Closed robert-scheck closed 6 years ago
I can bypass MacroMilter by using nested ZIP files, example:
zipwithinfectedandnotinfectedword.zip
zip nested.zip zipwithinfectedandnotinfectedword.zip
nested.zip
2017-10-07 03:38:17,729 - DEBUG: connect from localhost at ('::1', 52922, 0, 0) 2017-10-07 03:38:17,779 - DEBUG: [3] Content-type: 'multipart/mixed' 2017-10-07 03:38:17,779 - DEBUG: [3] Content-type: 'text/plain' 2017-10-07 03:38:17,779 - DEBUG: [3] Analyzing attachment None 2017-10-07 03:38:17,779 - DEBUG: [3] Content-type: 'application/zip' 2017-10-07 03:38:17,779 - DEBUG: [3] Analyzing attachment 'nested.zip' 2017-10-07 03:38:17,779 - DEBUG: Find Attachment with archive extension - File name: nested.zip 2017-10-07 03:38:17,779 - INFO: File in zip detected! Name: zipwithinfectedandnotinfectedword.zip - check for VBA 2017-10-07 03:38:17,780 - DEBUG: The attachment 'nested.zip' is clean.
I initially wanted to test an archive bomb, however this poorly failed. In case the observed behaviour is a bug and gets fixed, please avoid to get vulnerable to archive bombs (by adding max. nesting limits).
Under development and implemented in testing branch. Fixed:
Successfully verified with 3.4.3:
I can bypass MacroMilter by using nested ZIP files, example:
zipwithinfectedandnotinfectedword.zip
will be detected as maliciouszip nested.zip zipwithinfectedandnotinfectedword.zip
nested.zip
will not be detected as maliciousI initially wanted to test an archive bomb, however this poorly failed. In case the observed behaviour is a bug and gets fixed, please avoid to get vulnerable to archive bombs (by adding max. nesting limits).