https://tryhackme.com/room/attacks-on-ecrypted-files-aoc2025-asdfghj123
Created by: tryhackme, SecurityNomad, l000g1c
“With time between Easter and Christmas being destabilised, the once-quiet systems of The Best Festival Company began showing traces of encrypted data buried deep within their servers. Sir Carrotbane, stumbled upon a series of locked PDF and ZIP files labelled “North Pole Asset List.” Rumours spread that these could contain fragments of Santa’s master gift registry, critical information that could help Malhare control the festive balance between both worlds.
Sir Carrotbane sets out to crack the encryption, learning how weak passwords can expose even the most guarded secrets. Can the Elves adapt fast and prevent their secrets from being discovered?”
Our task is to look at the files on the Desktop in the terminal.
Using the cat command on the flag.zip, you will see that it’s encrypted.
THM is going to have us use a few tools to crack these files. The first one will be pdfcrack and with it, we find a user-password!
Next up will be the john(john the ripper) tool. We are tasked with created txt file that we can use with the John tool.
Highlights:
“What is the flag inside the encrypted PDF?”. Using our previously obtained password, we can now open the documents on the desktop directly. We are using the password “naughtylist”.
“What is the flag inside the encrypted zip file?”. Open the zip file and put in our previous password of “winter4ever” to obtain this flag. You will need to drag and drop the file on to the desktop for it to prompt for a password(this threw me off at first).
A quick but fun room that shows the power of password cracking. THM links to another https://tryhackme.com/room/passwordattacks if you want to do more password-related tasks. Heads up, this room has the difficulty set to “Hard”!