Cracking protected files (.zip, .pfx, .kdbx)

When a password-protected file shows up during enumeration (a .zip, a .pfx, a .kdbx...), you do not always need to know the password: if it is weak or in a dictionary, it is recovered offline by extracting a hash from the file and attacking it with a wordlist like rockyou.txt. The beauty of the offline attack is that it generates no noise or lockouts on any service: all the work is local.

The *2john pattern

The *2john family of converters extracts from each format the material that verifies the password and writes it in the hash syntax john (or hashcat) understands. The flow is always two stages: extract and crack.

zip2john backup.zip   > hash    # or directly: fcrackzip -v -u -D -p rockyou.txt backup.zip
pfx2john user.pfx     > hash    # PKCS#12 (key + certificate)
keepass2john base.kdbx > hash   # KeePass database
ssh2john  id_rsa      > hash    # SSH private key with a passphrase

john --wordlist=/usr/share/wordlists/rockyou.txt hash
john --show hash                # re-show what is already cracked (~/.john/john.pot)

With hashcat, the equivalent modes are -m 13600 (ZIP), -m 13400 (KeePass), -m 22911 (PKCS#8/PFX depending on variant) and -m 22921 (SSH). john usually detects the format on its own.

ZIP specifically

For an encrypted .zip, fcrackzip tries the dictionary directly against the file; the -u flag decompresses each candidate to discard false positives:

fcrackzip -v -u -D -p /usr/share/wordlists/rockyou.txt backup.zip   # shows PASSWORD FOUND

Do not assume the .zip password and the .pfx inside share the same value: they can differ, and each layer may need its own attack. Once the .pfx password is recovered, the private key and certificate are extracted with openssl pkcs12 to use where appropriate (for example, winrm-cert-auth).

Requirements

Having the protected file (read from a share, FTP, backup...) and its password being weak or in a dictionary. No access to any service is needed: the attack is entirely local.

How to detect it. The crack is entirely offline and local to the attacker: it generates no noise or lockouts on any service, so it is undetectable on the victim by design. What is detectable is the file access: reading or downloading the .zip/.pfx/.kdbx from a share leaves an Event ID 5145 (SMB) or a 4663 with a SACL on Windows, and an auditd event on Linux; a user copying a credential container from a share is the early signal. Afterward, the use of the recovered certificate or credential is visible (see winrm-cert-auth). Real detection is watching who accesses those sensitive files, not the crack itself.

Defence. A file protected by a weak password protects nothing: keys, certificates and password databases must be guarded with strong passwords and, better still, not left on accessible shares. It chains with hash cracking and credential reuse.