Spaces:
Paused
Paused
| import gradio as gr | |
| import subprocess | |
| import os | |
| import tempfile | |
| import time | |
| def estimate_time(length, charset): | |
| """Estimate time for brute force based on charset and length""" | |
| charset_sizes = { | |
| "a": 26, | |
| "A": 26, | |
| "1": 10, | |
| "a1": 36, | |
| "aA": 52, | |
| "aA1": 62 | |
| } | |
| size = charset_sizes.get(charset, 26) | |
| total_combinations = sum(size ** i for i in range(1, length + 1)) | |
| # Rough estimate: 100k passwords per second on CPU | |
| seconds = total_combinations / 100000 | |
| if seconds < 60: | |
| return f"{seconds:.1f} seconds" | |
| elif seconds < 3600: | |
| return f"{seconds/60:.1f} minutes" | |
| elif seconds < 86400: | |
| return f"{seconds/3600:.1f} hours" | |
| else: | |
| return f"{seconds/86400:.1f} days" | |
| def crack_zip(file, method, max_length=6, charset="a", progress=gr.Progress()): | |
| if file is None: | |
| return "Please upload a ZIP file" | |
| # Show estimated time for brute force | |
| if method == "Brute Force": | |
| est_time = estimate_time(max_length, charset) | |
| progress(0, desc=f"Starting brute force (estimated max time: {est_time})") | |
| # Use temp directory that user has access to | |
| temp_dir = tempfile.mkdtemp(dir="/tmp") | |
| temp_path = os.path.join(temp_dir, "uploaded.zip") | |
| try: | |
| # Read and save the uploaded file | |
| with open(temp_path, "wb") as f: | |
| f.write(file.read()) | |
| if method == "Dictionary Attack": | |
| progress(0.5, desc="Running dictionary attack...") | |
| return crack_with_john(temp_path) | |
| else: | |
| return crack_with_fcrackzip_progress(temp_path, max_length, charset, progress) | |
| except Exception as e: | |
| return f"Error: {str(e)}" | |
| finally: | |
| # Clean up | |
| try: | |
| if os.path.exists(temp_path): | |
| os.remove(temp_path) | |
| if os.path.exists(temp_dir): | |
| os.rmdir(temp_dir) | |
| except: | |
| pass | |
| def crack_with_fcrackzip_progress(file_path, max_length, charset, progress): | |
| """Run fcrackzip with progress updates""" | |
| try: | |
| # Try lengths progressively | |
| for length in range(1, max_length + 1): | |
| progress(length / max_length, desc=f"Trying length {length}/{max_length}") | |
| cmd = [ | |
| "fcrackzip", | |
| "-b", # brute force | |
| "-c", charset, # character set | |
| "-l", f"{length}-{length}", # specific length | |
| "-u", # unzip to verify | |
| "-v", # verbose | |
| file_path | |
| ] | |
| result = subprocess.run(cmd, capture_output=True, text=True) | |
| output = result.stdout + result.stderr | |
| if "PASSWORD FOUND" in output: | |
| # Extract password from output | |
| for line in output.split('\n'): | |
| if "PASSWORD FOUND" in line: | |
| password = line.split("== ")[-1].strip() | |
| return f"✅ Password found: {password}\n\nFound at length: {length}" | |
| return f"❌ Password not found (tried all combinations up to {max_length} characters)" | |
| except Exception as e: | |
| return f"Error with fcrackzip: {str(e)}" | |
| def crack_with_john(file_path): | |
| try: | |
| # Use /tmp for hash file (writable by user) | |
| hash_file = "/tmp/zip_hash.txt" | |
| # Extract hash | |
| result = subprocess.run( | |
| ["zip2john", file_path], | |
| capture_output=True, | |
| text=True | |
| ) | |
| if result.returncode != 0: | |
| return f"Error extracting hash: {result.stderr}" | |
| # Write hash to file | |
| with open(hash_file, "w") as f: | |
| f.write(result.stdout) | |
| # Create custom john directory in /tmp | |
| john_dir = "/tmp/.john" | |
| os.makedirs(john_dir, exist_ok=True) | |
| os.environ["JOHN_PRIVATE_HOME"] = john_dir | |
