walidpyh/cve-2025-8088Proof-of-concept demonstrating Alternate Data Stream (ADS) payload delivery via crafted WinRAR archives for educational research and controlled lab testing.
Details about this CVE can be found at: https://nvd.nist.gov/vuln/detail/CVE-2025-8088
⚠️ Warning: This repository contains a proof-of-concept (PoC) for CVE-2025-8088.
It is intended for educational purposes, research, and lab environments only.
Do not use this code on systems you do not own or have explicit permission to test.
This project demonstrates how an Alternate Data Stream (ADS) payload can be embedded into a WinRAR archive.
It is designed to teach how certain Windows applications handle file streams and archive processing, specifically for research and lab testing.
Key Points:
This PoC is not intended for malicious use. Misuse can be illegal and unethical.
Always run in a controlled lab environment or virtual machine.
Clone this repository:
git clone https://github.com/walidpyh/CVE-2025-8088.git
cd CVE-2025-8088
python main.py <payload_file> <output_rar> [--decoy <decoy_file1> <decoy_file2> ...]
Examples:
python main.py Updaters.exe Archive.rar
python main.py Updaters.exe Archive.rar --decoy README.md doc.txt
Explanation:
<payload_file>: The file you want to deliver via ADS.<output_rar>: The name of the generated RAR archive.--decoy: Optional list of decoy files; only the first file carries the payload via ADS.