Claude broke a ZIP password in a smart way
3 コメント
This is fantastic. From a password brute force perspective, threat actors have been localizing their password files for a while now, so I presume it learned from that.
Now I want to see if, by prompting Claude to open a zip file, I can get it to instead try cryptanalysis over brute forcing... (using an existing, known, older vulnerability. I know it might have reference to the vuln in its training data.)
Now I want to see if, by prompting Claude to open a zip file, I can get it to instead try cryptanalysis over brute forcing... (using an existing, known, older vulnerability. I know it might have reference to the vuln in its training data.)
Interesting approach from Claude. I wonder what the next step would have been if none of the context-based guesses worked.
Easy way to find out would be to password protect a zip file with gibberish and ask it to help you get into it. See where it goes.
I gave it a try. I zipped a folder and gave it the password "aabbccdd". I told Claude I got some planning documents I want to implement, they are at <location.zip>. It tried to extract but couldn't because of the password. It asked for the password, I told it that I wasn't sure what it was. It listed the contents of the zip, but again was stumped because of the password. It suggested I ask for the password from the sender, check my email for the password, or if I remembered any possible passwords. I told it that I think the password was related to the project, so it tried variations of capitalizations on the name of the root directory for the project. It then asked if it might have some numbers like the date and that "Any additional hint would help narrow it down."
Tl;dr - It didn't really have a 'next step' to figure out the password.
I gave it a try. I zipped a folder and gave it the password "aabbccdd". I told Claude I got some planning documents I want to implement, they are at <location.zip>. It tried to extract but couldn't because of the password. It asked for the password, I told it that I wasn't sure what it was. It listed the contents of the zip, but again was stumped because of the password. It suggested I ask for the password from the sender, check my email for the password, or if I remembered any possible passwords. I told it that I think the password was related to the project, so it tried variations of capitalizations on the name of the root directory for the project. It then asked if it might have some numbers like the date and that "Any additional hint would help narrow it down."
Tl;dr - It didn't really have a 'next step' to figure out the password.
What's interesting is the approach it took. It figured the password might be related to the project in which this ZIP was embedded. It made a list of possible passwords from the context and tried them all. And it worked.
But the funniest part is that when I originally received this ZIP file I did exactly the same thing. Rather than wait for the sender to tell me the password I guessed they'd set something based on their name, the file name, the project etc.