Blind Path Discovery & Reverse Shell Deployment Tool for zip slip

A security research tool for discovering writable/executable paths through ZIP file upload vulnerabilities and deploying reverse shells.

Overview

This tool demonstrates a technique for discovering writable/executable paths on a target system through a ZIP file upload vulnerability with directory traversal, and subsequently deploying reverse shells to those discovered paths. It uses multiple callback methods to confirm successful payload execution.

** DISCLAIMER**: This tool is intended for authorized security testing and educational purposes only. Use only on systems you own or have explicit permission to test. Unauthorized use may violate laws and regulations.

Features

• Blind Path Discovery: Probes target systems for writable paths using callback mechanisms
• Multi-Method Callback Detection: HTTP callbacks, raw socket connections, and DNS exfiltration via nip.io
• Time-Based Detection: Identifies execution through response time analysis
• Automated Reverse Shell Deployment: Automatically uploads reverse shells to discovered paths
• Customizable Ports: Flexible configuration for callback and shell ports
• Real-Time Feedback: Live updates when writable paths are discovered
• Retry Mechanism: Automatic retry for reliable shell connections

How It Works

Phase 1: Path Discovery

1. Creates a ZIP file with a payload designed to write to a specific path
2. Uploads the ZIP through the vulnerable endpoint
3. The payload executes and attempts to call back via HTTP, TCP, and DNS
4. A listener catches callbacks and confirms writable paths

Phase 2: Reverse Shell Deployment

1. Creates a reverse shell payload for discovered paths
2. Uploads through the same vulnerability
3. Payload connects back with a fully interactive PTY shell
4. 5 retry attempts ensure reliable connection

Detection Methods

• Callback Detection: Listener catches inbound connections from payloads
• Time-Based Detection: Unusual response times indicate script execution

🚀 Quick Start

# Clone the repository
git clone https://github.com/yourusername/blind-path-discovery.git
cd blind-path-discovery

# Start your listener (in another terminal)
nc -lvnp 4444

# Run the exploit
python exploit.py