Forensicsmedium
Broken Envelope
by Pavel Knespl (capyplivl)
A ZIP archive (archive.zip) whose End of Central Directory (EOCD) record is missing. The file ends right after the two central-directory headers (PK\x01\x02) with no PK\x05\x06 EOCD, so unzip/zipinfo refuse to read it. The local file data is intact, so the files recover once the EOCD is rebuilt. One file holds a base64 tag with the flag.
Solve
- Confirm the damage.
unzip -l archive.zipreports "End-of-central-directory signature not found", and a hexdump shows two PK\x01\x02 central-directory entries but no trailing PK\x05\x06:
xxd archive.zip | tail -8
- Quick path: 7z reads the local headers directly and pulls both files out despite the error:
7z x archive.zip
Robust path matching the hint (rebuild the EOCD, then standard unzip works). Save as rebuild_eocd.py:
#!/usr/bin/env python3
import struct
data = bytearray(open("archive.zip", "rb").read())
cd_start = data.find(b"PK\x01\x02")
count, pos = 0, cd_start
while pos < len(data) and data[pos:pos+4] == b"PK\x01\x02":
count += 1
n = struct.unpack_from("<H", data, pos + 28)[0]
m = struct.unpack_from("<H", data, pos + 30)[0]
k = struct.unpack_from("<H", data, pos + 32)[0]
pos += 46 + n + m + k
cd_size = pos - cd_start
eocd = struct.pack("<IHHHHIIH", 0x06054b50, 0, 0, count, count, cd_size, cd_start, 0)
open("fixed.zip", "wb").write(bytes(data[:pos]) + eocd)
print(f"{count} entries, cd at {cd_start}, size {cd_size}; wrote fixed.zip")
python3 rebuild_eocd.py
unzip fixed.zip -d out
- Either path recovers
readme.txtandproject_dispatch.txt. The dispatch file holds a tag value:
U1ZJVVNDR3tibHVlbW91bnRhaW5femlwX2VvY2RfcmVidWlsZH0=
- Decode it:
echo U1ZJVVNDR3tibHVlbW91bnRhaW5femlwX2VvY2RfcmVidWlsZH0= | base64 -d
Flag: SVIUSCG{bluemountain_zip_eocd_rebuild}