0

Using compression utilities, is it possible to create an archive that when extracted, will place certain files in certain areas on a users PC?

For example, suppose if I wrote a virus or a malicious script, store it in a folder with other files, and zip that folder. When the user extracts the files to the provided location, they're unaware that the virus or malicious script is being copied to a system folder or somewhere deep in the C: drive.

In other words, is it possible to trick compression utilities to extract files to a location not specified by the user?

How would you minimize the damage that can done?

I'm far from being an expert, but it would seem sensible not to extract anything under an Admin level account.

Improve this question
2
  • Basically like this but for Windows? I imagine the directory traversal vulnerability mentioned could be relevant depending on the software you use to extract the files.
    – AndrolGenhald
    Dec 5, 2018 at 17:19
  • @AndrolGenhald - Yeah, exactly. Should have searched harder to see if there were any similar questions.
    – user192946
    Dec 5, 2018 at 17:23

1 Answer 1

Reset to default
1

is it possible to trick compression utilities to extract files to a location not specified by the user?

Yes, it's possible. And is a know problem with a catchy name: Zip Slip. It depends on the particular implementation of your extraction utility: how the extraction routine parses the destination file name.

If your unzip utility is outdated, you can be affected. On Windows, if you extract the files on D: instead of C: you should not be affected.

Improve this answer
3
  • Okay, but to take it a little further, suppose if I provide the utility with D: as the destination, could I trick the utility into extract certain files in the background, no GUI, no indication that a second extract is taking place, to the C: drive?
    – user192946
    Dec 5, 2018 at 17:26
  • No, because D:\..\..\..\Windows\System, for example, would not be a valid path.
    – ThoriumBR
    Dec 5, 2018 at 17:30
  • It's certainly not limited to zip either. I recall an issue like that in tar as well.
    – forest
    Dec 6, 2018 at 2:14

You must log in to answer this question.