A better zip bomb
bamsoftware.com
A better zip bomb
1–10 of 138 posts
Re: A better zip bomb
#2Pretty powerful! Lots of breakage with things that touch this file. Simply downloading it in Chrome caused issues, Chrome began extracting it to a temp folder (presumably for some malware scanning?) and quickly started filling the disk.
Windows 10 then began doing the same thing for Windows Defender, but some sane limits aborted it after a few seconds.
Re: A better zip bomb
#3Just don’t go posting about this on YouTube!
Re: A better zip bomb
#4Is there a way to automatically send this to SSH spammers/directory scanning bots?
Re: A better zip bomb
#5Is there a way to automatically send this to SSH spammers/directory scanning bots?
Put it wherever in a "secret.zip" file? If you have the logs, just add a dummy page that they usually scan (/wp-admin or whatever) that automatically makes the client download the file.
SSH however works with zero trust. Clients are protected from bad servers just as servers are protected from bad clients. It shouldn't be possible to send a file. If it is, it is a serious ssh vulnerability.
Re: A better zip bomb
#6Is there a way to automatically send this to SSH spammers/directory scanning bots?
SSH has some kind of compression, so if you can write a Twisted ssh server sending the file as a compressed ssh packed. For detection, fail2ban provides a plugin architecture that allows it to do any action once it noticed an abuse, so you could switch the regular ssh implementation with you tricky one on the fly.
Fun project.
One should also do a lua nginx plugin for that: aggressive crawler ? Comment spammer ? Take this nice gzip HTTP response...
Re: A better zip bomb
#7Is there a way to automatically send this to SSH spammers/directory scanning bots?
SSH has some kind of compression, so if you can write a Twisted ssh server sending the file as a compressed ssh packed. For detection, fail2ban provides a plugin architecture that allows it to do any action once it noticed an abuse, so you could switch the regular ssh implementation with you tricky one on the fly. Fun project. One should also do a lua nginx plugin for that: aggressive crawler ? Comment spammer ? Take…
Does it work with gzip?
Re: A better zip bomb
#8Nice. Decades age we used zip bombs to destroy BBSes that were not well protected.
Re: A better zip bomb
#9Earlier quoted context omitted.
SSH has some kind of compression, so if you can write a Twisted ssh server sending the file as a compressed ssh packed. For detection, fail2ban provides a plugin architecture that allows it to do any action once it noticed an abuse, so you could switch the regular ssh implementation with you tricky one on the fly. Fun project. One should also do a lua nginx plugin for that: aggressive crawler ? Comment spammer ? Take…
Does it work with gzip?
Not sure, but let's see if I can try without crashing my laptop.
EDIT: nope, steaming doesn't work, the zip relies on the fact it contains many files, and gzip assume there is only one big blog.
EDIT 2: tried with zlib but it expects a different header. So my guess is you really need to open it as an archive.
Re: A better zip bomb
#10Is there a way to automatically send this to SSH spammers/directory scanning bots?
Put it wherever in a "secret.zip" file? If you have the logs, just add a dummy page that they usually scan (/wp-admin or whatever) that automatically makes the client download the file. SSH however works with zero trust. Clients are protected from bad servers just as servers are protected from bad clients. It shouldn't be possible to send a file. If it is, it is a serious ssh vulnerability.
It's not about downloading, it's about unzipping.
Most bots won't unzip a file they download.
But they will deflate a SSL packet.