13 matches found
CVE-2025-24071
CVE-2025-24071PoC CVE-2025-24071: NTLM Hash Leak via RAR/ZIP Extraction and .library-ms File Windows Explorer automatically initiates an SMB authentication request when a .library-ms file is extracted from a .rar archive, leading to NTLM hash disclosure. The user does not need to open or execute...
CVE-2022-30333-PoC
CVE-2022-30333-POC 用于测试CVE-2022-30333的示例文件 Sample.rar : 如果你想在Linux上测试。解压后，它会在 ../../tmp/traversed 中创建 trav 。请确保在解压 Sample.rar 之前目录 ../../tmp/traversed 已存在 exp.rar : 如果你想在Zimbra邮件服务器上测试。解压后，它会在 /opt/zimbra/jettybase/webapps/zimbra/public/ 中创建 moo.txt 。你可以通过...
CVE-2025-8088
Security Analysis: Path Traversal Exploitation in WinRAR CVE-2025-8088 Note: Repository under development. This project will receive future updates with additional analyses, analysis scripts non-exploit, and presentation material. New versions will be published as soon as they are available. This...
CVE-2025-24071
CVE-2025-24071 Windows 文件资源管理器欺骗漏洞 - CVE-2025-24071 通过提取精心构造的ZIP或RAR文件，并利用Windows处理.library-ms文件（一种用于指定库和网络连接的文件类型）时的漏洞，泄漏Windows的NTLM哈希。 受影响版本 Windows 10 Version 1809 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems Windows Server 2025 Server Core installation Windows Server 2025...
CVE-2025-6218_WinRAR
🧪 CVE-2025-6218: WinRAR中的路径遍历 📌 描述 本实验演示如何利用易受攻击的 Windows WinRAR 版本中的 CVE-2025-6218 漏洞。该漏洞允许恶意 .rar 文件使用相对路径（....\）覆盖解压目录之外的文件，可能导致代码执行或敏感文件篡改。 ⚠️ 本实验仅用于教育目的。 必须在隔离的虚拟机 中运行，且不连接生产网络。 🛡️ 受影响版本 该漏洞影响： WinRAR 7.11 及更早版本 （包括 6.x 和部分 5.x 版本）。 受影响版本在解压过程中未能正确过滤相对路径（....\）。 WinRAR 7.12 及更高版本不受影响 。...
Winrar-CVE-2023-40477-POC
CVE-2023-4047 PoC By Wild Pointer Read Research: https://wildptr.io/winrar-cve-2023-40477-poc-new-vulnerability-winrar-security-research/ Recvol3.cpp Vulnerability: https://www.rarlab.com/vulnrev3names.html, https://www.win-rar.com/ Vulnerable: WinRAR = 6.22 How to Test? You can generate your own...
CVE-2025-24071_PoC
CVE-2025-24071PoC CVE-2025-24071: NTLM Hash Leak via RAR/ZIP Extraction and .library-ms File Windows Explorer automatically initiates an SMB authentication request when a .library-ms file is extracted from a .rar archive, leading to NTLM hash disclosure. The user does not need to open or execute...
EUVD-2026-23872
Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted. Version 7.5.10 fixes th...
GHSA-J273-M5QQ-6825 Junrar has an arbitrary file write due to backslash Path Traversal bypass in LocalFolderExtractor on Linux/Unix
Summary A backslash path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution e.g., overwriting...
Junrar has an arbitrary file write due to backslash Path Traversal bypass in LocalFolderExtractor on Linux/Unix
Summary A backslash path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution e.g., overwriting...
CVE-2024-12390
A vulnerability in binary-husky/gptacademic version git 310122f allows for remote code execution. The application supports the extraction of user-provided RAR files without proper validation. The Python rarfile module, which supports symlinks, can be exploited to perform arbitrary file writes. Th...
USN-6569-1 libclamunrar vulnerabilities
it was discovered that libclamunrar incorrectly handled directories when extracting RAR archives. A remote attacker could possibly use this issue to overwrite arbitrary files and execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. CVE-2022-30333 ...
