Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
MAL-009 — MAL-009: Insecure Chaining of Flags T and TT in Zip for Linux | Kitploit
Tools/GitHubGitHub/mbadanoiu/mal-009
Privilege EscalationVulnerability AnalysisExploitationLearning & EducationCurated ResourcesBinary Exploitation
GitHubmbadanoiu/mal-009

MAL-009

MAL-009: Insecure Chaining of Flags T and TT in Zip for Linux

View Repository
21 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

MAL-009: Insecure Chaining of Flags T and TT in Zip for Linux

In Zip for Linux, the “-TT” flag can be used to run arbitrary system commands. Due to the dangerous nature of this flag, it must always be used at the same time as the “-T” flag. By using a flag chaining attack, attackers that should only be able to insert just one flag in a zip command can insert both the “-T” and “-TT” flags and potentially execute malicious code.

Proof Of Concept:

More details and the exploitation process can be found in this PDF.

Example of potentially vulnerable application can be found in this python code.

Additional Resources:

This case study came to mind after exploiting CVE-2020-8248: Privilege Escalation via Zip Wildcard Exploit in Pulse Secure VPN Linux Client as I was curious if the command execution via Zip could be achived with just 1 file instead of 2.

Bug ticket concerning this vulnerability opened on bugs.launchpad.net on 18-Feb-2021

Other examples of Zip for Linux Flag Chaining leading to RCE:

  • https://sonarsource.github.io/argument-injection-vectors/binaries/zip/
  • Multiple vulnerabilities in Dell Unisphere for PowerMax vApp, VASA Provider vApp and Solutions Enabler vApp CVE-2022-45103 / CVE-2022-45104
  • elFinder - A Case Study of Web File Manager Vulnerabilities
Download Tool