Every so often, I come across a challenge that has a password encrypted zip file.  And every so often I realize I've switched my working laptop and I no longer have Jumbo John installed.  Recently I encountered that exact scenario and when I attempted to install Jumbo John, something went sideways.  Rather than digging through it, and knowing that I'm about to switch my working laptop in the very near future, I decided to use a script instead.

Honestly, after going this route, I'm not exactly sure why this isn't a better approach.  Perhaps if I weren't using a wordlist?  Multithreading?  Dunno.  Anyway, I think I can count exactly one time I've come across a zip file with a password in my work.  Given that this situation only arises during CTF situations, the script works and I don't have to install anything.

Let's setup the situation:

1.  Create a text file with some text.  Let's call it secrets.txt
2.  Zip the file with a password using the following syntax:  zip -e secrets.zip secrets.txt

It will prompt you for you password, confirm your password, then delete secrets.txt

The password I used:  icecream

Our script looks like this:

#!/bin/bash

while read LINE
do
    unzip -P "$LINE" secrets.zip >>/dev/null 2>/dev/null
    if [[ $? == 0 ]]; then
        echo '[+] Password Cracked: ' $LINE
             exit
    fi
done < /usr/share/wordlists/rockyou.txt

I called mine:  zipcrack.sh

You need to change the permissions for execution:  chmod 777 zipcrack.sh

Now we can execute it:  ./zipcrack.sh

If the password is in rockyou.txt, we should see:  

[+] Password Cracked: icecream

That's it.