biunzip
‘biunzip’ is a command-line tool from Binalyze specifically designed to extract zip files generated by the AIR Off-Network responder.
You can download the latest release of biunzip from the releases section on GitHub.
Biunzip will either unzip a single zip file, or unzip zip files in a directory using a CSV file.
This capability will allow running off-network investigation at scale, and at speed with minimum effort.
Below we walk through the process
1) Download biunzip from https://github.com/binalyze/biunzip/releases.
![](https://kb.binalyze.com/~gitbook/image?url=https%3A%2F%2F1662683669-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FnA8kGzryHKp7UhDaLtzW%252Fuploads%252Fbwzkk226YoKMkDHCm6a7%252Freleases.png%3Falt%3Dmedia%26token%3D0f59db29-7d9e-4d98-bd0a-631d6e6fb10d&width=768&dpr=4&quality=100&sign=7f76afa7&sv=1)
![](https://kb.binalyze.com/~gitbook/image?url=https%3A%2F%2F1662683669-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FnA8kGzryHKp7UhDaLtzW%252Fuploads%252FrPZbKNVOqtJOquBk4PYp%252Fdownloads.png%3Falt%3Dmedia%26token%3D6a51c8b3-9524-4a13-81a8-d6f605c48669&width=768&dpr=4&quality=100&sign=6dc01191&sv=1)
2) Import off-network zipped files to a machine with AIR console access and the biunzip utility:
![](https://kb.binalyze.com/~gitbook/image?url=https%3A%2F%2F1662683669-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FnA8kGzryHKp7UhDaLtzW%252Fuploads%252FzNJcAQWRTxQZqKUBr6Hl%252Foffwork_files.png%3Falt%3Dmedia%26token%3De1b33a59-2748-4795-9459-f18f73a290f0&width=768&dpr=4&quality=100&sign=92776f50&sv=1)
3) Import off-network files into AIR (with acquisition password if the files are encrypted):
![](https://kb.binalyze.com/~gitbook/image?url=https%3A%2F%2F1662683669-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FnA8kGzryHKp7UhDaLtzW%252Fuploads%252F7IceKIn3S6PYfpEmRzTI%252Fimport.png%3Falt%3Dmedia%26token%3D2b85d52a-2bb9-49f1-962f-61922457e122&width=768&dpr=4&quality=100&sign=5b4a4caf&sv=1)
4) Export the passwords:
![](https://kb.binalyze.com/~gitbook/image?url=https%3A%2F%2F1662683669-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FnA8kGzryHKp7UhDaLtzW%252Fuploads%252F3MkEDtaQ8ZJLWZUts6DG%252Fexport_passwords.png%3Falt%3Dmedia%26token%3D6d70c649-8d67-4c9e-b360-d6548824d5f7&width=768&dpr=4&quality=100&sign=8ac9fd25&sv=1)
5) View the exported passwords:
![](https://kb.binalyze.com/~gitbook/image?url=https%3A%2F%2F1662683669-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FnA8kGzryHKp7UhDaLtzW%252Fuploads%252FN45i6pIZSSPmCGOT0V4M%252Fzip_passwords.png%3Falt%3Dmedia%26token%3Df13d1085-c778-4638-839c-20fdcd6c5cab&width=768&dpr=4&quality=100&sign=3b931023&sv=1)
6) Run biunzip with the following flags and necessary flag values to unzip off-network files:
In this example, zip_dir_path points “C:\Users\roadrunner\Desktop\offnetwork_files” directory, csv_file_path points “C:\Users\roadrunner\Desktop\Off-Network-Zip-Passwords_3107231801.csv“ file
![](https://kb.binalyze.com/~gitbook/image?url=https%3A%2F%2F1662683669-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FnA8kGzryHKp7UhDaLtzW%252Fuploads%252F8sb5pYMhdvD6ROX3wjnY%252Fbiunzip.png%3Falt%3Dmedia%26token%3Dd074c696-7c02-4746-9ee8-74d1bd97a0a6&width=768&dpr=4&quality=100&sign=1b6d506f&sv=1)
7) Here we see the unlocked zip file alongside the original locked files:
![](https://kb.binalyze.com/~gitbook/image?url=https%3A%2F%2F1662683669-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FnA8kGzryHKp7UhDaLtzW%252Fuploads%252FvlsJfp5qWYt5mhXq0xUF%252Funzipped_files.png%3Falt%3Dmedia%26token%3D846da043-7985-4b59-9182-d51aefc84317&width=768&dpr=4&quality=100&sign=54396e58&sv=1)
Last updated