hatching / sflock

Sample staging & detonation utility to be used in combination with Cuckoo Sandbox.
82 stars 46 forks source link

zipjail 0.5.2 problem with 7z #49

Closed doomedraven closed 4 years ago

doomedraven commented 4 years ago

7z itself can extract it, not sure what is wrong here, any idea @jbremer ? sample 9fa28e86c4754d254e22551ed76f2b6771873b4d64c82dc932902bc87c2398f3

/usr/local/lib/python3.8/dist-packages/sflock/data/zipjail.elf -h
zipjail 0.5.2 - safe unpacking of potentially unsafe archives.
Copyright (C) 2016-2018, Jurriaan Bremer <jbr@hatching.io>.
Copyright (C) 2018-2019, Hatching B.V.
Based on Tracy by Merlijn Wajer and Bas Weelinck.
    (https://github.com/MerlijnWajer/tracy)

$ /usr/local/lib/python3.8/dist-packages/sflock/data/zipjail.elf guloader /tmp/tmpadhipzsh -v -- /usr/bin/7z x -mmt=off -o/tmp/tmpadhipzsh guloader
openat(/etc/ld.so.cache)
openat(/lib/x86_64-linux-gnu/libc.so.6)
openat(/usr/bin/7z)
openat(/etc/ld.so.cache)
openat(/lib/x86_64-linux-gnu/libpthread.so.0)
openat(/lib/x86_64-linux-gnu/libdl.so.2)
openat(/usr/lib/x86_64-linux-gnu/libstdc++.so.6)
openat(/lib/x86_64-linux-gnu/libgcc_s.so.1)
openat(/lib/x86_64-linux-gnu/libc.so.6)
openat(/lib/x86_64-linux-gnu/libm.so.6)
openat(/usr/lib/locale/locale-archive)
openat(/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache)

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
openat(/sys/devices/system/cpu)
p7zip Version 16.02 (locale=es_ES.UTF-8,Utf16=on,HugeFiles=on,64 bits,4 CPUs Intel(R) Xeon(R) CPU E3-1225 v3 @ 3.20GHz (306C3),ASM,AES-NI)

openat(/usr/lib/p7zip/7z.so)
openat(/usr/lib/p7zip/Codecs)
openat(/usr/lib/p7zip/Codecs/Rar.so)
openat(/usr/lib/p7zip/Formats)
openat(/usr/lib/p7zip/Formats)
Scanning the drive for archives:
  0M Scanopenat(.)
1 file, 28860 bytes (29 KiB)
openat(.)
openat(.)

Extracting archive: guloader
openat(/home/X)
openat(guloader)
--
Path = guloader
Type = 7z
Physical Size = 28860
Headers Size = 154
Method = LZMA2:17 BCJ
Solid = -
Blocks = 1

mkdir(/tmp/tmpadhipzsh)
mkdir(/tmp/tmpadhipzsh)
  0%clone(0x3d0f00, ...)
Killing child 36940
7z l guloader

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=es_ES.UTF-8,Utf16=on,HugeFiles=on,64 bits,4 CPUs Intel(R) Xeon(R) CPU E3-1225 v3 @ 3.20GHz (306C3),ASM,AES-NI)

Scanning the drive for archives:
1 file, 28860 bytes (29 KiB)

Listing archive: guloader

--
Path = guloader
Type = 7z
Physical Size = 28860
Headers Size = 154
Method = LZMA2:17 BCJ
Solid = -
Blocks = 1

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2020-05-26 01:33:36 ....A       122880        28706  China Post 1292883.exe
------------------- ----- ------------ ------------  ------------------------
2020-05-26 01:33:36             122880        28706  1 files
doomedraven commented 4 years ago

-c=1thanks Jurrian