one zip, two pwd

2023-6-03 19:29

388

Learning

2023-10-24 21:40

JBNRZ

36 字

1 分钟内

本文最后更新于 393 天前，其中的信息可能已经有所发展或是发生改变。

Wiki

https://en.wikipedia.org/wiki/PBKDF2#HMAC_collisions

https://www.bleepingcomputer.com/news/security/an-encrypted-zip-file-can-have-two-correct-passwords-heres-why

Script

import pyzipper
import hashlib


with pyzipper.AESZipFile('submit.zip', 'r', compression=pyzipper.ZIP_DEFLATED, encryption=pyzipper.WZ_AES) as extracted_zip:
    extracted_zip.extractall('./test', pwd=bytes.fromhex(hashlib.sha1("Bl33pingC0mputer-Sh0w-M3-H0W-t0-pR0Duc3-an-eNcRyPT3D-ZIP-File-in-the-simplest-way".encode()).hexdigest()))


with pyzipper.AESZipFile('submit.zip', 'r', compression=pyzipper.ZIP_DEFLATED, encryption=pyzipper.WZ_AES) as extracted_zip:
    extracted_zip.extractall('./test', pwd=b"Bl33pingC0mputer-Sh0w-M3-H0W-t0-pR0Duc3-an-eNcRyPT3D-ZIP-File-in-the-simplest-way")

CRYPTO MISC