assembler (it will still compile on non x86 machines), and now it's about 4-12 percent faster than fzc (again, the fcrackzip performance was measured under a multitasking os, so there are inevitably some meaurement errors), so there shouldn't be a tempting reason to switch to other programs.

Further improvements are definitely possible: fzc took 4 years to get into shape, while fcrackzip was hacked together in under 10 hours. And not to forget you have the source, while other programs (like fzc), even come as an encrypted .exe file (maybe because their programmers are afraid of other people could having a look at their lack of programming skills? nobody knows...)  

RATIONALE

BUGS

Stop/resume facility is missing.

Should be able to distinguish between files with 16 bit stored CRC's and 8 bit stored CRC's.

The benchmark does not work on all systems.

It's still early alpha.

Method "cpmask" only accepts ppms.

Could be faster.  

AUTHOR

Index

NAME

SYNOPSIS

DESCRIPTION

OPTIONS

ZIP PASSWORD BASICS

BRUTE FORCE MODE

DICTIONARY MODE

CP MASK

EXAMPLES

PERFORMANCE

RATIONALE

BUGS

AUTHOR