Skip to content
Get packs

CTF ZIP Archive Solver

Guides an agent through solving encrypted ZIP challenges using known-plaintext key recovery with bkcrack.

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This skill teaches an AI agent a specific workflow for capture-the-flag (CTF) competition challenges involving legacy ZipCrypto-encrypted ZIP archives. It tells the agent to preserve the original file, list its entries, confirm the encryption type, and, when it has a predictable plaintext fragment, use the bkcrack tool to recover internal keys and produce an unlocked copy. It is designed to run only as a downstream step after a broader CTF orchestrator skill has set sandbox assumptions, and it asks the agent to reply in Simplified Chinese by default.

Great for

  • CTF players working on sandboxed ZIP or PKZIP challenges with known file headers or templates
  • Security students learning why legacy ZipCrypto is weak against known-plaintext attacks

Skip it if

  • Real-world or non-competition archives: recovering keys from data you do not own or are not authorized to access is illegal or unethical, and the skill frames itself as CTF-only.
  • WinZip AES or other modern encryption: the skill itself says bkcrack does not work on these, so the path will stop.

Try asking

  • “Solve this encrypted ZIP challenge where flag.txt is encrypted and I have a known PNG header in known.zip”
  • “Inspect the ZipCrypto metadata of challenge.zip and list its entries with bkcrack”
  • “Recover the internal keys from a known file prefix and produce an unlocked archive”
Step-by-step guide: how to use CTF ZIP Archive SolverInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-zip-archive.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-zip-archive.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-zip-archive.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Install and activate the parent ctf-sandbox-orchestrator skill first; this skill will not be useful on its own.
  • Review the bootstrap scripts before running them, since they download and install tools and the skill runs them automatically.
  • Provide a known plaintext of at least 12 bytes with 8 contiguous bytes for the attack to succeed.

What's inside

  • agents/openai.yaml
  • references/zip-archive.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.