Hacker News new | ask | show | jobs
by Thorrez 656 days ago
That wasn't the password of the zip file that John cracked. TIMBOBIMBO was the password of a file that was inside the zip file, specifically a program. The program prompted for that password before it would continue running.

The blog post doesn't say the zip file password. It's not clear to me if the program that cracked the zip file even found the zip file password. It might just be able to find the plaintext but not the password.
1 comments
qingcharles 656 days ago
I too was waiting to see what the ZIP password was after all these years. I wonder if there is a way to reverse the decryption key into the password, or is it a sausage machine like password hashing?

How long would it take to brute-force this on a modern PC?

link
jgrahamc 656 days ago
I spent a lot of power trying to reverse the actual password and got this far:

    PROGRAM  PATTERN                             MAX LENGTH TESTED
    bkcrack  ?p                                  14
    bkcrack  ?u?d                                16
    bkcrack  ?u                                  17
    bkcrack  ?l                                  15
    bkcrack  ?u?l?l?l?l?l?l?l?l?l?l?l?l?l?l?l    16
    bkcrack  ?u?l?u?l?u?l?u?l?u?l?u?l?u?l?u?l    16 
    hashcat  ?u?l?d                              14
The author kindly modified bkcrack based on Tim's fuzzy recollection of what he thought he might have chosen for the password: https://github.com/kimci86/bkcrack/pull/56 and https://github.com/kimci86/bkcrack/pull/126. However, I ran out of time to work on this part and it seemed more important to get the actual code running.

Also, in the course of things I discovered that Tim used PKZIP inside the BASIC code using a password that used non-printing characters.

link
qingcharles 656 days ago
> Also, in the course of things I discovered that Tim used PKZIP inside the BASIC code using a password that used non-printing characters.

Wow, that would make brute-forcing it an order of magnitude slower if you're having to cycle through control characters too. I wouldn't have thought to do this, as I wouldn't risk it not being supported.

link