58 lines
4.2 KiB
Plaintext
58 lines
4.2 KiB
Plaintext
|
Episode: 3183
|
||
|
|
Title: HPR3183: Don't trust zipfiles
|
||
|
|
Source: https://hub.hackerpublicradio.org/ccdn.php?filename=/eps/hpr3183/hpr3183.mp3
|
||
|
|
Transcribed: 2025-10-24 18:21:59
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
This is Hacker Public Radio Episode 3183 for Wednesday, 14 October 2020. Today's show is entitled,
|
||
|
|
Don't Trust Zipfiles
|
||
|
|
and is part of the series' Privacy and Security. It is hosted by Cedric DeVroey
|
||
|
|
and is about five minutes long
|
||
|
|
and carries a clean flag. The summary is,
|
||
|
|
Zipfiles can contain all kinds of evilness and unpacking them can lead to unexpected results.
|
||
|
|
This episode of HPR is brought to you by An Honesthost.com. Get 15% discount on all shared hosting
|
||
|
|
with the offer code HPR15. That's HPR15.
|
||
|
|
Better web hosting that's Honest and Fair at An Honesthost.com
|
||
|
|
.
|
||
|
|
.
|
||
|
|
.
|
||
|
|
Hello Hacker's around the world. My name is Cedric and I'm here again with another story
|
||
|
|
on ventesting and cybersecurity straight from the trenches. This time I'm going to talk about
|
||
|
|
a hack we did fairly recently actually today. I said straight from the trenches.
|
||
|
|
What happened is that we owned our clients' entire system by a full source disclosure
|
||
|
|
as we call this. What happened? We found the vulnerability in their web application, a fairly serious one.
|
||
|
|
And I'm going to explain about the technicalities.
|
||
|
|
So what actually happened in this web application?
|
||
|
|
You have a function to upload files and not just any files, it accepts Zipfiles
|
||
|
|
and it allows you to unzip those files on the server.
|
||
|
|
Now what a lot of people don't know about is that on Linux you have this concept of symbolic links.
|
||
|
|
And symbolic links are actually like Windows shortcuts. They point to another file.
|
||
|
|
Now what a lot of people don't know is that you can actually put these symbolic links in a zip file.
|
||
|
|
They will not, the zip file won't contain the actual file, it will contain the reference, the link to the file.
|
||
|
|
So you already see this coming. What you can do is create a link to dot dot slash dot dot slash dot dot slash dot dot slash dot dot
|
||
|
|
dot dot. Do this 100 times if you want slash ETC slash password, which contains your entire login register.
|
||
|
|
So that's what I did. I created a simlink to the ETC password file with some directory traversal injected.
|
||
|
|
Then I zipped this simlink and I uploaded this zip file to our target.
|
||
|
|
And since our target had a function to unzip file, I did that.
|
||
|
|
And guess what happened? If I clicked the unzipped file link, yes, you understand.
|
||
|
|
I downloaded it. Our clients ETC password containing all their logins.
|
||
|
|
So what did we learn? Don't trust zip files. Don't just trust any zip files.
|
||
|
|
You always need to check each and every file in there for threats.
|
||
|
|
And one of those threats is actually sim linking to other files on your system, especially in the context of a web application.
|
||
|
|
Thanks for listening. I hope you enjoyed. If you want to reach out to me, you can.
|
||
|
|
I'm on Twitter, LinkedIn and Facebook. And you can use the comment sections on hacker public grade video.
|
||
|
|
I also want to thank some people, the people from all wasp, the great organizations that bundles all kinds of knowledge on pen testing and cybersecurity and also develops a whole bunch of tools,
|
||
|
|
especially the all wasp set attack proxy. That's such a great tool.
|
||
|
|
If you think perpsuite is not your thing, especially the license, then all wasp set attack proxy.
|
||
|
|
It's a man in the middle proxy. We use it all the time. It's great. It's fantastic software. It really works very well.
|
||
|
|
And I also want to thank the people from Odacity who actually create a software with which I record this podcast.
|
||
|
|
Thanks for listening. See you next time. Bye!
|
||
|
|
You've been listening to hacker public radio at hackerpublicradio.org.
|
||
|
|
We are a community podcast network that releases shows every weekday Monday through Friday.
|
||
|
|
Today's show, like all our shows, was contributed by an hbr listener like yourself.
|
||
|
|
If you ever thought of recording a podcast, then click on our contribute link to find out how easy it really is.
|
||
|
|
Hacker public radio was founded by the digital dog pound and the infonomicon computer club and is part of the binary revolution at binrev.com.
|
||
|
|
If you have comments on today's show, please email the host directly, leave a comment on the website or record a follow-up episode yourself.
|
||
|
|
Today's show is released under creative comments, attribution, share a like, 3.0 license.
|