Lab: Password Cracking

Due: Wednesday, October 7 at 11:59pm (one week after it is assigned) Worth: 4 points

This is the second of this week’s two labs; the other is Cowsay (pip and linters). Password cracking uses try/except to guess passwords for encrypted zip files and catch failed attempts. Do them in either order.

In computer science, hacking is a compliment: it means building clever things. Cracking is the other one, the breaking-into-things that non-programmers usually mean when they say “hacking”.

You will write a program from scratch, open zip files in Python, and use try/except to handle incorrect passwords.

Starter code: github.com/rtealwitter/lab-password-cracking

Setup

Fork the starter repo to your account, then clone your fork and cd into it. It ships with the zip files you will be prying open.

Opening zip files in Python

Python opens password-protected zip files with the built-in zipfile module. Start a new file with this:

from zipfile import ZipFile
with ZipFile('guido_secrets.zip') as zf:
    password = b'BFDL'
    zf.extractall(pwd=password)

After the code runs, a new file appears at the relative path guido_secrets/secrets.txt, inside the guido_secrets folder. The file holds a poem, The Zen of Python. Open it in VS Code.

The password is a bytes object (b'BFDL'), not an ordinary str. Zip passwords are raw bytes, and while they usually spell out ASCII text, they do not have to. Change b'BFDL' to the plain string 'BFDL' and you get a TypeError because pwd requires bytes. You can convert a string to bytes with .encode, so 'BFDL'.encode('ascii') gives the same value as b'BFDL'. Change the password to anything other than BFDL and run it again: you get an error (RuntimeError, BadZipFile, or zlib.error, depending on your system), and any files it does create will hold garbage rather than the real contents.

Zip bombs

Some zip files are zip bombs, which expand to consume excessive storage when decompressed. Antivirus software routinely opens zip files to scan inside them, and opening the wrong one can take a machine down: decompressing it can fill the entire hard drive.

The file 42.zip in the repo is only 42 KB, but unzipped it expands to 4.5 petabytes, roughly 4.5 million gigabytes. (It is password-protected so you cannot set it off by accident; the password is 42 if you are feeling brave.) quine.zip uses a different technique: it contains an exact copy of itself.

Antivirus tools that open zips inside zips will unpack quine.zip forever, always finding another copy of the same file within. It is safe to open by hand, and worth doing once: unzip it and inside you find the same zip again, and again. Python has no built-in protection against zip bombs, so never open an untrusted zip file from Python.

The scenario

For this lab, pretend it is 2015 and you are an analyst at the GRU, the Russian military-intelligence agency. One of your agents has risked their life to bring you whitehouse_secrets.zip, stolen from a White House IT worker and said to hold details of the upcoming US presidential election. Your job is to open it, but the file is encrypted and you do not have the password. You do have leads.

In July 2015, the affair-oriented dating site Ashley Madison was breached and its entire user database leaked onto the internet.

The badges on that homepage promise that the data is safe and encrypted. The leak became a prominent example of hacktivism. The White House IT worker who made the zip was an Ashley Madison user. Like most people, they reused a single password everywhere, so one of the leaked passwords will open the file.

The scenario draws on a Defense One report that 45 White House staffers and more than 10,000 military personnel had Ashley Madison accounts. The Associated Press confirmed a White House IT staffer among them.

Your tasks

1. The SecLists repository collects security datasets, including the Ashley Madison passwords at Passwords/Leaked-Databases/Ashley-Madison.txt. Download that file.

2. Write a program password_cracker.py that finds the zip file’s password. It should:

   • Open Ashley-Madison.txt and build a list called passwords holding every password in the file.
   • For each password in passwords, try opening whitehouse_secrets.zip with that password; if it opens successfully, print the password.
   • When the file finally decrypts, you will have a new whitehouse_secrets/secrets.txt containing the secrets.
   • Commit both password_cracker.py and whitehouse_secrets/secrets.txt to your repo and push them.

   Hint. Use a try/except to tell whether the zip opened: try each password, catch a failure, and continue to the next password. A zip password must be bytes, so call .encode() on each one. A line read from a file includes its trailing newline, so call .strip() before trying it.

   Hint. There are a lot of passwords, and trying them all takes five to ten minutes, so print a progress line every 10,000 iterations (the current count and password) to confirm the program is still moving. Because the passwords are sorted alphabetically, how far into the alphabet you are tells you roughly how close you are to done.

3. (Optional, but recommended.) Stop reusing passwords across sites. Memorize them, or use a password manager. According to Snowden the NSA can guess up to a trillion passwords a second, and even an ordinary laptop running John the Ripper manages millions, so pick passwords that are genuinely hard to guess; XKCD 936 has a good method.

Submitting

Keep running your cracker until it prints the password and produces the decrypted text under whitehouse_secrets/. Commit that artifact alongside password_cracker.py, push, and submit the repository and branch to the Gradescope Programming Assignment. The instructor-owned grader checks the program’s cracking structure and the completed artifact offline; its result is authoritative, while any GitHub Action is preliminary feedback. Fix, push, and resubmit until it passes.