> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-11/offline-cracking/archive/trick-0586.md).

# Access Password-Protected Zip Cracked Pass

***

When you find a password-protected zip archive, you can attempt to extract its contents using a password obtained from other sources, such as a previously cracked user password.

Locate the archive (e.g., `/home/gege/wordpress.old.zip`) and use `unzip`.

```bash
unzip wordpress.old.zip
```

The `unzip` tool will prompt you to enter the password. Alternatively, you can provide the password directly on the command line using the `-P` option.

```bash
unzip -P password filename.zip
```

or

```bash
unzip -P your_password your_zip_file.zip
```

Provide the password you cracked or found (in this case, the password cracked for the `gege` user). If the password is correct, the files will be extracted. (This particular archive contained `wp-config.php`, which held credentials for user `xavi`).

The `wp-config.php` file typically contains the database connection settings, including the database name, username, password, and host. These are defined as PHP constants. For example, the database password is often stored in the `DB_PASSWORD` constant.

To programmatically access these credentials, you can include the `wp-config.php` file in a PHP script.

```php
<?php
define('ABSPATH', dirname(__FILE__) . '/'); // Define ABSPATH if not already defined
require_once(ABSPATH . 'wp-config.php');

// Now you can access the constants defined in wp-config.php
echo DB_NAME;
echo DB_USER;
echo DB_PASSWORD;
echo DB_HOST;
?>
```

This script defines `ABSPATH` (which is sometimes necessary for `wp-config.php` to load correctly if run outside the WordPress root) and then includes the configuration file, making the defined constants like `DB_PASSWORD` available.