Spasimo zip - dic files

[Pytzamarama]

Geia!

Prospatho na spaso ena zip to opoio

i) exei mono 3 files mesa opote den poianoun ta kolpa gia efkoli evresi password(prepei na exei pano apo 5 files encrypted)

ii)den eho kapoio apo ta encrypted files kai se unencrypted morfi (alli mia periptosi pou i evresi tou password tou zip einai efkoli ipothesi)

iii)To brute force attack argei polli

(PS xrisimopoio to Advanced Zip Password Recovery)

 

Mipos exei kapoios kapoio arxeio me olles tis ellinikes lekseis oste na kano dictionary attack me ellinika? (To AZPR exei Aggliko .dic file)

Kserete kanena allo kolpo pou na mporo esto na vro to length tou password sto zip?

 

Thanx a lot

[sotris99]

Νομίζω ότι είναι λίγο παράνομο αυτό που ζητάς.

[Pytzamarama]

Den einai paranomo.

Sto na prospatho na anoikso arxeia pou einai stin katohi mou kai den ta apektisa paranoma den iparxei tipota to mempto...

[random]

Υπερ της επιστήμης και της έρευνας!

ας προσεχε αυτος που αφησε εκτεθιμενο το σκληρό του δισκο, και δεν εβαλε πασσο 20 χαρακτηρων.

 

http://www.google.com.gr/search?num=100&ie=UTF-8&oe=UTF-8&hl=el&q=greek+dictionary+file&lr=

 

θα βρεις πολλα σχετικα με τους διορθωτες ms office kai openoffice και με λιγη δουλεια να τα κανεις txt. αλλα συνηθως βαζουμε για password ελληνικες λεξεις γραμμενες με λατινικα - greeklish, οποτε δυσκολεύει. Kαι αν εχε μεσα κανενα @ # $ % & ( ) _ . δεν θα βρεθει σε dictionary.

 

απο περιέργεια: τι σχεση αν εχει 5 αρχεια ή ένα μέσα.?

αυτο που μετράει ειναι απο πόσους χαρακτήρες αποτελειτε το πάσσο.

αν ειναι μεγαλυτερο απο 7-8 το brute force θα κανει κατι βδομαδες/μηνες/χρόνια...

[Pytzamarama]

Sorry gia to megethos,einai apo ta help files tou AZPR

 

Known plaintext attack (ZIP)

 

ZIP files have a strong encryption algorithm. First, the password isn't stored anywhere in a password-protected archive. The ZIP archiver converts the password you've entered into three 32-bit encryption keys, and then uses them to encrypt the whole archive. Because of this, the total complexity of the ZIP attack is 2^96, i.e., we would have to try all possible key combinations. This is really a lot ? even using all the computers in the world, it is not possible to check all of them, unfortunately? However, this algorithm isn't as strong as the DES, RSA, IDEA, and similar algorithms. One of the ways of breaking ZIP protection is using known-plaintext attack. If you're interested in the details of attack, find the paper "A Known Plaintext Attack on the PKZIP Stream Cipher" by Eli Biham and Paul Kocher. ARCHPR's implementation of plaintext attack is very close to that paper, with some minor modifications.

 

Having an encrypted file created by the ZIP archiver, and the same file in unencrypted form, we can make some calculations and retrieve the encryption keys used to protect that file. Usually, a ZIP archive contains several files and all of them have the same password (and therefore the same encryption keys). This means that if we get the encryption keys for one of these files, we'll be able to unprotect all the others! Furthermore, it won't take as much time as trying all possible combinations of encryption keys. To perform plaintext attack, all you need is one file from the archive, compressed by the same archiver and by the same method as an encrypted one.

 

Selecting the correct archiver is a bit complex, however; unfortunately, the ZIP file format doesn't contain any data which might help to identify the archiver. In fact, you may need to try several archivers (of course, only if you don't remember which particular utility you've used). A good check that the plain file is correct is the size difference between it and the encrypted file: the encrypted file must be exactly 12 bytes larger. Also, the files must have the same CRC and uncompressed sizes. ARCHPR

automatically checks these conditions for selected files, so all you need to do is to create a "plain" ZIP archive.

 

 

Guaranteed WinZip attack

 

Thatʼs the most powerful attack available in ARCHPR. It works similarly to known-plaintext attack described above, but doesnʼt require you to have any files from the archive. However, the archive itself should have at least 5 encrypted (password-protected) files, and have to be created with WinZip or any other ZIP archiver based on Info-ZIP sources.

Please note that only WinZip versions 8.0 and below are vulnerable for this particular attack (because of using weak random number generator). In version 8.1, the hole has been fixed, and so for archives created with this version (as well as newer ones) you will not be able to use this attack at all.

The attack consists of three stages: first two are for searching the encrypted keys (needed to decrypt the archive), and the last one searches for the actual password (up to 10 characters).

Usually, first stage takes just a few minutes (the program may show Estimated remaining time as a few hours, but actually, thatʼs the theoretical maximum, and in most cases it is MUCH faster). Second one is from 10 to 30 minutes, and the last stage (where the password itself is being recovered) is 2-3 minutes only. For the second stage, the time estimation is also not very accurate (to make it better, it would be needed to perform a lot of additional operations, while ARCHPR does its best to recover keys/password as fast as possible).

That attacks works in most cases (as already noted, for WinZip files only), and even if the password is very long (so it could not be found during the 3rd stage), ARCHPR will be able to decrypt the whole archive, so you will not need to supply a password to extract files from it. However, in some very rare cases (the probability is 1/256, i.e. 0,4% only), WinZip may create ZIP archives this attack fails on. ARCHPR identifies such archives and prints a warning message into the log window; actually, this message does not mean that the ARCHPR will definitely fail, but if first stage will be completed but no encryption keys found ? sorry, you're out of luck. Just try the other attacks.