index.md (2659B)
1 --- 2 title: "Zip Slip" 3 topic: "Zip Slip" 4 topicSlug: "zip-slip" 5 sourcePath: "Zip Slip/README.md" 6 sourceUrl: "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/3ac27901c711/Zip%20Slip/README.md" 7 sha: "3ac27901c711" 8 isReadme: true 9 --- 10 11 # Zip Slip 12 13 > The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../shell.php). The Zip Slip vulnerability can affect numerous archive formats, including tar, jar, war, cpio, apk, rar and 7z. The attacker can then overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine. 14 15 ## Summary 16 17 * [Tools](#tools) 18 * [Methodology](#methodology) 19 * [References](#references) 20 21 ## Tools 22 23 * [ptoomey3/evilarc](https://github.com/ptoomey3/evilarc) - Create tar/zip archives that can exploit directory traversal vulnerabilities 24 * [usdAG/slipit](https://github.com/usdAG/slipit) - Utility for creating ZipSlip archives 25 26 ## Methodology 27 28 The Zip Slip vulnerability is a critical security flaw that affects the handling of archive files, such as ZIP, TAR, or other compressed file formats. This vulnerability allows an attacker to write arbitrary files outside of the intended extraction directory, potentially overwriting critical system files, executing malicious code, or gaining unauthorized access to sensitive information. 29 30 **Example**: Suppose an attacker creates a ZIP file with the following structure: 31 32 ```ps1 33 malicious.zip 34 ├── ../../../../etc/passwd 35 ├── ../../../../usr/local/bin/malicious_script.sh 36 ``` 37 38 When a vulnerable application extracts `malicious.zip`, the files are written to `/etc/passwd` and /`usr/local/bin/malicious_script.sh` instead of being contained within the extraction directory. This can have severe consequences, such as corrupting system files or executing malicious scripts. 39 40 * Using [ptoomey3/evilarc](https://github.com/ptoomey3/evilarc): 41 42 ```python 43 python evilarc.py shell.php -o unix -f shell.zip -p var/www/html/ -d 15 44 ``` 45 46 * Creating a ZIP archive containing a symbolic link: 47 48 ```ps1 49 ln -s ../../../index.php symindex.txt 50 zip --symlinks test.zip symindex.txt 51 ``` 52 53 For a list of affected libraries and projects, visit [snyk/zip-slip-vulnerability](https://github.com/snyk/zip-slip-vulnerability) 54 55 ## References 56 57 * [Zip Slip - Snyk - June 5, 2018](https://web.archive.org/web/20260307012319/https://github.com/snyk/zip-slip-vulnerability) 58 * [Zip Slip Vulnerability - Snyk - April 15, 2018](https://web.archive.org/web/20180605125813/https://snyk.io/research/zip-slip-vulnerability)