0

Using compression utilities, is it possible to create an archive that when extracted, will place certain files in certain areas on a users PC?

For example, suppose if I wrote a virus or a malicious script, store it in a folder with other files, and zip that folder. When the user extracts the files to the provided location, they're unaware that the virus or malicious script is being copied to a system folder or somewhere deep in the C: drive.

In other words, is it possible to trick compression utilities to extract files to a location not specified by the user?

How would you minimize the damage that can done?

I'm far from being an expert, but it would seem sensible not to extract anything under an Admin level account.

  • Basically like this but for Windows? I imagine the directory traversal vulnerability mentioned could be relevant depending on the software you use to extract the files. – AndrolGenhald Dec 5 '18 at 17:19
  • @AndrolGenhald - Yeah, exactly. Should have searched harder to see if there were any similar questions. – user192946 Dec 5 '18 at 17:23
1

is it possible to trick compression utilities to extract files to a location not specified by the user?

Yes, it's possible. And is a know problem with a catchy name: Zip Slip. It depends on the particular implementation of your extraction utility: how the extraction routine parses the destination file name.

If your unzip utility is outdated, you can be affected. On Windows, if you extract the files on D: instead of C: you should not be affected.

  • Okay, but to take it a little further, suppose if I provide the utility with D: as the destination, could I trick the utility into extract certain files in the background, no GUI, no indication that a second extract is taking place, to the C: drive? – user192946 Dec 5 '18 at 17:26
  • No, because D:\..\..\..\Windows\System, for example, would not be a valid path. – ThoriumBR Dec 5 '18 at 17:30
  • It's certainly not limited to zip either. I recall an issue like that in tar as well. – forest Dec 6 '18 at 2:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy