0

I have a problem. I have the service which is giving me .exe file which they claim is in fact zip archive. A self-extracting archive. Problem is that I am downloading that with my app (php) to server and need to extract it there witout downloading to local computer. I have tried download .exe file to local computer - it is self extracting on windows to /temp dir and than self launching FLASH player.

$zip = zip_open($myfile); gives in print_r($zip): 1 zip->open gives no results either. change .exe to .zip doesn't let winzip or other kind of un-packer on windows to open it - .exe cannot be opened by winzip too.

Now I have no idea how to deal with it. If anybody can advise please.

user936600
  • 1
  • 1
  • Sorrry - one misleading fact - server is linux. – user936600 Jun 28 '11 at 09:41
  • and I trust content - it is just some flash session packed for download - so I am not worried about any 'security' – user936600 Jun 28 '11 at 09:42
  • sorted, file generated was not 'zip'. it just took a while to figure that out. I am just still not sure howto extract self extart zip. Anyway THANK you ALL for help. – user936600 Jul 06 '11 at 05:15

4 Answers4

2

Try to execute the program as an executable with the system command

Tudor Constantin
  • 26,330
  • 7
  • 49
  • 72
  • 1
    +1 Since it's an .exe file, you cannot just feed it to zip, the decompressor won't know what to do with the PE header and the binary. In fact, it will look at the first bytes and find that they are "MZ" rather than "PK" and will bail out. Obviously, running an executable is not without security issues. Having said that, you should be able to load the file into a string and search for `0x50 0x4B 0x03 0x00`, which marks the beginning of the actual ZIP data assuming the claim "it is ZIP" is correct (and not LZMA or something else). Feed the data _beginning_ there to the zip decompressor. – Damon Jun 28 '11 at 09:29
  • I have opened it in Notepad++ and found sentence inside: "This program cannot be run in DOS mode." File starts with 'MZ' characters. – user936600 Jun 28 '11 at 10:00
1

Executing files from an external source you don't trust 100% is never a good idea.

The info-zip version of zip allows you to remove the SFX stub from a self-extracting zip file (with the -J flag) converting it back into a normal zip file.

Source code is freely available.

Making a self-extracting zip file is a matter of prepending a zip file with the SFX binary code, then appending the size of the binary stub to the resulting file - but I'm not sure how the data is represented - but a bit of reverse-engineering the available code should make this clear.

symcbean
  • 47,736
  • 6
  • 59
  • 94
0

Well... if your PHP server is Windows you shouldn't have a problem doing it as a system command. Otherwise, it's a little more tricky. I hear that the unzip system command will unzip self-extracting zip files, but I don't have access to a Linux box at the moment to try it out.

If you're on shared hosting, chances are you can't do it.

Nathan MacInnes
  • 11,033
  • 4
  • 35
  • 50
  • actually I am on shared hosting, and spent all day trying to figure out how to do it :/ – user936600 Jun 28 '11 at 09:43
  • Well there are a few things you need to find out from your hosting company: what OS is the server (Windows/Linux)? If it's Windows, can you run exes as system commands? (doubtful they'd allow that) If Linux, can you run unzip as a system command? – Nathan MacInnes Jun 28 '11 at 09:46
  • Its Bluehost, Architecture x86_64, Operating system linux. I will try 'unzip' when possible as it went down now. – user936600 Jun 28 '11 at 09:55
0

Well if you think after executing the exe file, it will extract its content, then you can use exec function to run the .exe files like the one below:

exec("d:\\example\\php\_exe\\1436.exe");

and also you can use system function to run external programs as well.

And also if you wonder what's the difference:

PHP - exec() vs system() vs passthru()

Community
  • 1
  • 1
Tarik
  • 79,711
  • 83
  • 236
  • 349