https://github.com/Tylous/ZipExec

A unique technique to execute binaries from a password protected zip
https://github.com/Tylous/ZipExec

Last synced: about 2 months ago
JSON representation

A unique technique to execute binaries from a password protected zip

• Host: GitHub
• URL: https://github.com/Tylous/ZipExec
• Owner: Tylous
• License: mit
• Created: 2021-10-19T21:03:44.000Z (almost 3 years ago)
• Default Branch: main
• Last Pushed: 2022-07-01T16:25:26.000Z (about 2 years ago)
• Last Synced: 2024-06-20T14:22:31.873Z (3 months ago)
• Language: Go
• Size: 1.12 MB
• Stars: 996
• Watchers: 23
• Forks: 156
• Open Issues: 3
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome - Tylous/ZipExec - A unique technique to execute binaries from a password protected zip (Go)
• awesome-hacking-lists - Tylous/ZipExec - A unique technique to execute binaries from a password protected zip (Go)

README

        
# ZipExec

ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file. This zip file is then base64 encoded into a string that is rebuilt on disk. This encoded string is then loaded into a JScript file that when executed, would rebuild the password-protected zip file on disk and execute it. This is done programmatically by using COM objects to access the GUI-based functions in Windows via the generated JScript loader, executing the loader inside the password-protected zip without having to unzip it first. By password protecting the zip file, it protects the binary from EDRs and disk-based or anti-malware scanning mechanisms.



## Installation

The first step as always is to clone the repo. Before you compile ZipExec you'll need to install the dependencies. To install them, run following commands:

```

go get github.com/yeka/zip

```

Then build it

```

go build ZipExec.go

``` 

  

 or 

  

```

go install github.com/Tylous/ZipExec@latest

```

## Help

```

./ZipExec -h

__________.__      ___________                     

\____    /|__|_____\_   _____/__  ___ ____   ____  

  /     / |  \____ \|    __)_\  \/  // __ \_/ ___\ 

 /     /_ |  |  |_> >        \>    <\  ___/\  \___ 

/_______ \|__|   __/_______  /__/\_ \\___  >\___  >

        \/   |__|          \/      \/    \/     \/ 

                (@Tyl0us)

Usage of ./ZipExec:

  -I string

        Path to the file containing binary to zip.

  -O string

        Name of output file (e.g. loader.js)

  -sandbox

        Enables sandbox evasion using IsDomainedJoined.

```