I have an installer/self-extracting archive. The executable file has an embedded ZIP archive into it (like many other installers). The ZIP archive is encrypted with a password.
The installer DOES NOT ask for a password in order to install, it just proceeds with the installation. The installer has an embedded encrypted archive in it, but if started by double-clicking the installer, no password is requested from the user.
Upon trying to "open" it with 7-Zip as an archive, bypassing the executable part of the file and just trying to open the ZIP archive part, it asks for a password. This question is NOT about bypassing or cracking the encryption, but about finding out an already available password/encryption key. Since the password/encryption key is embedded inside the executable, this encryption serves the purpose of obfuscation for the archived files and not for actual confidentiality.
How can I find that password? Since the installer is local and doesn't need an internet connection, the password must be in the .exe file and somehow passed as an argument to the ZIP decryption module.
Here are some similar examples of self-extracting without the user having to input the password themselves; my goal is to extract that password:
- Archive Sidestepping: Self-Unlocking Password-Protected RAR
- Attackers switch to self-extracting password-protected archives to distribute email malware
For reference and continuity:
stringson the installer to it. As the ZIP payload is encrypted you should more or less only get strings from the installer section.