3

I have a zip archive that is password protected in linux(the password is "secret"). However, whenever I try to open the zip file I am not prompted for a password or anything. I also have a python script that extracts zip archives and purposely passes an incorrect password and it still unzips the archive anyway. I am not running as root either as I heard root likes to ignore file permissions. Is there anything I am doing wrong?

I zipped my folder "evil" into a zip file "evil.zip" and gave it a password by using the command:

zip --pasword secret -r evil.zip evil

The python script unzip.py reads:

import zipfile
zFile = zipfile.ZipFile("evil.zip")
zFile.extractall(pwd="oranges")

I am running Kali Linux 1.0.9 and Zip (v. 3.0)

I also tried to use the encrypt command instead of password:

zip --encrypt -r evil.zip evil

That prompted me for a password at which I set it to secret.

I ended up with the message:

Traceback (mostrecent call last) :
 File "unzip.py", line 3, in <module>
  zFile.extractall(pwd="oranges")
 File "/usr/lib/python2.7/unzip.py", line 980, in extractall
  self.extract(zipinfo, path, pwd)
 File "/usr/lib/python2.7/unzip.py", line 968, in extract
  return self._extract_member(member, path, pwd)
 File "/usr/lib/python2.7/unzip.py", line 1011, in _extract_member
  source = self.open(member, pwd=pwd)
 File "/usr/lib/python2.7/unzip.py", line 952, in open
  raise RuntimeError("Bad password for file", name)
RuntimeError: ('Bad password for file', <zipfile.ZipInfo object at 0x23a0118>)

And then the folder still unzips.

  • May be you need to use -e flag to enable encryption: zip --pasword secret -er evil.zip evil – kirill-a Jan 14 '15 at 10:56
  • It doesn't work for me: RuntimeError: ('Bad password for file', <zipfile.ZipInfo object at 0xb71f926c>) – Arkadiusz Drabczyk Jan 14 '15 at 13:00
  • Well, as I said some hours ago, this is specific to your distro/software version. It works absolutely fine for me with zip --encrypt -r evil.zip evil. If I try to unpack it with unzip, it's asking for password. If I try the same with python (3) it works fine with the right password and I get the same message as Arkadiusz if I give a wrong password, e.g. zFile.extractall(pwd=b"oranges") (it does create an empty directory evil but that's all). – don_crissti Jan 14 '15 at 20:56
2

It's the files in the archive that are encrypted and password protected, not the directory structure. This means that you will be able to extract tho directories from the archive even though it's encrypted (but not the files).

To encrypt the archive in a way so that this is not possible, I'd suggest using something like GnuPG instead.

-2

At a guess, it's because you're running Kali. That distro was designed to 'get around' security features (with the legitimate purpose of highlighting flaws in security). I don't think you'd encounter this 'error' in any other distro.

  • "Get around security features" by shipping a broken zip utility? – Kusalananda Aug 1 '18 at 12:06
  • 1
    This answer is completely incorrect. You can't simply bypass zip encryption via a modified zip binary (if you could, the encryption would be worthless). – Joseph Sible Oct 19 '18 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.