On Sun, Aug 10, 2025 at 05:04:24PM -0700, lunbun wrote: > If a symlink targets a nonexistent directory, the write will fail. 7-Zip by > default will print an error message, like: > ``` > ERROR: Cannot open output file : errno=2 : No such file or directory : ./ > malicious_link/file.txt > ``` > > This applies similarly to other filesystem errors, like insufficient > permissions or unwritable directory. > > However, 7-Zip by default continues with extraction regardless of the error, > which is why an attacker can use this "shotgun" strategy. These errors, > though, > would hopefully help notify the user that something suspicious is happening. Never forget terminal escape codes. At least the 7-Zip my debian has dumps the raw filename in those error messages. This allows an attacker to clean the specific error lines after they have been output (with another, later filename containing the required escapes).
With some fantasy, it might also be possible to massage the overwrite prompts (they're also unescaped) into suggesting to choose "(A)lways", e.g. by good cursor movement and setting a scroll region far above for the real prompt. Regards, Drahflow
signature.asc
Description: PGP signature
