3 ms·

TIMBOBIMBO hahahhaha

by atlas_hugged 2y ago

declan_roberts 2y ago
Read through the whole article to see the password reveal. Was not disappointed!
- Thorrez 2y ago
  That wasn't the password of the zip file that John cracked. TIMBOBIMBO was the password of a file that was inside the zip file, specifically a program. The program prompted for that password before it would continue running. The blog post doesn't say the zip file password. It's not clear to me if the program that cracked the zip file even found the zip file password. It might just be able to find the plaintext but not the password.
  - qingcharles 2y ago
    I too was waiting to see what the ZIP password was after all these years. I wonder if there is a way to reverse the decryption key into the password, or is it a sausage machine like password hashing? How long would it take to brute-force this on a modern PC?
    - jgrahamc 2y ago
      I spent a lot of power trying to reverse the actual password and got this far: PROGRAM PATTERN MAX LENGTH TESTED bkcrack ?p 14 bkcrack ?u?d 16 bkcrack ?u 17 bkcrack ?l 15 bkcrack ?u?l?l?l?l?l?l?l?l?l?l?l?l?l?l?l 16 bkcrack ?u?l?u?l?u?l?u?l?u?l?u?l?u?l?u?l 16 hashcat ?u?l?d 14 The author kindly modified bkcrack based on Tim's fuzzy recollection of what he thought he might have chosen for the password: https://github.com/kimci86/bkcrack/pull/56 https://github.com/kimci86/bkcrack/pull/56 and https://github.com/kimci86/bkcrack/pull/126 https://github.com/kimci86/bkcrack/pull/126. However, I ran out of time to work on this part and it seemed more important to get the actual code running. Also, in the course of things I discovered that Tim used PKZIP inside the BASIC code using a password that used non-printing characters.
      - qingcharles 2y ago
        > Also, in the course of things I discovered that Tim used PKZIP inside the BASIC code using a password that used non-printing characters. Wow, that would make brute-forcing it an order of magnitude slower if you're having to cycle through control characters too. I wouldn't have thought to do this, as I wouldn't risk it not being supported.
rurban 2y ago
The keys were personalized though. So this was for Timbo

TIMBOBIMBO hahahhaha

declan_roberts 2y ago

Read through the whole article to see the password reveal. Was not disappointed!

Thorrez 2y ago
That wasn't the password of the zip file that John cracked. TIMBOBIMBO was the password of a file that was inside the zip file, specifically a program. The program prompted for that password before it would continue running. The blog post doesn't say the zip file password. It's not clear to me if the program that cracked the zip file even found the zip file password. It might just be able to find the plaintext but not the password.
- qingcharles 2y ago
  I too was waiting to see what the ZIP password was after all these years. I wonder if there is a way to reverse the decryption key into the password, or is it a sausage machine like password hashing? How long would it take to brute-force this on a modern PC?
  - jgrahamc 2y ago
    I spent a lot of power trying to reverse the actual password and got this far: PROGRAM PATTERN MAX LENGTH TESTED bkcrack ?p 14 bkcrack ?u?d 16 bkcrack ?u 17 bkcrack ?l 15 bkcrack ?u?l?l?l?l?l?l?l?l?l?l?l?l?l?l?l 16 bkcrack ?u?l?u?l?u?l?u?l?u?l?u?l?u?l?u?l 16 hashcat ?u?l?d 14 The author kindly modified bkcrack based on Tim's fuzzy recollection of what he thought he might have chosen for the password: https://github.com/kimci86/bkcrack/pull/56 https://github.com/kimci86/bkcrack/pull/56 and https://github.com/kimci86/bkcrack/pull/126 https://github.com/kimci86/bkcrack/pull/126. However, I ran out of time to work on this part and it seemed more important to get the actual code running. Also, in the course of things I discovered that Tim used PKZIP inside the BASIC code using a password that used non-printing characters.
    - qingcharles 2y ago
      > Also, in the course of things I discovered that Tim used PKZIP inside the BASIC code using a password that used non-printing characters. Wow, that would make brute-forcing it an order of magnitude slower if you're having to cycle through control characters too. I wouldn't have thought to do this, as I wouldn't risk it not being supported.

rurban 2y ago

The keys were personalized though. So this was for Timbo