{"id":508,"date":"2025-09-12T12:15:41","date_gmt":"2025-09-12T10:15:41","guid":{"rendered":"https:\/\/bergee.it\/blog\/?p=508"},"modified":"2026-04-27T22:18:25","modified_gmt":"2026-04-27T20:18:25","slug":"how-two-dollars-and-one-zip-file-let-me-read-the-server-files","status":"publish","type":"post","link":"https:\/\/bergee.it\/blog\/how-two-dollars-and-one-zip-file-let-me-read-the-server-files\/","title":{"rendered":"How two dollars and one zip file let me read the server files"},"content":{"rendered":"

Hi there<\/p>\n

There was an app which allowed me to buy domains and offered different types of hosting. First I was testing the free features of the app and found really cool XSS bug but it is the different story :). Then I decided to invest some money and bought the domain, let’s call it mynewshinydomain.com, which costed me about 2 dollars. I took this financial risk \ud83d\ude42<\/p>\n

Once I bought it, I immediately gained access to tons of new features. And one of them was feature where I could upload or create files and dirs via web interface. I could only host static files such as .css, .html, .js, .txt, no scripts. But this isn’t important. There was also the option to upload the zip file, which later was extracted into the root of my site. As I am familiar with basic zip attacks such as zip-slip attack nad symlink attack, I tried both of them, but only the second one worked.<\/p>\n

The zip symlink attack<\/h3>\n

In this attack we must zip the file which is symbolic link. The symbolic link is a kind of shortcut, it points to another file on file system. I created the test.txt file pointing to \/etc\/passwd\u00a0 on my system in WSL shell:<\/p>\n

$\u00a0 ln -s \/etc\/passwd test.txt<\/p><\/blockquote>\n

Then I zipped the file into test.zip<\/p>\n

$ zip –symlinks test.zip test.txt<\/p><\/blockquote>\n

Note the –symlinks option to preserve the symlinks. I uploaded the file , I saw no errors, so I entered this url:<\/p>\n

https:\/\/mynewshinydomain.com\/test.txt<\/p><\/blockquote>\n

Wait, what? I could not believe I saw the content of \/etc\/passwd from the server. It worked just like this, no filters. So I obtained arbitrary file read, I could read files on server where web user has access to.<\/p>\n

\"\"<\/p>\n

I immedietaly reported it as critical finding and after short time I got P1 and some cash :). They introduced the fix which I tried to bypass with binary editing of zip file but failed :\/. My mistake was to report it right away, because I could maybe read some source code of an app and this way was able to find more vulns. On the other hand the attack is not complicated, so I was afraid of being duplicated and the emotions took over.<\/p>\n

The final notes<\/h3>\n
    \n
  1. Sometimes it pays off to spend some money which gives access to more features to test.<\/li>\n
  2. Let’s not assume anything upfront, even the pretty simple\u00a0 attacks might still work.<\/li>\n<\/ol>\n

     <\/p>\n

    Impact: High
    \nReward: $750<\/p>\n

    See you next bug<\/p>\n","protected":false},"excerpt":{"rendered":"

    Hi there There was an app which allowed me to buy domains and offered different types of hosting. First I was testing the free features of the app and found really cool XSS bug but it is the different story :). Then I decided to invest some money and bought the domain, let’s call it…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[29,47],"tags":[],"class_list":["post-508","post","type-post","status-publish","format-standard","hentry","category-write-up","category-zip-symlink"],"_links":{"self":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts\/508","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/comments?post=508"}],"version-history":[{"count":8,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts\/508\/revisions"}],"predecessor-version":[{"id":538,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts\/508\/revisions\/538"}],"wp:attachment":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/media?parent=508"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/categories?post=508"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/tags?post=508"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}