+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: WinRAR CVE-2018-20250 Exploit | Spread FAST (/showthread.php?tid=5944438)
WinRAR CVE-2018-20250 Exploit | Spread FAST - Goldmouth - Feb 23, 2019
CVE-2018-20250
exploit for Extracting Code Execution From Winrar
poc by Ridter
how to use ?
you just need to install python 3.7, and prepare a evil file you want to run, set the values you want, this exp script will generate the evil archive file automatically!
https://github.com/WyAtu/CVE-2018-20250
Enjoy. 🤝 🤝
RE: WinRAR CVE-2018-20250 Exploit | Spread FAST - #Skyline - Feb 23, 2019
Now this is useful. Thank you for the share.
RE: WinRAR CVE-2018-20250 Exploit | Spread FAST - ***W0lf*** - Feb 24, 2019
yeap , thanks for the share it bro ...a good one! Happy spreading!
RE: WinRAR CVE-2018-20250 Exploit | Spread FAST - BTC - Feb 24, 2019
Happy spreading everybody! Thanks for the share.
I find it is still quite easy to tell when you've opened an infected winrar archive :P
RE: WinRAR CVE-2018-20250 Exploit | Spread FAST - naxster - Feb 24, 2019
(Feb 24, 2019 12:20 AM)Apex Wrote: Happy spreading everybody! Thanks for the share.
I find it is still quite easy to tell when you've opened an infected winrar archive :P
How can you tell? :)
I haven't tried this yet, but does something pop up and reveal that the created WinRAR is infected?
RE: WinRAR CVE-2018-20250 Exploit | Spread FAST - BTC - Feb 24, 2019
(Feb 24, 2019 01:48 AM)naxster Wrote: How can you tell? :)
I haven't tried this yet, but does something pop up and reveal that the created WinRAR is infected?
Read the readme in the github the OP linked.
It shows screenshots of the exploit in different stages.
RE: WinRAR CVE-2018-20250 Exploit | Spread FAST - R4NS0M - Feb 24, 2019
(Feb 23, 2019 09:24 PM)⚠️️HOSTAH⚡ Wrote: CVE-2018-20250Thanks a lot!
exploit for Extracting Code Execution From Winrar
poc by Ridter
how to use ?
you just need to install python 3.7, and prepare a evil file you want to run, set the values you want, this exp script will generate the evil archive file automatically!
https://github.com/WyAtu/CVE-2018-20250
Enjoy. 🤝 🤝
RE: WinRAR CVE-2018-20250 Exploit | Spread FAST - naxster - Feb 24, 2019
(Feb 24, 2019 02:21 AM)Apex Wrote: Read the readme in the github the OP linked.
It shows screenshots of the exploit in different stages.
Just read it, yeah that's a big tell (not OPs fault though)...
But I'm a bit sceptic about step 4...
It says this and I quote "when he restart the computer, the hi.exe will run."
Soooo what happens if the person deletes the files before restarting the computer? And also won't the stub run if he run the .exe file? :/
RE: WinRAR CVE-2018-20250 Exploit | Spread FAST - BTC - Feb 24, 2019
(Feb 24, 2019 02:46 AM)naxster Wrote: Just read it, yeah that's a big tell (not OPs fault though)...
But I'm a bit sceptic about step 4...
It says this and I quote "when he restart the computer, the hi.exe will run."
Soooo what happens if the person deletes the files before restarting the computer? And also won't the stub run if he run the .exe file? :/
I'm not sure you understand what this exploit is exactly. I suggest googling, there is so much in the news about this. Do some research you will find your answers
RE: WinRAR CVE-2018-20250 Exploit | Spread FAST - galrov - Feb 24, 2019
not sure what i am doing wrong but i make it and when i send it to VM antivirus detects it
RE: WinRAR CVE-2018-20250 Exploit | Spread FAST - Fisher - Feb 24, 2019
(Feb 23, 2019 09:24 PM)⚠️️HOSTAH⚡ Wrote: CVE-2018-20250
exploit for Extracting Code Execution From Winrar
poc by Ridter
how to use ?
you just need to install python 3.7, and prepare a evil file you want to run, set the values you want, this exp script will generate the evil archive file automatically!
https://github.com/WyAtu/CVE-2018-20250
Enjoy. 🤝 🤝
Thanks man ! 😈 😈 😈 😈
RE: WinRAR CVE-2018-20250 Exploit | Spread FAST - Jacque Fresco - Feb 24, 2019
Well it does not work with the latest release "WinRAR x64 (64 bit) 5.70 beta 2" Winrar just responds with "The Archive is either in unknown format or damaged"
RE: WinRAR CVE-2018-20250 Exploit | Spread FAST - Goldmouth - Feb 24, 2019
(Feb 23, 2019 09:26 PM)#Skyline Wrote: Now this is useful. Thank you for the share.
Thnx for the love 🤝
(Feb 24, 2019 12:01 AM)沃爾夫在這裡 Wrote: yeap , thanks for the share it bro ...a good one! Happy spreading!
Happy to help out. 🎉
(Feb 24, 2019 02:33 AM)Vakaris Wrote: Thanks a lot!
👍
(Feb 24, 2019 05:57 AM)Jacque Fresco Wrote: Well it does not work with the latest release "WinRAR x64 (64 bit) 5.70 beta 2" Winrar just responds with "The Archive is either in unknown format or damaged"
Im sure they have patched some version of it.
RE: WinRAR CVE-2018-20250 Exploit | Spread FAST - Angelis - Feb 24, 2019
I always liked you OP. Thanks for the share, I am sure a bunch of skiddos gonna wet their beds over this.
RE: WinRAR CVE-2018-20250 Exploit | Spread FAST - BTC - Feb 24, 2019
(Feb 24, 2019 05:57 AM)Jacque Fresco Wrote: Well it does not work with the latest release "WinRAR x64 (64 bit) 5.70 beta 2" Winrar just responds with "The Archive is either in unknown format or damaged"
yes the ace library has been removed since the release of the exploit to the public.
winrar is not setup to auto-install updates in any sort of way, the amount of computers with the new version patching the exploit is likely less than 0.01%. This leaves a huge amount of victims to blackhat users. Not that I agree with any such thing, but given the nature of the software this is a huge exploit to come out haha.