How To: Make a Locked File Cracker with Python

Welcome back, friends! Many times, businesses, friends, and family will lock their zip files with a password to keep their files secure. It is reasonable, and understandable. Well, thanks to hackers, there are many ways to get past this wall of security.

(The idea and recources for this tutorial was taken from a great book, "Violent Python - A Cookbook for Hackers, Forensic Analysts, Penetration Testers, and Security Engineers ")

Step 1: Attack Strategy

As a wise Boom Beach commercial once told me, "Come with a plan, or leave in defeat!" Although Boom Beach is a little off topic, the point still stands strong. An attack will never work improvised.

The attack I will teach you today is one you are probably familiar with. It's called a dictionary attack. We will test all of the passwords in a dictionary file.

To be simple, I will share with you a picture of the dictionary I created.

I know, I'm creative.

Anyways, let's start scripting!

Step 2: Make the Script

Luckily for us, we don't have to install any third party modules since python already has ZipFile installed in it's default library. ZipFile is an easy and simple way to unzip zipped files.

Let's start the script:

• On line 1, although I didn't include it in the screenshot, we made sure our terminal understood that we were using python, by writing in:

#!/usr/bin/python

• On line 2 we import our zipfile module.
• On line 3 we define a variable called "zFile" and set the value of this variable to select our zipped file ('evil.zip') using the zipfile module.
• On line 4 we define a variable called "passFile" and set the value of this variable to open our dictionary, ('dictionary.txt').
• On line 5 we use a for loop, saying that for every line in our dictionary, we will try to extract our zip file using the password on the line of the dictionary, and if it works, we will print it out, but if not, we will advance to the next line.

Let's save this file as zipcracker.py in the same directory as the zip file and the dictionary and run the attack!

Step 3: Results

As you can see, (if you test it out on your own). The results are almost instant! Mostly because we have a small dictionary, but still! Wow!

Great!
The password was potato.

Step 4: Conclusion

I wouldn't say this is a huge security flaw so long as you make sure your password isn't on most dictionaries. AKA don't use 1234567 as your password.

(By the way, if that really is your password and you just freaked out, change it now)

Here is a simple "patch":

1. Take your password
2. Encode it using my python encoding tutorial
3. Use that one instead!

Thank you for reading. As always, leave any suggestions in the comment section below! :D -Cameron