Summary
Member-only story Hacker Holidays 2026: Day 10 Walkthrough (The Hollow Shell) A file upload accepted ZIP archives but never validated the paths inside. We used Zip Slip to plant a reverse shell in the server’s hooks directory. This is part of my Hacker Holidays 2026 walkthrough series. Read all walkthroughs here: This is Day 10 of my Hacker Holidays 2026 walkthrough series. Today’s challenge exploits one of the most elegant web vulnerabilities out there: Zip Slip. It is a path traversal attack that abuses how applications extract ZIP files, allowing an attacker to write arbitrary files to any location on the server. The wordplay in this challenge is perfect. We upload a “shell” (a decorative souvenir package) and get back a “shell” (command-line access to the server). The Setup The Byte Lotus Resort has a “Shoreline Display” portal where guests can upload decorative shell packages (ZIP files containing display configurations) to…