Hacker News Reader

Comment by atlas_hugged | Hacker News Reader

TIMBOBIMBO hahahhaha

The keys were personalized though. So this was for Timbo

Read through the whole article to see the password reveal. Was not disappointed!

That wasn't the password of the zip file that John cracked. TIMBOBIMBO was the password of a file that was inside the zip file, specifically a program. The program prompted for that password before it would continue running.

The blog post doesn't say the zip file password. It's not clear to me if the program that cracked the zip file even found the zip file password. It might just be able to find the plaintext but not the password.

I too was waiting to see what the ZIP password was after all these years. I wonder if there is a way to reverse the decryption key into the password, or is it a sausage machine like password hashing?

How long would it take to brute-force this on a modern PC?

I spent a lot of power trying to reverse the actual password and got this far:

    PROGRAM  PATTERN                             MAX LENGTH TESTED
    bkcrack  ?p                                  14
    bkcrack  ?u?d                                16
    bkcrack  ?u                                  17
    bkcrack  ?l                                  15
    bkcrack  ?u?l?l?l?l?l?l?l?l?l?l?l?l?l?l?l    16
    bkcrack  ?u?l?u?l?u?l?u?l?u?l?u?l?u?l?u?l    16 
    hashcat  ?u?l?d                              14

The author kindly modified bkcrack based on Tim's fuzzy recollection of what he thought he might have chosen for the password: https://github.com/kimci86/bkcrack/pull/56 and https://github.com/kimci86/bkcrack/pull/126. However, I ran out of time to work on this part and it seemed more important to get the actual code running.

Also, in the course of things I discovered that Tim used PKZIP inside the BASIC code using a password that used non-printing characters.

> Also, in the course of things I discovered that Tim used PKZIP inside the BASIC code using a password that used non-printing characters.

Wow, that would make brute-forcing it an order of magnitude slower if you're having to cycle through control characters too. I wouldn't have thought to do this, as I wouldn't risk it not being supported.

Reply on news.ycombinator.com