Exploitation Summary
EIP tracks 3 public exploits for CVE-2009-2261.
PoCs published by Metasploit, Nine:Situations:Group, pyrokinesis, jduck, including Metasploit module exploits/multi/fileformat/peazip_command_injection.
AI-analyzed exploit summary This exploit leverages a command injection vulnerability in PeaZip by crafting a malicious ZIP file with a specially named file entry. When the victim opens the ZIP and double-clicks the file, arbitrary commands are executed.
Description
PeaZIP 2.6.1, 2.5.1, and earlier on Windows allows user-assisted remote attackers to execute arbitrary commands via a .zip archive with a .txt file whose name contains | (pipe) characters and a command.
Exploits (3)
This exploit leverages a command injection vulnerability in PeaZip by crafting a malicious ZIP file with a specially named file entry. When the victim opens the ZIP and double-clicks the file, arbitrary commands are executed.
This exploit generates a malicious ZIP file that leverages a command injection vulnerability in PeaZIP <= 2.6.1. When the victim opens the ZIP and double-clicks the crafted file, arbitrary commands (e.g., fetching and executing a remote batch file) are executed via pipe manipulation in the filename.
This Metasploit module exploits a command injection vulnerability in PeaZip (CVE-2009-2261) by crafting a malicious ZIP file. When the victim opens the file and double-clicks the specially named entry, arbitrary commands are executed.