Phishing through WinRAR 3.51
----------------------------
Credit to: Preben Nyløkken
Tested on version: 3.51
Vendors site: www.rarlabs.com
Vendor status: Tried contacting without luck.
Description:
Due to the build-up of WinRAR, some vital parts of the programs functions and url's are visible through a simple HEX editor.
This can be used to conduct a bin-phishing attack. Phishing attack based on altering binary files.
If a user want's to buy the full version of WinRar, the user can use WinRAR's menu to access WinRars homepage.
Now if the file WinRAR.exe was altered at 0009BCC0, it would be possible to conduct a phishing attack against the user.
The attacker would simply alter this line, and send the user to he's fake WinRAR site.
In a realistic senario, the attacker could spread the modified file(s), through file sharing networks or download sites.
PoC:
0009BCC0 | 2F 77 77 77 2E 67 6F-67 6C 65 2E 63 6F 6D 00 | /www.google.com |
As of today, this is not a normal way of doing phsihing attacks, but still plausible.
Other versions of WinRAR might be vulnerable as well.
Phishing through WinRAR 3.51
----------------------------
Credit to: Preben Nyløkken
Tested on version: 3.51
Vendors site: www.rarlabs.com
Vendor status: Tried contacting without luck.
Description:
Due to the build-up of WinRAR, some vital parts of the programs functions and url's are visible through a simple HEX editor.
This can be used to conduct a bin-phishing attack. Phishing attack based on altering binary files.
If a user want's to buy the full version of WinRar, the user can use WinRAR's menu to access WinRars homepage.
Now if the file WinRAR.exe was altered at 0009BCC0, it would be possible to conduct a phishing attack against the user.
The attacker would simply alter this line, and send the user to he's fake WinRAR site.
In a realistic senario, the attacker could spread the modified file(s), through file sharing networks or download sites.
PoC:
0009BCC0 | 2F 77 77 77 2E 67 6F-67 6C 65 2E 63 6F 6D 00 | /www.google.com |
As of today, this is not a normal way of doing phsihing attacks, but still plausible.
Other versions of WinRAR might be vulnerable as well.
[ reply ]