fkie-cad / fact_extractor

Standalone Utility for FACT-like extraction
GNU General Public License v3.0
80 stars 31 forks source link

7z plugin password detection produces false positives and false negatives #133

Closed eclipsotic closed 2 months ago

eclipsotic commented 2 months ago

I have an idea on how to fix this that I'm going to push soon, but here are the details of the problem.

This is the code that determines if a password was required to unpack the archive:

        if 'Wrong password' not in output:
            if 'AES' in output:
                meta['password'] = password
            break

if 'AES' in output is the source of both the false positives and false negatives.

False Positives

On my machine, AES is in all outputs of 7z because these lines are always at the top:

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,4 CPUs Intel(R) Core(TM) i7-10875H CPU @ 2.30GHz (A0652),ASM,AES-NI)

False Negatives

If 7z extracts an encrypted zip, there is nothing in the output to indicate that the archive required a password (unlike when an encrypted 7zip file is extracted). Here's some example output:

$ 7z x -ppassword archive.zip 

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,4 CPUs Intel(R) Core(TM) i7-10875H CPU @ 2.30GHz (A0652),ASM,AES-NI)

Scanning the drive for archives:
1 file, 433 bytes (1 KiB)

Extracting archive: archive.zip
--
Path = archive.zip
Type = zip
Physical Size = 433

Everything is Ok

Folders: 2
Files: 1
Size:       3
Compressed: 433