CVE-2025-8088 WinRAR Exploitation

Advanced WinRAR Path Traversal Exploitation Tool

A sophisticated GUI tool for creating malicious RAR files that exploit the WinRAR path traversal vulnerability (CVE-2025-8088) by manipulating ADS and RAR5 headers.

Features

• ADS Exploitation - NTFS alternate data streams to hide the payload
• RAR5 Header Manipulation - Direct header patching for path injection
• GUI Interface - Clean and modern user interface
• Startup Placement - Automatic payload placement in Windows startup
• Custom Decoy Support - Use your own decoy files or defaults

Requirements

• Python 3.6+
• WinRAR CLI
• Custom kinter

Quick Start

# Instalar dependencias
instalación de pip -r requisitos.txt

# Ejecute la herramienta
python gui.py

Usage

1. Select Payload - Choose your executable file (.exe, .bat, etc.)
2. Choose Decoy - Select a decoy file or leave empty for default
3. File Name - Enter the output RAR file name
4. Build - Generate the exploit file

How It Works

The tool creates RAR files with path traversal using:

1. ADS Creation - Hides the payload in NTFS alternate data streams
2. RAR Construction - Creates base RAR with ADS using WinRAR CLI
3. Header Patching - Injects a path traversal into RAR5 headers
4. CRC Recalculation - Ensures file integrity
5. Output - Delivers malicious RAR ready for extraction

Example path: ..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\payload.exe

Disclaimer

This tool is for educational and authorized testing purposes only. Use it only in controlled environments with proper consent.

Author

Made by undefined_name

Advanced red team tool for exploitation of CVE-2025-8088