Cracking Encrypted ZIP Files with Python and Solving Memory Exhaustion

While cleaning an old computer, the author discovered an encrypted ZIP file with a forgotten six‑character alphanumeric password. Using Python's built‑in zipfile module, a simple script can extract a ZIP when the correct password is supplied.

import zipfile
# create file handle
file = zipfile.ZipFile("test.zip", 'r')
# extract with password (bytes)
file.extractall(path='.', pwd='123'.encode('utf-8'))

The next step was to brute‑force the password. A multithreaded script using ThreadPoolExecutor and itertools.permutations generated all six‑character combinations of digits and uppercase letters.

import zipfile
import itertools
from concurrent.futures import ThreadPoolExecutor

def extract(file, password):
    if not flag: return
    file.extractall(path='.', pwd=''.join(password).encode('utf-8'))

def result(f):
    exception = f.exception()
    if not exception:
        print('Password is:', f.pwd)
        global flag
        flag = False

if __name__ == '__main__':
    flag = True
    pool = ThreadPoolExecutor(100)
    nums = [str(i) for i in range(10)]
    chrs = [chr(i) for i in range(65, 91)]
    password_lst = itertools.permutations(nums + chrs, 6)
    zfile = zipfile.ZipFile("encrypted.zip", 'r')
    for pwd in password_lst:
        if not flag: break
        f = pool.submit(extract, zfile, pwd)
        f.pwd = pwd
        f.add_done_callback(result)

Running this code quickly filled memory because ThreadPoolExecutor uses an unbounded work queue; tasks were produced faster than they could be executed, causing the queue to grow without limit and memory usage to spike to 95 % before the process crashed.

To fix the problem, the author rewrote the executor to use a bounded queue by subclassing ThreadPoolExecutor and overriding its internal work queue.

import queue
from concurrent.futures import ThreadPoolExecutor

class BoundedThreadPoolExecutor(ThreadPoolExecutor):
    def __init__(self, max_workers=None, thread_name_prefix=''):
        super().__init__(max_workers, thread_name_prefix)
        self._work_queue = queue.Queue(self._max_workers * 2)  # set queue size

Replacing the original executor with BoundedThreadPoolExecutor prevented the memory overflow, and the password was eventually recovered, as shown in the final screenshot.