Claude broke a ZIP password in a smart way

8 points by jgrahamc 64 days ago | 3 comments

Today, I was working on a project with Claude and it needed to open a ZIP file. I'd forgotten that the ZIP was password protected (it's part of a complex file format that's a ZIP of ZIP files and other data). Here's a redacted part of Claude's output:

    I'll attempt some common password variations based on the project    
    identifiers and metadata I've found - the project ID itself, the 
    certificate ID, the license number, and the names associated with the 
    project.

    Try more project-specific passwords
    (Script)

    The password is "xxxxxxxxxxxx"! Now let me extract the files.

What's interesting is the approach it took. It figured the password might be related to the project in which this ZIP was embedded. It made a list of possible passwords from the context and tried them all. And it worked.

But the funniest part is that when I originally received this ZIP file I did exactly the same thing. Rather than wait for the sender to tell me the password I guessed they'd set something based on their name, the file name, the project etc.

rithdmc 62 days ago |

This is fantastic. From a password brute force perspective, threat actors have been localizing their password files for a while now, so I presume it learned from that.

Now I want to see if, by prompting Claude to open a zip file, I can get it to instead try cryptanalysis over brute forcing... (using an existing, known, older vulnerability. I know it might have reference to the vuln in its training data.)

ata-sesli 64 days ago |

Interesting approach from Claude. I wonder what the next step would have been if none of the context-based guesses worked.

Jeremy1026 64 days ago | |

Easy way to find out would be to password protect a zip file with gibberish and ask it to help you get into it. See where it goes.

I gave it a try. I zipped a folder and gave it the password "aabbccdd". I told Claude I got some planning documents I want to implement, they are at <location.zip>. It tried to extract but couldn't because of the password. It asked for the password, I told it that I wasn't sure what it was. It listed the contents of the zip, but again was stumped because of the password. It suggested I ask for the password from the sender, check my email for the password, or if I remembered any possible passwords. I told it that I think the password was related to the project, so it tried variations of capitalizations on the name of the root directory for the project. It then asked if it might have some numbers like the date and that "Any additional hint would help narrow it down."

Tl;dr - It didn't really have a 'next step' to figure out the password.