Skip to content

SET file extension attacks explained

Viyat Bhalodia edited this page Mar 2, 2016 · 2 revisions

Below is largely from the SET menus and trial and error - Official site: www.secmaniac.com

NOTE: SET only uses File extension attacks for Payload 1, which in OWTF is expanded into payloads: 1_zip, 1_rar, 1_zce, 1_rce

File extension attacks explained:

The DLL Hijacker vulnerability will allow normal file extensions to call local (or remote) .dll files that can then call your payload or executable. In this scenario it will compact the attack in a zip file and when the user opens the file extension, will trigger the dll then ultimately our payload. During the time of this release, all of these file extensions were tested and appear to work and are not patched. This will continiously be updated as time goes on.

Enter the choice of the file extension you want to attack:

1. Windows Address Book (Universal)
2. Microsoft Help and Support Center
3. wscript.exe (XP)
4. Microsoft Office PowerPoint 2007
5. Microsoft Group Converter
6. Safari v5.0.1
7. Firefox <= 3.6.8
8. Microsoft PowerPoint 2010
9. Microsoft PowerPoint 2007
10. Microsoft Visio 2010
11. Microsoft Word 2007
12. Microsoft Powerpoint 2007
13. Microsoft Windows Media Encoder 9
14. Windows 7 and Vista Backup Utility
15. EnCase
16. IBM Rational License Key Administrator
17. Microsoft RDP

NOTE on RAR vs ZIP exploitability of file extension attacks: Do you want to use a zipfile or rar file. Problem with zip is they will have to extract the files first, you can't just open the file from inside the zip. Rar does not have this restriction and is more reliable

Clone this wiki locally