Endpoint Encryption

Greetings,

I'm working on automating a nightly process that our technicians spend two hours on every day. The process begins with receipt of a Self Decrypting Archive file. Our technicians rename the file with a .EXE file extension. Afterward they run the .EXE file and are prompted for a passphrase. After the passphrase is supplied the decrypted file is created in the same directory that the .EXE is in.

The issue I'm finding is that it's not possible to, using the PGP Command Line software (or GPG, or traditional PGP software), automate the process of decrypting the file. When trying to do so with command line syntax it results with an error indicating that the .EXE does not contain PGP data.

I've read some brief comments about a workaround which involves parsing the EXE headers and extracting the encrypted data that way, but sadly that is outside of my wheelhouse.

Is this something that anyone else has dealt with before?

Thank you for your time.

From page 63 of the PGP Command Line user guide:

--list-sda
Lists the contents of a Self-Decrypting Archive (SDA). The entire SDA needs to be
decrypted in order to list its contents, which could take up to several minutes
(depending on the number and size of the files in the archive).
The usage format is:
pgp --list-sda <input> --passphrase <pass>
Where:
<input> is an SDA file, such as reports.exe. Output is always the standard output.
<pass> This is a passphrase or symmetric passphrase with which the SDA was
encrypted.
Example:
pgp --list-sda reports.exe --symmetric-passphrase "B0bsm1t4"
reports\
reports\README.rtf
reports\README.txt
reports\report.txt
reports.exe:list SDA (0:SDA decoded successfully)
The archive "reports.exe" was decrypted and listed.

Self-decrypting archives do not decode, they extract.  The command --list-sda causes the extraction and listing process of the files from the encrypted container.

Hello Mike,

Thank you very much for the prompt and informative response! Regrettably when I try the --list-sda option on the file the client has sent over it returns:

test.exe:list SDA <1085:invalid SDA>

In light of this I created a new SDA on my local machine and stepped through the process again, and it worked without issue.

The problem appears to be that perhaps my client is not creating the SDA using PGP, but I'm not sure what other software is available for the creation of SDAs - not that I expect you to have that answer. Sadly the client isn't being very helpful in getting clarification on how exactly the automated process creates the SDA on their side - it sounds like it's a legacy process that was configured years and years ago that no one knows anything about....and it's working fine now, and has been for all these years...so getting any additional information on the subject has been like pulling teeth.

At any rate I'll make your answer as the solution to this problem. Thanks again for your assistance!

Edit: Mike appears to have removed his response, though it's not clear to me why. I'm copying/pasting the pertinent information from the PGP Command Line user guide below for future reference to others that may happen upon this topic.

--list-sda
Lists the contents of a Self-Decrypting Archive (SDA). The entire SDA needs to be
decrypted in order to list its contents, which could take up to several minutes
(depending on the number and size of the files in the archive).
The usage format is:
pgp --list-sda <input> --passphrase <pass>
Where:
<input> is an SDA file, such as reports.exe. Output is always the standard output.
<pass> This is a passphrase or symmetric passphrase with which the SDA was
encrypted.
Example:
pgp --list-sda reports.exe --symmetric-passphrase "B0bsm1t4"
reports\
reports\README.rtf
reports\README.txt
reports\report.txt
reports.exe:list SDA (0:SDA decoded successfully)
The archive "reports.exe" was decrypted and listed.

I went to edit the response and got a call.  I had everything selected, and somehow managed to delete it when I hit save.  I'm going to call it a computer glitch!

Editing the post back to original, as I have it saved on a notepad.  Sorry for the confusion. 

I believe GPG can encrypt an SDA (and I am sure other products can as well), but depending on the version, we may not have the same ciphers and/or compression support, which could cause some issues.