agourlay / zip-password-finder Goto Github PK

Add support for mask attack.

https://hashcat.net/wiki/doku.php?id=mask_attack

This requires a change in the CLI to have a clear separation of attack modes:

• dictionary
• brute force
• mask

Hey, nice project!

I suggest adding an open source license. I looked around the repo but couldn't find it.

Publishing to crates.io on release is not working anymore since 0.6.0.

The zip crate is in maintenance mode and will not accept any new feature.

This is why the changes required to achieve a performance improvement were made into a fork

To reproduce the issue

cargo publish --dry-run --allow-dirty

yields

error[E0599]: no method named `get_aes_key_and_salt` found for struct `ZipArchive` in the current scope
  --> src/zip_utils.rs:32:28
   |
32 |     let aes_data = archive.get_aes_key_and_salt(0);
   |    

During the publishing process, the mainline for the zip crate is used instead of the fork.

If it is not possible to publish a crate depending on a fork, we might have to extract all the necessary zip features into zip-passord-finder itself.

Hi, I have a file whose contents are definitely encrypted - this much I know.

The issue happens with version:

$ zip-password-finder --version
zip-password-finder 0.5.1

which is the current version on crates.io.

file on Ubuntu 22.04 reports:

Zip archive data, at least v2.0 to extract, compression method=store

unzip as packaged with Ubuntu - version reports as 6.00 (or Ubuntu package as 6.0-26ubuntu3.1) - reports for each of the contained files:

need PK compat. v5.1 (can do v4.6)

The file names don't seem to be encrypted.

7-Zip (pkg: 16.02+dfsg-8) appears to be able to handle the file format, but the password is obviously deemed wrong.

Any idea what I could try, or is this simply not supported, yet? Thanks.

PS: zipdump.py by Didier Stevens also claims ZIP file is not password protected
PPS: there is currently not support for zip64 is claimed by zip-rs which you use, so this could already be the issue. I also noticed that the version installable via crates.io lags behind, so going to install from a local checkout ...

Hey!

Have you considered publishing zip-password-finder on crates.io? I think it would be nice to install via cargo install zip-password-finder.

I can submit a PR to update the release workflow if you find this applicable. LMK! 🐻

The current interface with easy, medium and hard is not flexible enough.

We can use something similar to Hashcat:

  l | abcdefghijklmnopqrstuvwxyz [a-z]
  u | ABCDEFGHIJKLMNOPQRSTUVWXYZ [A-Z]
  d | 0123456789                 [0-9]
  h | 0123456789abcdef           [0-9a-f]
  H | 0123456789ABCDEF           [0-9A-F]
  s |  !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

and then being able to combine charsets which is not currently possible

./zip-password-finder -c hs