Yes I've read forums that says Forward Slash (/) is invalid character in a file name since it being File Separator in Windows and *nix based machines. But Without creating such an exploit file, I think attacks like ZipSlip won't be possible, Isn't it?

Most Zip Slip attacks involve creating an File with a slash character and when languages like Java use File IO with ZipEntry name, writes to some directory other than intended. So how is this possible?

Ref : https://snyk.io/research/zip-slip-vulnerability


The key is in the first line of the third paragraph of the page you reference:

The vulnerability is exploited using a specially crafted archive...

You don't create a file with a slash in it (and then put that file into an archive), but you create an archive that says it has a file with a slash in it (so when it is extracted it "confuses" the extractor/operating system and creates a file where it shouldn't).

Depending on the nature of an archive, and its internal format, creating an archive could conceivably be as easy as binary-editing an existing archive (e.g. changing SafeNamedFile.sh to ../../../evil.sh), but is more likely to need altering the source code of the archive-creation utility to embed what would normally be an illegal filename.

  • I get it. My question is more about such _craft_ing technique to create such a file payload. Can you guide towards some utilities i can start looking at and if needed to modify source to create one? – Subramanian May 2 '20 at 11:06
  • Sorry, no. If you want to craft such an attack, you'll have to do the work.yourself. – TripeHound May 2 '20 at 11:20
  • @Subramanian there are easily findable scripts/MSF modules from the same authors, I believe. – multithr3at3d May 2 '20 at 17:22
  • I do think this answer properly answers the question as currently phrased. – multithr3at3d May 2 '20 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.