[Goldmouth]

CVE-2018-20250

exploit for Extracting Code Execution From Winrar

poc by Ridter

how to use ?

you just need to install python 3.7, and prepare a evil file you want to run, set the values you want, this exp script will generate the evil archive file automatically!

https://github.com/WyAtu/CVE-2018-20250

Enjoy.  🤝  🤝

[#Skyline]

Now this is useful. Thank you for the share.

[***W0lf***]

yeap , thanks for the share it bro ...a good one! Happy spreading!

[BTC]

Happy spreading everybody! Thanks for the share.

I find it is still quite easy to tell when you've opened an infected winrar archive :P

[naxster]

Happy spreading everybody! Thanks for the share.

I find it is still quite easy to tell when you've opened an infected winrar archive :P

How can you tell? :)
I haven't tried this yet, but does something pop up and reveal that the created WinRAR is infected?

[BTC]

How can you tell? :)
I haven't tried this yet, but does something pop up and reveal that the created WinRAR is infected?

Read the readme in the github the OP linked.

It shows screenshots of the exploit in different stages.

[R4NS0M]

CVE-2018-20250

exploit for Extracting Code Execution From Winrar

poc by Ridter

how to use ?

you just need to install python 3.7, and prepare a evil file you want to run, set the values you want, this exp script will generate the evil archive file automatically!

https://github.com/WyAtu/CVE-2018-20250

Enjoy.  🤝  🤝

Thanks a lot!

[naxster]

Read the readme in the github the OP linked.

It shows screenshots of the exploit in different stages.

Just read it, yeah that's a big tell (not OPs fault though)...

But I'm a bit sceptic about step 4...
It says this and I quote "when he restart the computer, the hi.exe will run."
Soooo what happens if the person deletes the files before restarting the computer? And also won't the stub run if he run the .exe file? :/

[BTC]

Just read it, yeah that's a big tell (not OPs fault though)...

But I'm a bit sceptic about step 4...
It says this and I quote "when he restart the computer, the hi.exe will run."
Soooo what happens if the person deletes the files before restarting the computer? And also won't the stub run if he run the .exe file? :/

I'm not sure you understand what this exploit is exactly. I suggest googling, there is so much in the news about this. Do some research you will find your answers

[galrov]

not sure what i am doing wrong but i make it and when i send it to VM antivirus detects it

[Fisher]

CVE-2018-20250

exploit for Extracting Code Execution From Winrar

poc by Ridter

how to use ?

you just need to install python 3.7, and prepare a evil file you want to run, set the values you want, this exp script will generate the evil archive file automatically!

https://github.com/WyAtu/CVE-2018-20250

Enjoy.  🤝  🤝

Thanks man ! 😈 😈 😈 😈

[Jacque Fresco]

Well it does not work with the latest release "WinRAR x64 (64 bit) 5.70 beta 2" Winrar just responds with "The Archive is either in unknown format or damaged"

[Goldmouth]

Now this is useful. Thank you for the share.

Thnx for the love  🤝

yeap , thanks for the share it bro ...a good one! Happy spreading!

Happy to help out.  🎉

Thanks a lot!

👍

Well it does not work with the latest release "WinRAR x64 (64 bit) 5.70 beta 2" Winrar just responds with "The Archive is either in unknown format or damaged"

Im sure they have patched some version of it.

[Angelis]

I always liked you OP. Thanks for the share, I am sure a bunch of skiddos gonna wet their beds over this.

[BTC]

Well it does not work with the latest release "WinRAR x64 (64 bit) 5.70 beta 2" Winrar just responds with "The Archive is either in unknown format or damaged"

yes the ace library has been removed since the release of the exploit to the public.

winrar is not setup to auto-install updates in any sort of way, the amount of computers with the new version patching the exploit is likely less than 0.01%. This leaves a huge amount of victims to blackhat users. Not that I agree with any such thing, but given the nature of the software this is a huge exploit to come out haha.