lewis-ricardo/amaranth-projectCVE-2025-8088 exploitation chain + Quasar C2 multi-stage payload delivery
Utilize CVE-2025-8088 (WinRAR path traversal vulnerability, ≤ 7.11) to implement a multi-stage backdoor implantation attack chain.
诱饵文档 → 恶意RAR → CVE触发 → ADS写入 → Stager执行 → 文件加载 → C2上线
| Directory | Content |
|---|---|
Stage01~Stage07/ | Source code and test scripts for attack chains at each historical stage |
loader/ | Self-developed PE memory loader (C language) |
rat-client/ | Self-developed lightweight RAT client (C#) |
source/ | Upstream source code of Quasar RAT / AsyncRAT |
tools/ | Quasar C2 server, Donut and other tools |
payloads/ | Compiled payload files |
poc/ | Exploit script for CVE-2025-8088 |
side-load/ | DLL side-loading experiment |
docs/ | Documentation, progress reports, attack flow |
计划书/ | Original plan |
source/Quasar-master/ directory in the project contains its original source code. The C2 client is modified and compiled based on this.source/AsyncRAT-C-Sharp/ directory in the project contains its original source code.| Machine | IP | Role |
|---|---|---|
| Physical machine | 192.168.30.1 | C2 server + attack machine |
| Win10 VM | 192.168.30.136 | Target machine (WinRAR 7.11) |
This project is for network security research and education purposes only.