# Zipper

**Source**: Proving Grounds\
**OS**: Linux\
**Community Rating**: Very Hard

## **Enumeration & Reconnaissance**

* I started with the usual autorecon and found two open ports on the target:&#x20;
  * **SSH (22)**
  * **HTTP (80)**

## **Service Analysis**

* Browsing HTTP, I discovered a page with a file upload feature that lets you upload files and then download them as a zip archive. I played around with it, but without further clues, nothing really stood out.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FYfeeZ5N06CNBKFFnwOQI%2Fimage.png?alt=media&#x26;token=928372c2-c80d-45f9-a791-5c488c0027c0" alt="" width="563"><figcaption><p>Zipper Application</p></figcaption></figure>

* It wasn’t until I clicked the home link that I noticed a "file" parameter in the URL, an obvious hint of an LFI vulnerability. I tried including **/etc/passwd** immediately, but it wasn’t that easy. I suspected the application was appending `.php` to the filename, and even using a null byte (`%00`) didn’t bypass it.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FWpymJN6E8kKYdbnZMeiM%2Fimage.png?alt=media&#x26;token=bd38d25d-401c-4090-a2ff-60497fdc13de" alt="" width="375"><figcaption><p>The file Parameter</p></figcaption></figure>

## Gaining Initial Access

* Using the wrapper:

{% code overflow="wrap" fullWidth="true" %}
```php
php://filter/convert.base64-encode/resource
```
{% endcode %}

{% code overflow="wrap" fullWidth="true" %}
```html
192.168.201.229/index.php?file=php://filter/convert.base64-encode/resource=home
```
{% endcode %}

* Returned a base64-encoded version of the page. Decoding it revealed the source code and confirmed that `.php` was indeed being appended. With that confirmed, I uploaded a shell and, using the zip wrapper, executed:

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2F3kwTEceYAaiWhnE3UXAo%2Fimage.png?alt=media&#x26;token=35e88426-4d9d-432c-8f8f-056c4569dfed" alt="" width="563"><figcaption><p>Home Source Code</p></figcaption></figure>

```
192.168.201.229/index.php?file=zip://uploads/upload_1741612267.zip%23shell
```

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FetPufiqC7suPMQkKhVpV%2Fimage.png?alt=media&#x26;token=509f4f7e-f1d1-43d2-9121-507d563798ee" alt="" width="563"><figcaption><p>Reverse Shell</p></figcaption></figure>

## **Privilege Escalation**

* Once in, I ran linpeas.sh to check for privilege escalation vectors. Right away, I spotted a cron job that was running **backup.sh** every minute. Looking into the script, I found that it uses `7za` to zip files in the uploads directory, and its logs are saved to a file I can access.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2Fk1pteYthUFznNvijvRRO%2Fimage.png?alt=media&#x26;token=19c45b1a-5187-40c6-bb9b-b1a92f1bc16f" alt="" width="563"><figcaption><p>Cron Job</p></figcaption></figure>

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FsuISlWU9dYWMNRP07K3H%2Fimage.png?alt=media&#x26;token=94fcb3d2-313f-4fad-9cf5-e15157fd2be7" alt="" width="375"><figcaption><p>backup.sh</p></figcaption></figure>

* At first, I was stumped until I came across a neat trick from Hacktricks. The idea is simple: with `7za`, if you add `--` before the file list, it forces everything after to be treated strictly as file paths, not as options. This means if you can create files in the working directory, you can drop a marker file named **@root.txt** (telling 7za a file list is coming) along with a symlink called **root.txt** that points to the file you want to read. When 7za processes root.txt, it ends up reading the target file. Since the file content isn’t a valid list, 7za throws an error that ends up revealing the file’s content.
* OffSec had already set up an **enox.zip** that exposed the root password using this technique, but to practice, I created my own zip file (root.zip), linked it directly to the flag, and after waiting a minute, the log file revealed both the root password and the flag. Cool new technique.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FmFdcYPNXrnoeac6c0Vxc%2Fimage.png?alt=media&#x26;token=92e4257b-9769-41c0-86b7-a367efcd2306" alt="" width="375"><figcaption><p>enox.zip</p></figcaption></figure>

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2Fo9i340acs2XSE3SeTpKc%2Fimage.png?alt=media&#x26;token=23973739-cb9c-4126-9d32-3cab8fe75494" alt="" width="563"><figcaption><p>Flag &#x26; Root Password</p></figcaption></figure>

## **Lessons Learned**

* **Click Everywhere**: A seemingly innocuous “file” parameter can hide a serious vulnerability.
* **Check for LFI:** Wrappers like `php://filter` and `zip://` are useful for bypassing restrictions and revealing hidden code.
* **Cron Job Exploitation:** The insecure cron job the path to root.
* **7za Trick:** The 7za trick is a new technique that I learned and was crucial for privilege escalation.&#x20;
