665 matches found
WinRAR 5.80 XML Injection
Exploit Title: winrar External Entity Injection Exploit Author: albalawi-s Vendor Homepage: https://win-rar.com Software Link: https://win-rar.com/fileadmin/winrar-versions/winrar-x64-58b2.exe Version: 5.80 Tested on: Microsoft Windows Version 10.0.18362.418 64bit https://twitter.com/testapp poc...
WinRAR 5.80 Memory Corruption
Exploit Title: winrar memory corruption Exploit Author: albalawi-s Vendor Homepage: https://win-rar.com Software Link: https://win-rar.com/fileadmin/winrar-versions/winrar-x64-58b2.exe Version: 5.80 Tested on: Microsoft Windows Version 10.0.18362.418 64bit https://twitter.com/testapp...
The Best Way to Install and Set-Up WinRAR 64-bit
By Owais Sultan WinRAR is a file archiving tool for handling ZIP and RAR files on computers. It is also available for several different platforms including Windows, Mac, Linux, Android and lots more. This is a post from HackRead.com Read the original post: The Best Way to Install and Set-Up WinRA...
StrongPity APT Returns with Retooled Spyware
UPDATE The APT group behind the sophisticated malware known as StrongPity a.k.a. Promethium has mounted a fresh spyware campaign that is still ongoing as of July 2019. The group has retooled with new malware to control compromised machines, according to researchers. “The new malware samples first...
RARLAB WinRAR 5.61 - ACE Format Input Validation Remote Code Execution (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework TODO: add other non-payload files class MetasploitModule 'RARLAB WinRAR ACE Format Input Validation Remote Code Execution', 'Description' = %q In WinRAR versions prior t...
RARLAB WinRAR ACE Format Input Validation Remote Code Execution Exploit
In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format in UNACEV2.dll. When the filename field is manipulated with specific patterns, the destination extraction folder is ignored, thus treating the filename as an...
RARLAB WinRAR ACE Format Input Validation Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework TODO: add other non-payload files class MetasploitModule 'RARLAB WinRAR ACE Format Input Validation Remote Code Execution', 'Description' = %q In WinRAR versions prior t...
RARLAB WinRAR ACE Format Input Validation Remote Code Execution
In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format in UNACEV2.dll. When the filename field is manipulated with specific patterns, the destination extraction folder is ignored, thus treating the filename as an...
Analysis of a targeted attack exploiting the WinRAR CVE-2018-20250 vulnerability
In early March, we discovered a cyberattack that used an exploit for CVE-2018-20250, an old WinRAR vulnerability disclosed just several weeks prior, and targeted organizations in the satellite and communications industry. A complex attack chain incorporating multiple code execution techniques...
LokiBot Trojan Spotted Hitching a Ride Inside .PNG Files
A spam campaign pushing the info-stealing LokiBot trojan leverages a novel technique to avoid detection. According to researchers, the spam messages include malicious .zipx attachment hidden inside a .PNG file that can slip past some email security gateways. According to Trustwave SpiderLabs, tha...
Elfin Hacking Group Targets Multiple U.S. and Saudi Arabian Firms
An Iran-linked cyber-espionage group that has been found targeting critical infrastructure, energy and military sectors in Saudi Arabia and the United States two years ago continues targeting organizations in the two nations, Symantec reported on Wednesday. Widely known as APT33, which Symantec...
Elfin Hacking Group Targets Multiple U.S. and Saudi Arabian Firms
An Iran-linked cyber-espionage group that has been found targeting critical infrastructure, energy and military sectors in Saudi Arabia and the United States two years ago continues targeting organizations in the two nations, Symantec reported on Wednesday. Widely known asAPT33 , which Symantec...
Cybercriminals Have a Heyday with WinRAR Bug in Fresh Campaigns
A recently discovered vulnerability in the WinRAR file archival utility has been exploited in a slew of new campaigns, including one with a never-before-seen payload. The flurry of activity shows no sign of waning as cybercriminals continue to find success exploiting the bug. The campaigns take...
WinRAR Zero-day Abused in Multiple Campaigns
WinRAR, an over 20-year-old file archival utility used by over 500 million users worldwide, recently acknowledged a long-standing vulnerability in its code-base. A recently published path traversal zero-day vulnerability, disclosed in CVE-2018-20250 by Check Point Research, enables attackers to...
A week in security (March 11 – 17)
Last week on Malwarebytes Labs, we looked at the Lazarus group in our series about APT groups, we discussed the introduction of Payment Service Directive 2 PSD2 in the EU, we tackled Google’s Nest fiasco, and the launch of Mozilla's Firefox Send. In addition, we gave you an overview of the...
WinRAR 5.61 - Path Traversal Exploit
Exploit for windows platform in category local exploits !/usr/bin/env python3 import os import re import zlib import binascii The archive filename you want rarfilename = "test.rar" The evil file you want to run evilfilename = "calc.exe" The decompression path you want, such shown below...
Hackers are using 19-year-old WinRAR bug to install nasty malware
By Waqas By using the bug, hackers are desperately dropping persistent malware through generic trojan on systems using the old version of WinRar. McAfee security firm’s researcher Craig Schmugar has identified that the world famous and commonly used compression software WinRar is plagued with cod...
Patched WinRAR Bug Still Under Active Attack—Thanks to No Auto-Updates
Various cyber criminal groups and individual hackers are still exploiting a recently patched critical code execution vulnerability in WinRAR, a popular Windows file compression application with 500 million users worldwide. Why? Because the WinRAR software doesn't have an auto-update feature, whic...
Patched WinRAR Bug Still Under Active Attack—Thanks to No Auto-Updates
Various cyber criminal groups and individual hackers are still exploiting a recently patched critical code execution vulnerability in WinRAR, a popular Windows file compression application with 500 million users worldwide. Why? Because the WinRAR software doesn't have an auto-update feature, whic...
