Bugzilla – Bug 12235
pwdb password not working on some zips
Last modified: 2019-02-06 11:36:19 EST
Created attachment 7490 [details] 7zip password as in example debug This is using ClamAV clamav-0.99.4 Create a test.pwdb test file: PWDB.Entry.1;Engine:81-255,Container:CL_TYPE_ZIP;0;infected Create zip with password infected: a.zip (using Info-ZIP) Create zip with password infected: b.zip (using 7zip) Clamscan --database=test.pwdb a.zip --debug LibClamAV debug: Recognized ZIP file LibClamAV debug: cache_check: 1cef62e51ab13662af840de8f19a2901 is negative LibClamAV debug: in cli_unzip LibClamAV debug: cli_unzip: central @3b5 LibClamAV debug: cli_unzip: ch - flags 9 - method 8 - csize 308 - usize 726 - flen a - elen 11 - clen 0 - disk 0 - off 0 LibClamAV debug: cli_unzip: ch - fname: index.html LibClamAV debug: cli_unzip: lh - ZMDNAME:1:index.html:1830:776:101693bc:8:1:1 LibClamAV debug: CDBNAME:CL_TYPE_ZIP:776:index.html:776:1830:1:1:269915068:00000000 LibClamAV debug: cli_unzip: lh - has data desc LibClamAV debug: cli_unzip: decrypt - (v20) >> 0x00006053 0x4d8b6053 (moddate) LibClamAV debug: cli_unzip: decrypt - password [PWDB.Entry.1] matches LibClamAV debug: cli_unzip: decrypt - decrypted 764 bytes to C:\DOCUME~1\steveb\LOCALS~1\Temp\clamav-6d9c4fa33da49b4765446c0bb3776300.tmp\zip.decrypt.000 LibClamAV debug: cli_unzip: extracted to C:\DOCUME~1\steveb\LOCALS~1\Temp\clamav-6d9c4fa33da49b4765446c0bb3776300.tmp\zip.000 LibClamAV debug: in cli_magic_scandesc (reclevel: 1/16) LibClamAV debug: Recognized ASCII text LibClamAV debug: Matched signature for file type HTML data at 167 So, as you can see the password matched fine. Clamscan --database=test.pwdb b.zip --debug LibClamAV debug: Recognized ZIP file LibClamAV debug: cache_check: 019bb0ac73ff5d6ce06403667c6d84dc is negative LibClamAV debug: in cli_unzip LibClamAV debug: cli_unzip: central @32a LibClamAV debug: cli_unzip: ch - flags 1 - method 8 - csize 302 - usize 726 - flen a - elen 24 - clen 0 - disk 0 - off 0 LibClamAV debug: cli_unzip: ch - fname: index.html LibClamAV debug: cli_unzip: lh - ZMDNAME:1:index.html:1830:770:101693bc:8:1:1 LibClamAV debug: CDBNAME:CL_TYPE_ZIP:770:index.html:770:1830:1:1:269915068:00000000 LibClamAV debug: cli_unzip: decrypt - (v20) >> 0x00001094 0x101693bc (crc32) LibClamAV debug: cli_unzip: decrypt - skipping encrypted file, no valid passwords LibClamAV debug: cli_unzip: ch - wrkcomplete LibClamAV debug: cli_unzip: lh - ZMDNAME:1:index.html:1830:770:101693bc:8:1:1 LibClamAV debug: CDBNAME:CL_TYPE_ZIP:770:index.html:770:1830:1:1:269915068:00000000 LibClamAV debug: cli_unzip: decrypt - (v20) >> 0x00001094 0x101693bc (crc32) LibClamAV debug: cli_unzip: decrypt - skipping encrypted file, no valid passwords LibClamAV debug: cli_unzip: lh - wrkcomplete LibClamAV debug: Matched signature for file type ZIP-SFX at 0 In the above case, no valid passwords are found... even though... the password is the same..... 7z e b.zip Enter password (will not be echoed): Everything is Ok Size: 1830 Compressed: 924 Documents: https://github.com/Cisco-Talos/clamav-devel/blob/288057e9d6b4938290d1c2134befc5d73ef71469/docs/UserManual/Signatures/EncryptedArchives.md
Created attachment 7491 [details] info zip password as in above example
Created attachment 7492 [details] test.pwdb as in example
Technical output of a.zip and b.zip 7-Zip 17.01 beta (x86) : Copyright (c) 1999-2017 Igor Pavlov : 2017-08-28 Scanning the drive for archives: 1 file, 1044 bytes (2 KiB) Listing archive: a.zip -- Path = a.zip Type = zip Physical Size = 1044 ---------- Path = index.html Folder = - Size = 1830 Packed Size = 776 Modified = 2018-12-11 12:02:38 Created = Accessed = Attributes = A Encrypted = + Comment = CRC = 101693BC Method = ZipCrypto Deflate Characteristics = 0x4453 UT : Encrypt Descriptor Host OS = FAT Version = 20 Volume Index = 0 Offset = 0 7-Zip 17.01 beta (x86) : Copyright (c) 1999-2017 Igor Pavlov : 2017-08-28 Scanning the drive for archives: 1 file, 924 bytes (1 KiB) Listing archive: b.zip -- Path = b.zip Type = zip Physical Size = 924 ---------- Path = index.html Folder = - Size = 1830 Packed Size = 770 Modified = 2018-12-11 12:02:38 Created = 2014-08-18 13:48:47 Accessed = 2018-04-30 10:57:28 Attributes = AI Encrypted = + Comment = CRC = 101693BC Method = ZipCrypto Deflate Characteristics = NTFS : Encrypt Host OS = FAT Version = 20 Volume Index = 0 Offset = 0
Arnaud also found issues with the .pwdb database late last October. There's good info in both tickets, so I'm marking this newer one as a duplicate. *** This bug has been marked as a duplicate of bug 12219 ***