skander1337/winrar-exploitC++ implementation of CVE-2025-8088 WinRAR exploit using Alternate Data Streams to drop payloads into Windows Startup folder for persistence.
This is my implementation of the CVE-2025-8088 Winrar exploit. It uses Alternate Data Streams (ADS) and path patching within the archive. When a victim extracts the infected archive, the patched ADS payload (e.g., executable, powershell script, or some funny png) is redirected into the target path (usually startup folder). On the next system start, the payload is automatically executed due to it being in startup
zlibC++ 20 and higherRun your compiled executable and follow the prompts:
Enter the Windows username of the target. The payload will only drop into Startup if the username matches exactly.
Enter the folder path containing the files you want the rar to visibly include. These are the "real" files shown in the archive.
Enter the payload file path. This can be any file type, i like doing png's myself to troll but you can do malware executables, anything you want. It will be copied into startup and executed on next system start.
This repository is intended for educational purposes only.