CVE-2025-8088 WinRAR Exploit

Advanced WinRAR Path Traversal Exploit Tool

A sophisticated GUI tool for creating malicious RAR archives that exploit the WinRAR path traversal vulnerability (CVE-2025-8088) using ADS and RAR5 header manipulation.

Features

ADS Exploitation - NTFS Alternate Data Streams for payload hiding
RAR5 Header Manipulation - Direct header patching for path injection
GUI Interface - Clean, modern user interface
Startup Targeting - Automatic payload placement in Windows startup
Custom Decoy Support - Use your own decoy files or default

Requirements

Python 3.6+
WinRAR CLI
customtkinter

Quick Start

# Install dependencies
pip install -r requirements.txt

# Run the tool
python gui.py

Usage

Select Payload - Choose your executable file (.exe, .bat, etc.)
Choose Decoy - Select a decoy file or leave empty for default
Name Archive - Enter output RAR filename
Build - Generate the exploit archive

How It Works

The tool creates RAR archives with path traversal using:

ADS Creation - Hides payload in NTFS alternate data streams
RAR Building - Creates base RAR with ADS using WinRAR CLI
Header Patching - Injects traversal path into RAR5 headers
CRC Recalculation - Ensures archive integrity
Output - Delivers malicious RAR ready for extraction

Path Example: ..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\payload.exe

Disclaimer

This tool is for educational and authorized testing purposes only. Use only in controlled environments with proper consent.

Author

Made by @tcixt on Telegram

Advanced red team tool for CVE-2025-8088 exploitation

CVE-2025-8088-Winrar-Tool

Most Popular