Skip to content

Instantly share code, notes, and snippets.

@elohim666
elohim666 / Walkthrough.md
Last active August 14, 2026 14:24
Unsafe handling of received filenames on the receiver: Arbitrary File Feletion via a maliciously named incoming file (croc-marked-files.txt) and, when receiving into $HOME can be chained to remote code execution

Summary

A malicious sender can delete arbitrary files (and empty directories) on a receiver's machine (anywhere the receiving user has permission ofc) by sending a file named croc-marked-files.txt. croc uses that exact filename in the current working directory as its internal "delete these temp files on exit" list, and deletes every path it contains without any validation. Because a received file with that name lands in the receiver's working directory (the default receive location), the incoming file becomes the deletion list, and its contents are fully attacker-controlled. Deletion runs automatically when the transfer completes and also on Ctrl-C.

Details

Two functions in src/utils/utils.go implement a cleanup mechanism for temporary files:

  • const crocRemovalFile = "croc-marked-files.txt" a fixed, relative path resolved against the current working directory.
  • RemoveMarkedFiles() opens that file and runs os.Remove(line) for **every line, with no path validation and no