forensicsPromedium
Oleg
duckerz
Task: recover the password for a protected GovSec ZIP using a VMware memory dump and the encrypted archive contents. Solution: treat the UTF-16LE flag-like string in memory as a stale decoy, recover ZipCrypto keys with bkcrack known plaintext, then brute-force only the changed suffix behind the stable prefix.
$ ls tags/ techniques/
zipcrypto_known_plaintext_attackutf16le_string_searchmask_bruteforce
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [reverse][Pro]Защищенный банк (Protected Bank)— duckerz
- [forensics][Pro]Блокнот (Notepad)— hackerlab
- [reverse][Pro]Очень защищенный банк (Super Protected Bank)— duckerz
- [forensics][Pro]Какой-то DMP...— hackerlab
- [forensics][Pro]awk...wardddd ✂️— bluehensctf