Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
ezwinrar — Python tool exploiting CVE-2018-20250 found by CheckPoint folks | Kitploit
Tools/GitHubGitHub/ektoplasma/ezwinrar
Payload GenerationVulnerability AnalysisExploitationPenetration TestingBinary Exploitation
GitHubektoplasma/ezwinrar

ezwinrar

Python tool exploiting CVE-2018-20250 found by CheckPoint folks

View Repository
27 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

ezwinrar

Python tool exploiting CVE-2018-20250 found by CheckPoint folks : https://research.checkpoint.com/extracting-code-execution-from-winrar/

By crafting the filename field of the ACE format, the destination folder (extraction folder) is ignored, and the relative path in the filename field becomes an absolute Path. This logical bug, allows the extraction of a file to an arbitrary location which is effectively code execution.

Usage:

python3 ezwinrar.py /path/to/winace.exe (default is C:\Program File (x86)\WinAce\winace.exe)

(1) User's startup folder:
Since it is not possible to guess the name of the victime in advance (else use 3), the path will be like ..\Appdata\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

(2) System startup folder:
File will be in C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp. System privileges are required.

(3) Custom local location

(4) SMB location [not implemented yet]

Download Tool