Can a PowerShell script inside a Zip file execute automatically upon unzipping?

Question

I have a zip file that has a Powershell script inside that I want to look at. Is it possible that the Powershell script could execute automatically just by unzipping the file? This is not something I want to happen. Thank you!

Answer 1

Generally speaking, the answer is no. There's a risk that a malicious archive will exploit a bug in your archive software to open a file, but if your software has such a bug then attempting to execute a script is actually relatively safe, as there's lots of ways to block that (you'd have fewer options it if just ran an executable or took over the archive utility directly).

With that said, if you're feeling paranoid, here's a few things you could do:

1. Set the execution policy in Powershell to "Restricted", which says "don't run scripts, period". It won't stop something like a CMD script invoking powershell with a malicious command, but it will stop an attempt to execute a .ps1 (or similar) file directly.
2. Rename the file, before unpacking, using a hex editor. File names in ZIP archives are stored in plain text, uncompressed, and if you simply change a non-NULL character (rather than adding or removing any) then it'll still be a valid file afterward. Changing the extension will prevent attempts to launch the file using ShellExecute or similar, although it could still be explicitly passed to Powershell... but if the attacker has the ability to launch arbitrary programs directly then the PS script isn't going to be anything except a payload, and probably a simple one. Hex editors are simple enough that it's extremely unlikely they'd have a vulnerability that could be triggered by reading any file, no matter how malicious.
3. Use a sandbox to unzip the file. For example, on Windows, there are multiple Zip unpacker apps in the Windows Store, most of which don't even have permissions to write to the file system without permission, much less launch a program. If one of them tries anyway, at worst you'll get a prompt asking you to confirm you want to open the file / launch the program.
4. Use a system that has no Powershell available. On a Mac or Linux box, this just requires never having installed it. On Windows, this requires moving/renaming/deleting the executable, removing its Execute permission, or using the OS' built-in app restriction policies to prevent it from running. Note that any of these actions require Admin privileges as Powershell is installed in the system directory, may cause the OS to malfunction in the long term (some Windows Updates require a working Powershell, for example) so you should undo it afterward, and that on anything except 32-bit x86 Windows there may be multiple versions of Powershell installed using different architectures (for example, on my x86-64 machine, there's one in "System32" (the 64-bit one) and one in "SysWOW64" (the 32-bit one, in the "Windows-on-Windows64" system directory).

Answer 2

Not under normal circumstances. I mean, if no malware is already running on your PC and you are using well known archiving apps (default windows zip, winzip, winrar, 7zip). But it is very easy to missclick and run it on your own ;)