0

I have this multiple-part zip files as a list of {File.zip.001, File.zip.002, ..., File.zip.013} that happen to be protected by password.

When I try to unzip them using the Gnome GUI, I see click on the first file and can see everything inside of the archive. When it comes to extracting one or more of the contained files, the GUI asks me for a password which I don't have.

I tried to run zip2john on the first file of the archive, and an error appeared:

Did not find End Of Central Directory

I understand that this is because the archive is split, so I tried to merge it, first using cat:

cat File.zip.* > reassembled-zip.zip

Which results in a single .zip file, that still outputs the same error with zip2john.

Then using zip -FF:

Fix archive (-FF) - salvage what can
    zip warning: Missing end (EOCDR) signature - either this archive
                     is not readable or the end is damaged
Is this a single-disk archive?  (y/n): n
Scanning for entries...
    zip warning: unexpected signature 50 4b 08 0e on disk 0 at 28163216

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 05 0a on disk 0 at 36958289

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 06 05 on disk 0 at 38360085

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 05 0b on disk 1 at 4113854

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 05 07 on disk 1 at 37794272

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 0d 0c on disk 2 at 13988149

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 08 0b on disk 2 at 32540580

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 08 0f on disk 3 at 22252597

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 07 03 on disk 3 at 43159328

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 02 03 on disk 3 at 46197775

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 0e 09 on disk 3 at 46912538

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 0d 0e on disk 4 at 18365613

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 01 0d on disk 4 at 30660201

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 03 06 on disk 4 at 51561479

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 06 09 on disk 5 at 21609562

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 0d 0f on disk 5 at 33684577

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 0d 0f on disk 6 at 26918306

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 05 05 on disk 6 at 35119054

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 0a 0d on disk 6 at 40757891

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 02 05 on disk 6 at 50151081

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 0d 05 on disk 7 at 41068997

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 05 00 on disk 8 at 18797631

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 0b 0e on disk 8 at 32933431

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 0c 01 on disk 9 at 5171745

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 01 0b on disk 9 at 25825684

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 00 0e on disk 9 at 37006392

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 0e 01 on disk 9 at 37687530

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 0b 02 on disk 9 at 46914268

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 07 03 on disk 10 at 38971848

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 0a 02 on disk 11 at 26959546

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 02 0e on disk 11 at 37013657

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 01 0f on disk 11 at 52166748

    zip warning: skipping this signature...
    zip warning: unexpected signature 50 4b 0c 0d on disk 12 at 9048933

    zip warning: skipping this signature...


Could not find:
  Study.zip.z14

Hit c      (change path to where this split file is)
    s      (skip this split)
    q      (abort archive - quit)
    e      (end this archive - no more splits)
    z      (look for .zip split - the last split)
 or ENTER  (try reading this split again): e
    zip warning: user ended reading - closing archive
    zip warning: zip file empty

for which I had to rename the files in File.zip.z01 instead of File.zip.001 in order for it to work, and whose output was an empty zip file.

I think that the zip files are not broken, because the Gnome GUI tool has no trouble reading into the archive. But how can I bypass the password of the archive if john cannot process a multipart archive ?

2
  • What you have is a multi-part ZIP archive not a ZIP archive that has been split into multiple files (you can see that by the unexpected signature which indicates that each file has a ZIP header). Have you tried to open the main ZIP and it's parts e.g. into 7-Zip UI, just to see if it is able to correctly read the central directory?
    – Robert
    Commented May 11, 2023 at 15:57
  • Hello @Robert thank you for your response. I tried to open the first zip in the Gnome gui manager, and it worked well, but I couldn't extract the files because of the password. So I think that the files are not broken.
    – Louis
    Commented May 12, 2023 at 16:09

0

You must log in to answer this question.

Browse other questions tagged .