Executive Summary Archive extraction is one of the most trusted operations in modern computing. From package managers to backup systems, we routinely extract TAR files without a second thought. But what happens when the archive itself is malicious? This analysis examines a how archive traversal technique uses deeply nested directory structures and symbolic link chains to bypass validation mechanisms and write files outside the intended extraction directory. By understanding how path resolution works at the filesystem level, we can see why simple validation fails and how attackers exploit this gap.

Disclaimer: I do not promote hacking or abusing systems without permission. Everything shown here is purely for learning and experimentation. I was doing what I usually do solving problems on LeetCode using python when a random thought popped into my head: What if I import os and try to run something on the system? So I took a basic problem, Two Sum, solved it normally… and then added a tiny extra line at the end.

Introduction The year is 2525 and you’ve just embarked on a journey to visit all planets in the Solar System (Mercury, Venus, Earth, Mars, Jupiter, Saturn, Uranus and Neptune). The first stop is Mercury, where customs require you to fill out a form (bureaucracy is apparently not Earth-specific). As you hand over the form to the customs officer, they scrutinize it and frown. “Do you really expect me to believe you’re just 50 years old?

Let me start with the real reason this project exists. My college keeps giving assignments and insists that they must be handwritten. Not typed. Not PDFs generated from Word. Handwritten and after writing everything, we still have to scan or take photos and upload them to a Google Form. If you’ve ever done this, you already know how annoying it is. Writing multiple pages by hand takes time, your hand starts hurting, and half the effort goes into making sure it looks neat enough to upload.