module
WinRAR Filename Spoofing
| Disclosed | Created |
|---|---|
| 09/28/2009 | 05/30/2018 |
Disclosed
09/28/2009
Created
05/30/2018
Description
This module abuses a filename spoofing vulnerability in WinRAR. The vulnerability exists
when opening ZIP files. The file names showed in WinRAR when opening a ZIP file come from
the central directory, but the file names used to extract and open contents come from the
Local File Header. This inconsistency allows to spoof file names when opening ZIP files
with WinRAR, which can be abused to execute arbitrary code, as exploited in the wild in
March 2014
when opening ZIP files. The file names showed in WinRAR when opening a ZIP file come from
the central directory, but the file names used to extract and open contents come from the
Local File Header. This inconsistency allows to spoof file names when opening ZIP files
with WinRAR, which can be abused to execute arbitrary code, as exploited in the wild in
March 2014
Authors
chr1xjuan vazquez
Platform
Windows
References
Module Options
To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:
msf > use exploit/windows/fileformat/winrar_name_spoofing
msf /(g) > show actions
...actions...
msf /(g) > set ACTION < action-name >
msf /(g) > show options
...show and set options...
msf /(g) > run
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.