NAME

       yazc - yet another zip cracker

SYNOPSIS

       yazc [-h] [-V]
       yazc COMMAND OPTIONS... FILE

DESCRIPTION

       yazc  cracks password protected zip files. Three attack methods are supported: bruteforce, dictionary and
       plaintext.

       Note: Only files encrypted using the legacy Pkware encryption method are supported.

BRUTEFORCE

       The bruteforce command tries every possible character combination. A general rule of thumb is to use this
       command when you suspect the password to be 8 characters or less.

       -c, --charset=CHARSET
              Set the character set to CHARSET.

       -i, --initial=STRING
              Set the initial password to STRING.

       -l, --length=NUM
              Set the maximum password length to LENGTH characters.

       -a, --alpha
              Use characters [a-z].

       -A, --alpha-caps
              Use characters [A-Z].

       -n, --numeric
              Use characters [0-9].

       -s, --special
              Use special characters "!:$%&/()=?{[]}+-*~#@|;".

       -t, --threads=NUM
              Distribute load to NUM threads. For maximum performance, this should  be  set  to  the  number  of
              logical processors available.

       -h, --help
              Display help and exit.

DICTIONARY

       The dictionary command reads passwords from a text file (or stdin if no file argument is provided). It is
       assumed that each password is separated by a newline.

       -d, --dictionary=FILE
              Read passwords from FILE.

       -h, --help
              Display help and exit.

PLAINTEXT

       The  plaintext  command  uses  a  known  vulnerability  in  the  pkzip stream cipher to find the internal
       representation of the encryption key. To use this attack type, you need at least 13 known plaintext bytes
       from any file in the archive. Generally, this means that you need to obtain at  least  13  bytes  of  the
       compressed stream before it was encrypted.

       The  plaintext  command  expects  two  file  arguments  along with the corresponding offsets separated by
       colons. The first file argument is the plaintext filename and offsets:

              PLAINTEXT:BEGIN:END

       The second file argument is the encrypted archive filename and offsets (this time including the offset of
       the first byte of the cipher):

              CIPHERTEXT:BEGIN:END:CIPHER_BEGIN

INFO

       The info command lists the filenames, offsets and the encryption header for each  file  in  the  archive.
       This is useful to determine what configuration to pass to the plaintext command.

EXAMPLES

       Use  a  bruteforce  attack on file archive.zip using only lower case letters and distribute the load to 8
       threads:

              yazc bruteforce -a -t8 archive.zip

       Use a dictionary attack on file archive.zip and use passwords from rockyou.txt:

              cat rockyou.txt | yazc dictionary archive.zip

       Use a plaintext attack on archive.zip. Take plaintext bytes 100 to 650 and map them to  ciphertext  bytes
       112  to  662.  Use these bytes to reduce the number of keys and perform the attack. Once the intermediate
       key is found, decrypt the rest of the cipher (begins at offset 64) to  get  the  internal  representation
       (the encryption key derived from the password). If possible the actual (or equivalent) password will also
       be recovered and printed.

              yazc plaintext plain.bin:100:650 archive.zip:112:662:64

AUTHOR

       Marc Ferland <marc.ferland at gmail dot com>

       Part of this software was inspired by fcrackzip by Marc Lehmann and pkcrack by Peter Conrad. The original
       plaintext algorithm was developed by Eli Biham and Paul C. Kocher.

                                                                                                         YAZC(1)