Ethical hacking script not working - no error message

Question

I've been taking an Ethical Hacking course. Part of the course is creating a Python script that finds the password for a locked zip file, from a password list text file (hope that makes sense!) - basically iterates through a text file trying each password. The script doesn't work, doesn't error out, and the instructor says "well, it works for me" - not useful. Here's the script:

import optparse
import zipfile
from threading import Thread

def extract_zip(zfile, password):
    try:
        zfile.extractall(pwd=password)
        print("[+] Password Found: " + password + '\n')
    except:
        pass

def main():
    parser = optparse.OptionParser("usage %prog "+\
                                   "-f <zipfile> -d <dictionary>")
    parser.add_option('-f', dest='zname', type='string',\
                      help='specify zip file')
    parser.add_option('-d', dest='dname', type='string',\
                      help='specify dictionary file')
    (options, arg) = parser.parse_args()
    if (options.zname == None) | (options.dname == None):
        print(parser.usage)
        exit(0)
    else:
        zname = options.zname
        dname = options.dname

    zFile = zipfile.ZipFile(zname)
    passFile = open(dname)

    for line in passFile.readlines():
        password = line.strip('\n')
        t = Thread(target=extract_zip, args=(zFile, password))
        t.start()

if __name__ == '__main__':
    main()

The other two files are a text file with a list of passwords, and a password protected zip file where one of the passwords from the text file will unlock it.

Within the course there's a thread mentioning that optparse is depracated, and argparse is its replacement - but even rewriting the script with that doesn't work.

For want of closing out this part of the course I'm looking for help in why this doesn't work.

Thanks in advance for any help on this.

Answer 1

Per my comment above - I added the code below just below the "try" statement:

password = bytes(password.encode('utf-8'))

...then changed

print('[+] Password Found: ' + password + '\n')

to

print("[+] Password Found: " + (password.decode("utf-8")) + '\n')

Now I get the password printed to the console, and the zip file is unzipped. Here's the final, working code.

import optparse
import zipfile
from threading import Thread


def extract_zip(zfile, password):
    try:
        password = bytes(password.encode('utf-8'))
        zfile.extractall(pwd=password)
        print("[+] Password Found: " + (password.decode("utf-8")) + '\n')
    except:
        pass


def main():
    parser = optparse.OptionParser("usage %prog " + '-f <zipfile> -d <dictionary>')
    parser.add_option('-f', dest='zname', type='string', help='specify zip file')
    parser.add_option('-d', dest='dname', type='string', help='specify dictionary file')
    (options, args) = parser.parse_args()
    if (options.zname is None) | (options.dname is None):
        print(parser.usage)
        exit(0)
    else:
        zname = options.zname
        dname = options.dname

    zFile = zipfile.ZipFile(zname)
    passFile = open(dname)

    for line in passFile.readlines():
        password = line.strip('\n')
        t = Thread(target=extract_zip, args=(zFile, password))
        t.start()


if __name__ == '__main__':
    main()

The way I found this was by changing the 'except' statement to print exceptions to the console:

except Exception as e: print(e)

From there I had a couple of issues to solve, but at least I had errors to work with. Once the password was being successfully logged to the console I change the exeception statement back to "pass" - don't need to see the passwords that failed!

I hope this helps someone else hitting the same issues I had.

Answer 2

I run your code using python3 it excuted without problem i did this long ago it is a book called violent something

the password.txt should contain this line

victim: HX9LLTdc/jiDE: 503:100:Iama Victim:/home/victim:/bin/sh root: DFNFxgW7C05fo: 504:100: Markus Hess:/root:/bin/bash

and the command should look like python stack.py -f evil.zip -d passwords.txt