A better zip bomb • Hacker News Board

Re: A better zip bomb

#11

Post by tpetry » Thu, Jul 04, 2019, 9:40 AM UTC

sametmax wrote: post #10

moviuro wrote: post #5

Earlier quoted context omitted.

Put it wherever in a "secret.zip" file? If you have the logs, just add a dummy page that they usually scan (/wp-admin or whatever) that automatically makes the client download the file. SSH however works with zero trust. Clients are protected from bad servers just as servers are protected from bad clients. It shouldn't be possible to send a file. If it is, it is a serious ssh vulnerability.

It's not about downloading, it's about unzipping. Most bots won't unzip a file they download. But they will deflate a SSL packet.

That would be something new! A website crashing your browser because http or tls compression is sending „zip bombs“.

Re: A better zip bomb

#12

Post by WAHa_06x36 » Thu, Jul 04, 2019, 9:42 AM UTC

sametmax wrote: post #6

curiousgal wrote: post #4

Is there a way to automatically send this to SSH spammers/directory scanning bots?

SSH has some kind of compression, so if you can write a Twisted ssh server sending the file as a compressed ssh packed. For detection, fail2ban provides a plugin architecture that allows it to do any action once it noticed an abuse, so you could switch the regular ssh implementation with you tricky one on the fly. Fun project. One should also do a lua nginx plugin for that: aggressive crawler ? Comment spammer ? Take…

This file exploits the zip container format, not the actual compression algorithm. SSH only uses the latter, not the former, so it is not applicable.

Re: A better zip bomb

#13

Post by basgrootarch » Thu, Jul 04, 2019, 9:43 AM UTC

Great hack! It will take a long time before all installations everywhere are updated to check for such overlaps. This is a powerful weapon with many uses.

Re: A better zip bomb

#14

Post by WAHa_06x36 » Thu, Jul 04, 2019, 9:43 AM UTC

sametmax wrote: post #10

moviuro wrote: post #5

Earlier quoted context omitted.

Put it wherever in a "secret.zip" file? If you have the logs, just add a dummy page that they usually scan (/wp-admin or whatever) that automatically makes the client download the file. SSH however works with zero trust. Clients are protected from bad servers just as servers are protected from bad clients. It shouldn't be possible to send a file. If it is, it is a serious ssh vulnerability.

It's not about downloading, it's about unzipping. Most bots won't unzip a file they download. But they will deflate a SSL packet.

SSL packets do not use the zip container format which this targets, though. They only use the deflate compression algorithm.

Re: A better zip bomb

#15

Post by gitgud » Thu, Jul 04, 2019, 9:48 AM UTC

r1ch wrote: post #2

Pretty powerful! Lots of breakage with things that touch this file. Simply downloading it in Chrome caused issues, Chrome began extracting it to a temp folder (presumably for some malware scanning?) and quickly started filling the disk. Windows 10 then began doing the same thing for Windows Defender, but some sane limits aborted it after a few seconds.

Why would Chrome automatically begin unzipping the file?

I'm afraid to even download it now...

Re: A better zip bomb

#16

Post by kekebo » Thu, Jul 04, 2019, 9:49 AM UTC

tpetry wrote: post #11

sametmax wrote: post #10

Earlier quoted context omitted.

It's not about downloading, it's about unzipping. Most bots won't unzip a file they download. But they will deflate a SSL packet.

That would be something new! A website crashing your browser because http or tls compression is sending „zip bombs“.

Not sure if your post is sarcastic but if not it already exists: https://blog.haschek.at/tools/bomb.php

Usually aimed against bots though: https://hackaday.com/2017/07/08/dropping-zip-bombs-on-vulner...

Re: A better zip bomb

#17

Post by CTOSian » Thu, Jul 04, 2019, 9:52 AM UTC

lovely... its on my "collection" along with the "one square kilometer" pdf :

https://www.librarystack.org/one-square-kilometer-for-walter...

Re: A better zip bomb

#18

Post by zaarn » Thu, Jul 04, 2019, 10:02 AM UTC

sametmax wrote: post #6

curiousgal wrote: post #4

Is there a way to automatically send this to SSH spammers/directory scanning bots?

SSH has some kind of compression, so if you can write a Twisted ssh server sending the file as a compressed ssh packed. For detection, fail2ban provides a plugin architecture that allows it to do any action once it noticed an abuse, so you could switch the regular ssh implementation with you tricky one on the fly. Fun project. One should also do a lua nginx plugin for that: aggressive crawler ? Comment spammer ? Take…

You don't need a zip file; just send the other side a gzip response with an endless amount of '' inside. I've had some fun with that and some bots truly just stop responding after about 8 minutes of downloading div tags with no end.

Re: A better zip bomb

#19

Post by masklinn » Thu, Jul 04, 2019, 10:04 AM UTC

curiousgal wrote: post #4

Is there a way to automatically send this to SSH spammers/directory scanning bots?

This specifically exploits peculiarities of the PKZIP archival format (in combination with DEFLATE). SSH compression doesn't use zip, so unless the scanning bots also start downloading and processing / decompressing files they find on your honeypot, this is not going to apply (you can still use normal compression bombs to try and crash them: https://hackaday.com/2017/07/08/dropping-zip-bombs-on-vulner...)

Re: A better zip bomb

#20

Post by masklinn » Thu, Jul 04, 2019, 10:05 AM UTC

sametmax wrote: post #9

vbezhenar wrote: post #7

Earlier quoted context omitted.

Does it work with gzip?

Not sure, but let's see if I can try without crashing my laptop. EDIT: nope, steaming doesn't work, the zip relies on the fact it contains many files, and gzip assume there is only one big blog. EDIT 2: tried with zlib but it expects a different header. So my guess is you really need to open it as an archive.

gzip and zlib (and tar) are "streaming" formats, the essay notes that "streaming" zip libraries are not affected as this bomb exploits the relationship between the central directory and the individual files.