On 8/10/25 19:04, lunbun wrote:
> What does 7-Zip do if the symlink implies a nonexistent directory?
> (Example: attack targeting ~/.ssh/authorized_keys is unpacked in
> ~/Downloads/foo/bar and unpacks a symlink to /proc/self/cwd/../../.ssh
> which maps to ~/Downloads/.ssh which probably does not exist.)
If a symlink targets a nonexistent directory, the write will fail.
7-Zip by default will print an error message, like:
```
ERROR: Cannot open output file : errno=2 : No such file or directory :
./malicious_link/file.txt
```
This applies similarly to other filesystem errors, like insufficient
permissions or unwritable directory.
However, 7-Zip by default continues with extraction regardless of the
error, which is why an attacker can use this "shotgun" strategy. These
errors, though, would hopefully help notify the user that something
suspicious is happening.
This at least prevents this from being a "silent" attack in all but the
most targeted scenarios---and in those cases, the attacker probably
already has another way in.
[...]
> Can the malicious link be silently replaced or does extracting a
> malicious archive leave links to every directory that the attack hit?
> (That could at least make cleaning out the attack relatively
> straightforward.)
I could be wrong, but I don't think there is any way for an attacker
to silently remove or replace a malicious link.
If the link cannot be overwritten (another entry in the fake archive
with the same name?), then there are immediate indications pointing to
everything the attacker planted.
Thank you for answering all of my questions.
I don't know what the general policy is for releasing exploit PoCs
after a patch is released. If it is okay, I can post one on this
thread (publicly) so you can play around with it.
At the original announcement, you had basically released a PoC, there
would be only a matter of programming to generate malicious fake archives.
-- Jacob
