Arbitrary read with 7-Zip @listfile

7-Zip (7z, 7za, 7zr) interprets any argument starting with @ as a list file (@listfile): it reads that file and treats each line as the name of a file to add to the archive. If one of those names does not exist, 7-Zip dumps it as a warning (<content> : No more files). That behavior turns 7-Zip into a reader of other people's files when we can influence its arguments.

Mechanism

The classic scenario: a root cron runs something like 7za a backup.7z * in a directory where we have write access. When the * wildcard expands, the shell includes any matching file, including one we name @x. 7-Zip sees the @ and reads x as a list; if x is also a link to a root file, its content leaks into the log:

cd /writable/directory
touch @root.txt          # 7z will see it as @listfile -> will read "root.txt"
ln -s /root/.ssh/id_rsa root.txt
# after the cron (or when the privileged 7z runs):
cat /path/to/backup.log  # -> "<content of /root/.ssh/id_rsa> : No more files"

It is the same principle as tar wildcard abuse (--checkpoint), but here no code runs, it reads: each line of the pointed file is opened and its content falls into the error message. Filtering line by line recovers a private key, a shadow, a reused password.

Requirements

7-Zip running with more privileges than ours (a root cron, SUID or a sudo rule), the working directory being writable by us (to plant the @file and the symlink), and being able to read its output (the log, or stdout if the sudo is interactive). It leaks a file's content, not a direct shell.

How to detect it. Creating a file whose name starts with @ and a symlink to sensitive paths (/root, /etc/shadow) in a privileged cron's working directory is the cleanest signature (Sysmon for Linux / auditd over creat/symlink). In the task logs, the appearance of ... : No more files lines with content that looks like a key or a hash gives away the leak. A 7z/7za invoked with an unanchored wildcard in a root script is the pattern to audit.

Defence. Avoid unanchored wildcards in privileged scripts (use ./* or explicit paths, and -- to terminate options), do not run compressors over directories writable by third parties, and do not keep secrets in files readable by the compressing process. It is a cousin of tar wildcard abuse and a form of credential hunting through arbitrary read.