# ZipExec | A Unique Technique To Execute Binaries From A Password Protected Zip

**URL:** <https://onehack.st/t/zipexec-a-unique-technique-to-execute-binaries-from-a-password-protected-zip/208384>\
**Category:** Tools & Scripts\
**Tags:** tools, privacy\
**Created:** [December 1, 2021, 9:48am UTC](https://onehack.st/t/zipexec-a-unique-technique-to-execute-binaries-from-a-password-protected-zip/208384 "2021-12-01T09:48:36Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [December 1, 2021, 9:48am UTC](https://onehack.st/t/zipexec-a-unique-technique-to-execute-binaries-from-a-password-protected-zip/208384/1 "2021-12-01T09:48:36Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/f/9/f92f2db80d8984a8f72916737a171ff3898fbff8.png)

ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file. This zip file is then base64 encoded into a string that is rebuilt on disk. This encoded string is then loaded into a JScript file that when executed, would rebuild the password-protected zip file on disk and execute it. This is done programmatically by using COM objects to access the GUI-based functions in Windows via the generated JScript loader, executing the loader inside the password-protected zip without having to unzip it first. By password protecting the zip file, it protects the binary from EDRs and disk-based or anti-malware scanning mechanisms.

[![](https://camo.githubusercontent.com/c9b2b4933f179f620796ff00a6d23bbbe7b7c55dbceb5b79be20eb933dda5d2e/68747470733a2f2f6d656469612e67697068792e636f6d2f6d656469612f596b6d347870354e6e4d6c7a396f684a62432f67697068792e676966)](https://camo.githubusercontent.com/c9b2b4933f179f620796ff00a6d23bbbe7b7c55dbceb5b79be20eb933dda5d2e/68747470733a2f2f6d656469612e67697068792e636f6d2f6d656469612f596b6d347870354e6e4d6c7a396f684a62432f67697068792e676966)

## Installation

The first step as always is to clone the repo. Before you compile ZipExec you’ll need to install the dependencies. To install them, run following commands:

```auto
go get github.com/yeka/zip

```

Then build it

```auto
go build ZipExec.go

```

or

`go get github.com/Tylous/ZipExec`

## Help

```auto
./ZipExec -h

__________.__  ___________                     
\ ____/|__ | _____\______ / _____  ________  
  / / | \ ____\|__ )_\ \/ // __\_/___ \ 
 / /_ | | |_> > \> <\ ___/\ \___ 
/ _______\|__ | __/_______ / __/\_ \\___ >\___ >
        \/ |__| \/ \/ \/ \/ 
                (@Tyl0us)

Usage of ./ZipExec:
  -I string
        Path to the file containing binary to zip.
  -O string
        Name of output file (e.g. loader.js)
  -sandbox
        Enables sandbox evasion using IsDomainedJoined.

```

## GitHub:

> **[GitHub - Tylous/ZipExec: A unique technique to execute binaries from a...](https://github.com/Tylous/ZipExec)**
>
> A unique technique to execute binaries from a password protected zip