| # Run John with wordlist | |
| crack_result = subprocess.run( | |
| ["john", "--wordlist=/usr/share/john/password.lst", hash_file], | |
| capture_output=True, | |
| text=True, | |
| timeout=300 # 5 minute timeout | |
| ) | |
| # Get cracked password | |
| show_result = subprocess.run( | |
| ["john", "--show", hash_file], | |
| capture_output=True, | |
| text=True | |
| ) | |
| # Parse output | |
| if show_result.stdout: | |
| lines = show_result.stdout.strip().split('\n') | |
| for line in lines: | |
| if ':' in line and not line.startswith('0 password'): | |
| parts = line.split(':') | |
| if len(parts) >= 2: | |
| password = parts[1] | |
| return f"✅ Password found: {password}" | |
| return "❌ Password not found in wordlist" | |
| except subprocess.TimeoutExpired: | |
| return "⏱️ Dictionary attack timed out after 5 minutes" | |
| except Exception as e: | |
| return f"Error with John: {str(e)}" | |
| # Create Gradio interface | |
| with gr.Blocks(title="ZIP Password Recovery", theme=gr.themes.Soft()) as demo: | |
| gr.Markdown("# 🔐 ZIP Password Recovery Tool") | |
| gr.Markdown("Upload a password-protected ZIP file to attempt password recovery") | |
| with gr.Row(): | |
| with gr.Column(): | |
| file_input = gr.File( | |
| label="Upload ZIP File", | |
| file_types=[".zip"], | |
| type="binary" | |
| ) | |
| method = gr.Radio( | |
| ["Dictionary Attack", "Brute Force"], | |
| label="Recovery Method", | |
| value="Dictionary Attack" | |
| ) | |
| with gr.Accordion("Brute Force Settings", open=False): | |
| max_length = gr.Slider( | |
| minimum=1, | |
| maximum=12, # Extended to 12 | |
| value=4, | |
| step=1, | |
| label="Max Password Length", | |
| info="⚠️ Length 8+ can take hours/days!" | |
| ) | |
| charset = gr.Dropdown( | |
| choices=[ | |
| ("Lowercase letters (a-z)", "a"), | |
| ("Uppercase letters (A-Z)", "A"), | |
| ("Numbers (0-9)", "1"), | |
| ("Lowercase + Numbers", "a1"), | |
| ("All letters (a-z, A-Z)", "aA"), | |
| ("All letters + Numbers", "aA1") | |
| ], | |
| value="a", | |
| label="Character Set", | |
| info="More characters = much longer time" | |
| ) | |
| # Time estimate display | |
| time_estimate = gr.Textbox( | |
| label="Estimated Maximum Time", | |
| value="~0.1 seconds", | |
| interactive=False | |
| ) | |
| crack_btn = gr.Button("Start Recovery", variant="primary") | |
| with gr.Column(): | |
| output = gr.Textbox( | |
| label="Result", | |
| lines=5, | |
| max_lines=10 | |
| ) | |
| # Update time estimate when settings change | |
| def update_estimate(length, charset): | |
| return f"~{estimate_time(length, charset)}" | |
| max_length.change(update_estimate, [max_length, charset], time_estimate) | |
| charset.change(update_estimate, [max_length, charset], time_estimate) | |
| crack_btn.click( | |
| fn=crack_zip, | |
| inputs=[file_input, method, max_length, charset], | |
| outputs=output | |
| ) | |
| gr.Markdown(""" | |
| ### 📊 Time Estimates (approximate): | |
| - **Length 4**: seconds to minutes | |
| - **Length 6**: minutes to hours | |
| - **Length 8**: hours to days | |
| - **Length 10+**: days to weeks/months | |
| ### ⚡ Tips: | |
| - Start with Dictionary Attack first | |
| - For brute force, start with shorter lengths | |
| - Lowercase only is fastest | |
| - Each additional character exponentially increases time | |
| - HF Spaces may timeout on very long operations | |
| ### ⚠️ Important: | |
| - Only use on files you own | |
| - Consider if recreating the content would be faster | |
| - GPU instances would be much faster but cost money | |
| """) | |
| if __name__ == "__main__": | |
| demo.launch() |