Hacker Holidays – Day 10 – The Hollow Shell

Bybwright

Overview

Room: The Hollow Shell
Category: Web Security / Archive Extraction
Difficulty: Medium
Completed: August 5, 2026

The Hollow Shell demonstrates one of the most common archive extraction vulnerabilities: Zip Slip.

The vulnerable application allows authenticated staff members to upload a ZIP archive containing a “shell” theme for in-room tablets. During extraction, the application fails to validate archive entry paths, allowing files to be written outside of the intended destination directory.

The challenge highlights how seemingly harmless file uploads can become dangerous when archive contents are trusted.

Note

This walkthrough intentionally omits the challenge flag and does not include the complete exploitation chain.

Room Objectives

  • Enumerate the exposed web application
  • Identify authentication weaknesses
  • Confirm the presence of a Zip Slip vulnerability
  • Demonstrate arbitrary file write
  • Obtain shell access
  • Recover the challenge flag

Enumeration

The first step was a standard service scan.

nmap -sC -sV -p- <TARGET-IP>

The scan revealed:

PortService
22SSH
5000Flask / Gunicorn Web Application

Browsing to the application redirected to the login page.

Discovering Credentials

Before attempting brute force or guessing passwords, I inspected the page source.

Ctrl + U

An HTML comment contained default staff credentials left by the developers.

Using those credentials provided access to the Shoreline Display dashboard.

Exploring the Upload Feature

Inside the dashboard was a feature allowing users to upload a ZIP archive containing a shell theme.

A normal upload consisted of a simple manifest file.

Example:

{
  "name": "Beach Theme",
  "assets": []
}

Uploading a normal archive completed successfully.

Understanding Zip Slip

Zip Slip occurs when an application extracts archive entries without validating their paths.

For example, an archive entry such as:

../../example.txt

may escape the intended extraction directory.

Applications should always normalize paths and ensure every extracted file remains inside the destination folder.

Demonstrating the Vulnerability

To confirm the issue, I created a harmless proof-of-concept archive containing a file with a traversal path.

import zipfile

with zipfile.ZipFile("zipslip-test.zip", "w") as archive:
    archive.writestr(
        "../../test.txt",
        "Zip Slip Proof of Concept"
    )

The archive uploaded successfully without any validation errors.

This confirmed the application trusted filenames stored inside the ZIP archive.

Observations

The application:

  • accepted archive uploads
  • extracted files automatically
  • did not sanitize ../ directory traversal sequences
  • did not reject invalid archive paths

These behaviors confirmed an arbitrary file write vulnerability consistent with Zip Slip (CWE-22 / CWE-73).

Obtaining Initial Access

The challenge included an automation feature that processed uploaded shell packages after extraction.

By combining the arbitrary file write with this automated processing behavior, it was possible to obtain command execution as the application’s service account.

At that point, a shell was established on the target system.

For ethical reasons, the payload used to achieve code execution has been intentionally omitted.

Finding the Flag

After obtaining shell access, the challenge flag was located within the application’s working directory.

No privilege escalation was required.

The flag has been intentionally removed to avoid spoilers while the event remains active.

Vulnerability Analysis

Zip Slip vulnerabilities occur when archive extraction routines trust filenames embedded inside compressed files.

Instead of writing:

uploads/file.txt

an attacker supplies:

../../../../target/file.txt

If the application fails to validate the resolved path before writing the file, arbitrary locations on the filesystem may be modified.

When combined with scheduled jobs, startup scripts, plugins, or automation features, arbitrary file write can quickly become remote code execution.

Defensive Recommendations

Developers should always:

  • Normalize every extracted path.
  • Reject archive entries containing ../ traversal sequences.
  • Verify extracted paths remain inside the intended directory.
  • Disable automatic execution of uploaded content.
  • Remove default credentials before deployment.
  • Validate uploaded archives before extraction.
  • Run upload services using least-privilege accounts.

Key Takeaways

  • Never trust filenames stored inside ZIP archives.
  • Archive extraction should always enforce path validation.
  • File-write vulnerabilities often become far more severe when combined with automation.
  • Convenience features that automatically process uploaded files can dramatically increase risk.
  • Small configuration mistakes can chain together into complete system compromise.

References

  • CWE-22 – Path Traversal
  • CWE-73 – External Control of File Name or Path
  • OWASP File Upload Security Cheat Sheet
  • OWASP Path Traversal

https://tryhackme.com/room/hh-thehollowshell-ddb582ac

Similar Posts