I have a zip file that has a Powershell script inside that I want to look at. Is it possible that the Powershell script could execute automatically just by unzipping the file? This is not something I want to happen. Thank you!

  • 1
    You could, if you're paranoid, unpack it on a platform that lacks powershell... Like a linux live media. – vidarlo Sep 13 '19 at 17:50

Generally speaking, the answer is no. There's a risk that a malicious archive will exploit a bug in your archive software to open a file, but if your software has such a bug then attempting to execute a script is actually relatively safe, as there's lots of ways to block that (you'd have fewer options it if just ran an executable or took over the archive utility directly).

With that said, if you're feeling paranoid, here's a few things you could do:

  1. Set the execution policy in Powershell to "Restricted", which says "don't run scripts, period". It won't stop something like a CMD script invoking powershell with a malicious command, but it will stop an attempt to execute a .ps1 (or similar) file directly.
  2. Rename the file, before unpacking, using a hex editor. File names in ZIP archives are stored in plain text, uncompressed, and if you simply change a non-NULL character (rather than adding or removing any) then it'll still be a valid file afterward. Changing the extension will prevent attempts to launch the file using ShellExecute or similar, although it could still be explicitly passed to Powershell... but if the attacker has the ability to launch arbitrary programs directly then the PS script isn't going to be anything except a payload, and probably a simple one. Hex editors are simple enough that it's extremely unlikely they'd have a vulnerability that could be triggered by reading any file, no matter how malicious.
  3. Use a sandbox to unzip the file. For example, on Windows, there are multiple Zip unpacker apps in the Windows Store, most of which don't even have permissions to write to the file system without permission, much less launch a program. If one of them tries anyway, at worst you'll get a prompt asking you to confirm you want to open the file / launch the program.
  4. Use a system that has no Powershell available. On a Mac or Linux box, this just requires never having installed it. On Windows, this requires moving/renaming/deleting the executable, removing its Execute permission, or using the OS' built-in app restriction policies to prevent it from running. Note that any of these actions require Admin privileges as Powershell is installed in the system directory, may cause the OS to malfunction in the long term (some Windows Updates require a working Powershell, for example) so you should undo it afterward, and that on anything except 32-bit x86 Windows there may be multiple versions of Powershell installed using different architectures (for example, on my x86-64 machine, there's one in "System32" (the 64-bit one) and one in "SysWOW64" (the 32-bit one, in the "Windows-on-Windows64" system directory).
| improve this answer | |

Not under normal circumstances. I mean, if no malware is already running on your PC and you are using well known archiving apps (default windows zip, winzip, winrar, 7zip). But it is very easy to missclick and run it on your own ;)

| improve this answer | |
  • 1
    I don't think "well known" has anything to do with it. I think what you're really getting at is whether or not the zip application is secure. If you use a zip application that happens to have a vulnerability, and the zip archive is a malicious one designed to take advantage of said vulnerability, then it doesn't matter if the zip library is "well known". – Conor Mancone Sep 13 '19 at 20:24
  • If anything a well known app might make this (admittedly unlikely) attack slightly more likely since hackers don't usually bother targeting rarely used apps... Note that I'm not suggesting that therefore you use the least used app available... – Conor Mancone Sep 13 '19 at 20:26
  • I agree, but as far a I know there is no known vulnerability you describe in recent versions of "most known" apps and it never happened to me something got executed automatically when I've used them (or I didn't notice? :)) – Fis Sep 13 '19 at 20:40
  • Ups, actually, there is one threatpost.com/… – Fis Sep 13 '19 at 20:43
  • I agree - I think the risk here is very small, and I'm sure it has never happened to you or just about anyone here. However, that wasn't my point. My point is that just because something is "Well known" doesn't mean it is safe. In fact, well known sometimes mean less safe, because it is more targeted. As a result "well known" is simply a red herring that distracts from the underlying issue, and may give people "confidence" in the wrong thing. – Conor Mancone Sep 13 '19 at 20:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.