Is it possible to reverse engineer ZIP file with password, and get the password or the data that is containing. I'm wondering because there is challenge in hacking lab which is to extract file from ZIP with passwd protection, and it's category is reverse engineering but when I look at the HEX dump I only see the file name.
Certain ZIP and ARJ archives can be unlocked and decrypted in just minutes, provided that you have at least one unprotected file from that archive at your discretion. It does not matter how long and complex the password is! If you have a file from the encrypted ZIP archive in your hands, the whole archive can be usually unlocked in minutes by applying the known-plaintext attack.
After carefully analyzing the algorithms and implementations of password protection in different versions of WinZip, ElcomSoft developed a work-around solution to allow quick guaranteed decryption of certain ZIP archives instead of performing lengthy attacks. If an encrypted ZIP archive was created with WinZip version 8 or earlier, and if the archive contains 5 or more files, Advanced Archive Password Recovery can unlock the archive and decrypt its content – guaranteed! A modern PC takes just under one hour to finish the job.
If this is a class competition, and it's filed under Reverse Engineering, the chances are the tutor has compiled this package themselves and has used techniques you've learnt in previous lessons to store the password somewhere within the executable.
Look back on the techniques you've already learnt, and try those.
Judging by the question I'll assume that you've not covered advanced Reverse Engineering techniques so the first place to start would be to view all the strings in the executable - provided no encryption is used, again I'm assuming not.
If you're using Windows you can use Sys Internals Strings (http://technet.microsoft.com/en-gb/sysinternals/bb897439.aspx). IDA Pro also allows you to do this.
Use a PE viewer to check whether it's a valid zip file created with WinZip, WinRar etc. It could have been created with a different program that contains a vulnerability to extract/crack the password.
Failing that, and not knowing the level of your experience or class the only option left is to brute force.