After reading Violent Python, I decided to try making a basic dictionary zip password recovery tool for fun. Some of the other free open source tools out there are great but this tool is fully functional if not ideal. I’m primarily posting it to serve as an example of how Python can be used to perform such an attack. I do not condone the use of password crackers for illicit purposes.

The tool can generate a biographical dictionary from a specified file’s ASCII strings as well as populate the dictionary with a recursive directory listing from the location of your choice. Got the idea while studying for my AccessData cert. Their Password Recovery Toolkit does this in hopes of increasing the likelihood that the dictionary will contain a relevant password. The idea is that a user either used the word in the past or that it can be found elsewhere on his or her computer. A very cool idea that’s helped me on forensics challenges in the past.

I’ve designed the code below for Python 2.7.5 on Windows 7. It uses the Strings binary from Picnix Utils. You can also click here to download a copy. Obviously the best defense against it is to use a strong password outside the scope of the dictionary (which most people do when protecting zip files anyway).

import argparse
import zipfile
import subprocess
import os

print ''' SYNTAX:
    Dictionary: zipdict.py -f (zip) -d (dict)
    Bio Dictionary Generator: zipdict.py -f (zip) -s (file with desired strings)
'''

parser = argparse.ArgumentParser(description='Zip file dictionary attack tool.')
parser.add_argument('-f', help='Specifies input file (ZIP)', required=True)
parser.add_argument('-d', help='Specifies the dictionary.', required=False)
parser.add_argument('-s', help='Build ASCII strings dictionary.', required=False)
args = parser.parse_args()
zipfile = zipfile.ZipFile(args.f)

print '{*} Cracking: %s' % args.f
print '{*} Dictionary: %s' % args.d

def biodictattack():
  print '{*} Generating biographical dictionary...'
  stringsdict = open('stringsdict', 'w')
  stringsout = subprocess.Popen(['strings', args.f], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
  for string in stringsout.stdout:
    stringsdict.write(string)
    stringsout.wait()
  walkpath = raw_input("Directory listing starting where? [ex. C:\] ")
  for root, dirs, files in os.walk(walkpath):
    for name in files:
      filenames = os.path.join(name)
      stringsdict.write(filenames + '\n')
  for root, dirs, files in os.walk(walkpath):
    for name in dirs:
      dirlisting = os.path.join(name)
      stringsdict.write(dirlisting + '\n')
  print '{*} Done. Re-run tool with zipdict.py -f (zip) -d stringsdict'

def dictattack():
  dict = open(args.d, 'r')
  with open(args.d, 'r') as dict:
    for x in dict.readlines():
      dictword = x.strip('\n')
      try:
        zipfile.extractall(pwd=dictword)
        print '{*} Password found = ' + dictword + '\n'
        print '{*} File contents extracted to zipdict path.'
        exit(0)
      except Exception, e:
        pass

if args.s:
  biodictattack()
else:
  dictattack()

My next post will be on analyzing Volume Shadow Copies on Linux and some cool methods that I used on the 2013 DC3 Forensic Challenge.