ritheachengkh

Passwords - A Cracking Christmas

Learn how to crack password-based encrypted files.

https://tryhackme.com/room/attacks-on-ecrypted-files-aoc2025-asdfghj123

Task 1 Introduction

1

With time between Easter and Christmas being destabilised, the once-quiet systems of The Best Festival Company began showing traces of encrypted data buried deep within their servers. Sir Carrotbane, stumbled upon a series of locked PDF and ZIP files labelled “North Pole Asset List.” Rumours spread that these could contain fragments of Santa’s master gift registry, critical information that could help Malhare control the festive balance between both worlds.

Sir Carrotbane sets out to crack the encryption, learning how weak passwords can expose even the most guarded secrets. Can the Elves adapt fast and prevent their secrets from being discovered?

Learning Objectives

A few simple points to remember:

To make it simple, encryption makes the contents unreadable unless the correct password is known. If the password is weak, an attacker can simply try likely passwords until one works.

Task 2 Attacks Against Encrypted Files

How Attackers Recover Weak Passwords

Attackers don’t usually try to “break” the encryption itself because that would take far too long with modern cryptography. Instead, they focus on guessing the password that protects the file. The two most common ways of doing this are dictionary attacks and brute-force (or mask) attacks.

Dictionary Attacks

In a dictionary attack, the attacker uses a predefined list of potential passwords, known as a wordlist, and tests each one until the correct password is found. These wordlists often contain leaked passwords from previous breaches, common substitutions like password123, predictable combinations of names and dates, and other patterns that people frequently use. Because many users choose weak or common passwords, dictionary attacks are usually fast and highly effective.

Mask Attacks

Brute-force and mask attacks go one step further. A brute-force attack systematically tries every possible combination of characters until it finds the right one. While this guarantees success eventually, the time it takes grows exponentially with the length and complexity of the password.

Mask attacks aim to reduce that time by limiting guesses to a specific format. For example, trying all combinations of three lowercase letters followed by two digits.

By narrowing the search space, mask attacks strike a balance between speed and thoroughness, especially when the attacker has some idea of how the password might be structured.

2

Practical tips attackers use (and defenders should know about):

Exercise

You will find the files for this section in the Desktop directory of the machine. Switch to it by running cd Desktop in your terminal.

1. Confirm the File Type

Use the file command or open the file with a hex viewer. This helps pick the right tool.

3

If it’s a PDF, proceed with PDF tools. If it’s a ZIP, proceed with ZIP tools.

2. Tools to Use (pick one based on file type)

3. Try a Dictionary Attack First (fast, often successful)

Example: PDF with pdfcrack and rockyou.txt:

4

Example: using john

5

6

Detection of Indicators and Telemetry

Offline cracking does not hit login services, so lockouts and failed logon dashboards stay quiet. We can detect the work where it runs, on endpoints and jump boxes. The important signals to monitor include:

Process creation: Password cracking has a small set of well-known binaries and command patterns that we can look out for. A mix of process events, file activity, GPU signals, and network touches tied to tooling and wordlists. Our goal is to make the activity obvious without drowning in noise.

It’s worth noting that on Windows systems, Sysmon Event ID 1 captures process creation with full command line properties, while on Linux, auditd, execve, or EDR sensors capture binaries and arguments.

GPU and Resource Artefacts

GPU cracking is loud. Sudden high utilisation on hosts can be picked up and would need to be investigated.

7

Network Hints, Light but Useful

Offline cracking does not need the network once wordlists are present. Yet most operators fetch lists and tools first.

Unusual File Reads

Repeated reads of files such as wordlists or encrypted files would need analysis.

Detections

Below are some examples of detection rules and hunting queries we can put to use across various environments.

Sysmon:

8

Linux audit rules, temporary for an investigation:

9

Sigma style rule, Windows process create for cracking tools:

10

Response Playbook

As security analysts in Wareville, it is important to have a playbook to follow when such incidents occur. The immediate actions to take are:

  1. Isolate the host if malicious activity is detected. If it is a lab, tag and suppress.
  2. Capture triage artefacts such as process list, process memory dump, nvidia-smi sample output, open files, and the encrypted file.
  3. Preserve the working directory, wordlists, hash files, and shell history.
  4. Review which files were decrypted. Search for follow‑on access, lateral movement or exfiltration.
  5. Identify the origin and intent of the activity. Was this authorised? If not, escalate to the IR team.
  6. Remediate the activity, rotate affected keys and passwords, and enforce MFA for accounts.
  7. Close with education and correct placement of tools into approved sandboxes.

🔑 Solution

What is the flag inside the encrypted PDF?

✅ THM{Cr4ck1ng_PDFs_1s_34$y}

What is the flag inside the encrypted zip file?

✅ THM{Cr4ck1n6_z1p$_1s_34$yyyy}

Side Quest 2 Key

For those who want another challenge, have a look around the VM to get access to the key for Side Quest 2! Accessible through our Side Quest Hub!

https://tryhackme.com/adventofcyber25/sidequest