10

How can i recover a zip password on linux using CUDA (GPU). For the past two days i tried using "fcrackzip" but it's too slow

Few months back i saw some application that can use GPU / CUDA and get large performance boost in comparison to CPU.

If brute-force using cuda is not possible, please tell me what's the best application for performing a dictionary attack, and where can i find best (largest) dictionary.

Regards

4 Answers 4

5

You can extract the hashes from the .zip and use hashcat to crack with the GPU. To extract the hashes you can use some tool like zip2john from john the ripper.

You can find precompiled binaries from both programs here:

https://hashcat.net/hashcat/

https://www.openwall.com/john/

Example:

./zip2john file.zip > hashes.txt

Then put it in the appropriated input format for hashcat:

https://hashcat.net/wiki/doku.php?id=example_hashes

Finally run hashcat:

./hashcat -a 3 -m 17225 .\hashes.txt

The -m parameter correspondent you can find in the link above also.

2

According to this article using CUDA for brute-force against ZIP is possible, but I haven't found free app so far. The difficulty of using CUDA for ZIP is that the "forced" attempt is not consisting of a single calculation like in brute-forcing hash, but requires reading the zip file and attempting to decrypt it. To utilize CUDA, you will need to virtualize that process - load the zip in the GPU memory, rewrite the decryption method in code executable by the GPU, evaluate the result dynamically.

Please share if you have found any solution yourself.

0

Have you tried a precomputed rainbow table?

Unless your password is long or your zip uses special (ie, salted) pass hashing, this should suffice if you're willing to torrent a huge file.

Here are some places you can download.

btw, downloading an ophcrack rainbow table and exposing how weak our critical webapp's hashing was, got my SW manager to agree to have us non-trivially salt our hashes.

3
  • 2
    Rainbowtables only work for hashes not for encryption.
    – OliverS
    Aug 13, 2010 at 9:29
  • 1
    OliverS, how do you think the encryption works, magic? If the zip is password locked then the goal is to retrieve the password, not brute-force decrypt the entire volume. All password implementations use hashing to match entered with stored password.
    – r00fus
    Aug 15, 2010 at 19:54
  • 2
    The password to a locked Zip file isn't stored as a hash, it's the key to the encryption algorithm (AES). You can't use rainbow tables to attack the password as you can't recover a hash to compare against. Jul 13, 2011 at 4:07
0

I have been doing this with ZIP and RAR files for a while, just use zip2john or rar2john (as stated on other answer) then run "john --format=zip-opencl" (or rar-opencl) Just add the usual options like dict or brute force and limits. works like charm with my rtx 3060 and cuda 11.4 hope it helps someone.

1
  • 1
    As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.
    – Community Bot
    Aug 31, 2023 at 19:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .