imbyter/imbyter-winrar_cve-2023-38831PoC exploit for WinRAR CVE-2023-38831 with Python script to generate malicious archives that execute arbitrary code via spoofed file extensions.
A spoofable file extension vulnerability exists in WinRAR versions prior to 6.23. Attackers can exploit this vulnerability by crafting specially packaged files that appear harmless, such as JPG (.jpg) image files, text files (.txt), or PDF documents (.pdf), and then trick users into opening these files directly without decompression, thereby successfully executing arbitrary code on the victim's machine.
File: test.zip
This is a pre-built archive containing the CVE-2023-38831 vulnerability. When directly opening
2.jpginside the archive using WinRAR version < 6.23, it will execute the bat script within the archive. The content of the bat script is as follows:
echo off
mshta vbscript:msgbox("你电脑已经被我控制！！！",64,"被黑了")(window.close)
shutdown -s -t 60
After a successful test, a shutdown prompt will appear. Enter
shutdown -ain the command prompt to cancel the shutdown task.
File: make-poc.py
Used to automatically convert the input files into a POC archive.