Unable to extract files from .intunewin
allexb opened this issue · 7 comments
When I download intunewin file from azure I cannot extract it.
ERROR: End of Central Directory record could not be found.
Oh interesting... can you share some more details...
Did you get more than this error message?
Oh interesting... can you share some more details...
Did you get more than this error message?
No, only this message in console. Is there any other logs in system for your tool?
Okay from my research it looks like the zip archive is corrupt or it is not a valid archive, not correctly downloaded... So how did you get the .intunewin, via log file parsing and explicit download?
Using powershell sciprt
https://github.com/allexb/POC_Download_Intunewin
hmmm okay Nickolaj's script, that is working... How did you get the encryption information? By parsing the IME logs? The downloaded .intunwin is encrypted and you normally get the encryption key and IV only by parsing the Intune IME log... If yes, then you called my IntuneDecoder with the path to the encrypted .intunwin and provided the key and iv by parameter?
Oh, I missed this part. So I need logs from Intune client to get encryption key, am I right?
Found Key and IV. No problem now.