Author Topic: ZIP to PHP converter (Read 54874 times)

scancode · « **on:** January 05, 2010, 04:17 AM »

This is a small application that converts a ZIP file into a self-extracting PHP file. Simply upload it to your webserver, call it once, then delete it.

Requested by icekin on teh IRC channel.

housetier · « **Reply #1 on:** January 05, 2010, 06:45 AM »

This is a very cool idea! Can it cope with tarballs (.tar or .tar.gz) as well?

gjehle · « **Reply #2 on:** January 05, 2010, 06:45 AM »

you, sir, are awesome.
this is simply ingenious.

f0dder · « **Reply #3 on:** January 05, 2010, 09:15 AM »

But what's the point?

Are there hosts which allow you to run PHP scripts but don't give FTP access? And don't allow .zip files from web-based upload forms? O_o

scancode · « **Reply #4 on:** January 05, 2010, 10:01 AM »

This is a very cool idea! Can it cope with tarballs (.tar or .tar.gz) as well?
-housetier (January 05, 2010, 06:45 AM)

Not yet, mebbe I should add it.

you, sir, are awesome.
this is simply ingenious.
-gjehle (January 05, 2010, 06:45 AM)

Thanks.

But what's the point?

Are there hosts which allow you to run PHP scripts but don't give FTP access? And don't allow .zip files from web-based upload forms? O_o
-f0dder (January 05, 2010, 09:15 AM)

The problem is not uploading the zips, but unzipping them server-side.
Uploading a crapload of small files takes ages over FTP.

f0dder · « **Reply #5 on:** January 05, 2010, 01:01 PM »

But what's the point?

Are there hosts which allow you to run PHP scripts but don't give FTP access? And don't allow .zip files from web-based upload forms? O_o
-f0dder (January 05, 2010, 09:15 AM)

The problem is not uploading the zips, but unzipping them server-side.
Uploading a crapload of small files takes ages over FTP.
-scancode (January 05, 2010, 10:01 AM)

Ooooh, duh! - I thought self-extracting meant "generate .zip output". Facepalm, more coffee to me - this could be pretty darn useful when you don't have shell support

Deozaan · « **Reply #6 on:** January 05, 2010, 06:11 PM »

That looks pretty awesome!

Stoic Joker · « **Reply #7 on:** January 05, 2010, 06:24 PM »

Any chance that could be done with .asp also (e.g. zip2asp)?

Tuxman · « **Reply #8 on:** January 05, 2010, 07:35 PM »

Now I needed this a few weeks ago.

Maybe it could be useful on next Wordpress update... thank you!

Deozaan · « **Reply #9 on:** January 05, 2010, 08:41 PM »

Any chance you can do this with exe too?

Just kidding.

Again, awesome utility here.

scancode · « **Reply #10 on:** January 05, 2010, 08:59 PM »

Any chance you can do this with exe too? Just kidding.

Again, awesome utility here.
-Deozaan (January 05, 2010, 08:41 PM)

EXE: use your favourite archiver. WinRAR, WinZIP, WinACE, 7Zip all do SFXs
As soon as I get ASP to work there will be an ASP version (will prolly involve two files instead of one tho)

Deozaan · « **Reply #11 on:** January 05, 2010, 09:04 PM »

Any chance you can do this with exe too? Just kidding.

Again, awesome utility here.
-Deozaan (January 05, 2010, 08:41 PM)

EXE: use your favourite archiver. WinRAR, WinZIP, WinACE, 7Zip all do SFXs
As soon as I get ASP to work there will be an ASP version (will prolly involve two files instead of one tho)
-scancode (January 05, 2010, 08:59 PM)

Er.. What I meant was EXE2PHP. So I could execute an executable on a server via PHP. But like I said it was a joke.

scancode · « **Reply #12 on:** January 05, 2010, 09:10 PM »

Any chance you can do this with exe too? Just kidding.

Again, awesome utility here.
-Deozaan (January 05, 2010, 08:41 PM)

EXE: use your favourite archiver. WinRAR, WinZIP, WinACE, 7Zip all do SFXs
As soon as I get ASP to work there will be an ASP version (will prolly involve two files instead of one tho)
-scancode (January 05, 2010, 08:59 PM)

Er.. What I meant was EXE2PHP. So I could execute an executable on a server via PHP. But like I said it was a joke.
-Deozaan (January 05, 2010, 09:04 PM)

Ever heard of system()?

VictorM · « **Reply #13 on:** January 07, 2010, 05:22 AM »

afraid I can see how this can be used together with a successful injection attack to deploy on a single session. yet, very interesting.

Tuxman · « **Reply #14 on:** January 07, 2010, 05:33 AM »

Injecting files is not actually dangerous yet.

f0dder · « **Reply #15 on:** January 07, 2010, 09:51 AM »

Injecting files is not actually dangerous yet.
-Tuxman (January 07, 2010, 05:33 AM)

Stoic Joker · « **Reply #16 on:** January 07, 2010, 10:56 AM »

Injecting files is not actually dangerous yet.
-Tuxman (January 07, 2010, 05:33 AM)

-f0dder (January 07, 2010, 09:51 AM)

ROFL (I had same reaction)

Tuxman · « **Reply #17 on:** January 07, 2010, 12:57 PM »

Unpacking a ZIP file on the server does not automatically cause any danger. How?

Stoic Joker · « **Reply #18 on:** January 07, 2010, 03:34 PM »

Unpacking a ZIP file on the server does not automatically cause any danger. How?
-Tuxman (January 07, 2010, 12:57 PM)

Kinda depends on what's in the file...

...Sure the server isn't in any danger (unless you count reputation) but the visitors..?

Tuxman · « **Reply #19 on:** January 07, 2010, 03:40 PM »

The visitors need a link to the file anyway. Where should that be?

Stoic Joker · « **Reply #20 on:** January 07, 2010, 05:54 PM »

The visitors need a link to the file anyway. Where should that be?
-Tuxman (January 07, 2010, 03:40 PM)

You're kidding, right?

Tuxman · « **Reply #21 on:** January 07, 2010, 05:56 PM »

No, why?

f0dder · « **Reply #22 on:** January 07, 2010, 06:04 PM »

The visitors need a link to the file anyway. Where should that be?
-Tuxman (January 07, 2010, 03:40 PM)

*facepalm*

If you have the possibility to inject a zippedfile.php on a server and then run it... what harm could you possibly do? Nobody would think of putting index.php in that sfx-zip, of course no... and certainly nobody would put a connect-back shell, would they? Definitely harmless

Tuxman · « **Reply #23 on:** January 07, 2010, 06:11 PM »

Depends. Does unzipping always overwrite files? It actually shouldn't. (So who cares about index.php?)

f0dder · « **Reply #24 on:** January 07, 2010, 06:14 PM »

Depends. Does unzipping always overwrite files? It actually shouldn't.
-Tuxman (January 07, 2010, 06:11 PM)

For the intended use of this program (as I understand it: upgrading websites, especially pre-fab systems), it should.

(So who cares about index.php?)
-Tuxman (January 07, 2010, 06:11 PM)

Ask any website owner who has his site defaced