0

Yes I've read forums that says Forward Slash (/) is invalid character in a file name since it being File Separator in Windows and *nix based machines. But Without creating such an exploit file, I think attacks like ZipSlip won't be possible, Isn't it?

Most Zip Slip attacks involve creating an File with a slash character and when languages like Java use File IO with ZipEntry name, writes to some directory other than intended. So how is this possible?

Ref : https://snyk.io/research/zip-slip-vulnerability

1 Answer 1

2

The key is in the first line of the third paragraph of the page you reference:

The vulnerability is exploited using a specially crafted archive...

You don't create a file with a slash in it (and then put that file into an archive), but you create an archive that says it has a file with a slash in it (so when it is extracted it "confuses" the extractor/operating system and creates a file where it shouldn't).

Depending on the nature of an archive, and its internal format, creating an archive could conceivably be as easy as binary-editing an existing archive (e.g. changing SafeNamedFile.sh to ../../../evil.sh), but is more likely to need altering the source code of the archive-creation utility to embed what would normally be an illegal filename.

4
  • I get it. My question is more about such _craft_ing technique to create such a file payload. Can you guide towards some utilities i can start looking at and if needed to modify source to create one?
    – user154
    May 2, 2020 at 11:06
  • Sorry, no. If you want to craft such an attack, you'll have to do the work.yourself.
    – TripeHound
    May 2, 2020 at 11:20
  • @Subramanian there are easily findable scripts/MSF modules from the same authors, I believe. May 2, 2020 at 17:22
  • I do think this answer properly answers the question as currently phrased. May 2, 2020 at 17:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .