Competition ZIP Archive

Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is active and has established sandbox assumptions, evidence priorities, and the analysis project root. If that has not happened yet, return to $ctf-sandbox-orchestrator first.

Use this skill when the decisive path is an encrypted ZIP/PKZIP archive rather than an upload parser or a generic crypto blob. Prefer the legacy ZipCrypto known-plaintext path when the challenge gives a predictable file, format header, template, or other recoverable plaintext. Do not begin with blind password brute force.

Reply in Simplified Chinese unless the user explicitly requests English. Keep commands and tool output in their original form.

Quick Start

1. Preserve the original archive, compute a hash, and work on a copy under the analysis project's work/<case>/ directory.
2. Confirm the actual archive format and list entries before attempting a password attack.
3. Determine whether the entry uses legacy ZipCrypto. bkcrack does not recover WinZip AES or other modern encryption.
4. Build an exact known-plaintext candidate. The attack needs at least 12 known plaintext bytes, including at least 8 contiguous bytes.
5. Recover the internal keys with bkcrack, then create an unencrypted copy and extract it.
6. Preserve the command, entry names, known-plaintext source, recovered keys, output hash, and final flag as evidence.

Tool Setup