来源

关联漏洞

描述

CVE-2025-8088 exploit C++ impl

介绍

## Description
This is my implementation of the ``CVE-2025-8088`` Winrar exploit. It uses Alternate Data Streams (ADS) and path patching within the archive. When a victim extracts the infected archive, the patched ADS payload (e.g., executable, powershell script, or some funny png) is redirected into the target path (usually startup folder). On the next system start, the payload is automatically executed due to it being in startup 

## drawbacks
- You need to know the victims Windows username, to reach their Startup folder. This is usually easy to get, so not a huge issue.
- Winrar has patched this on the latest version, so this will only be effective for the next 5-6 months. (most people havent updated in years)

## Repository 
- Requires ``zlib``
- Supports ``C++ 20`` and higher

## Usage
Run your compiled executable and follow the prompts:

1. Enter the **Windows username** of the target. The payload will only drop into Startup if the username matches exactly.

3. Enter the **folder** path containing the files you want the rar to visibly include. These are the "real" files shown in the archive.

4. Enter the payload **file** path. This can be any file type, i like doing png's myself to troll but you can do malware executables, anything you want. It will be copied into startup and executed on next system start.

## showcase

https://github.com/user-attachments/assets/d7fc4825-26f7-4452-824c-231815050c03

*This repository is intended for educational purposes only.*

文件快照

 [4.0K]  /data/pocs/2403244c172a72c1cf712f07900e2ca280c8ced5
├── [1.5K]  README.md
├── [4.0K]  valentines
│   ├── [4.0K]  include
│   │   ├── [4.0K]  ads
│   │   │   └── [ 702]  ads.hpp
│   │   ├── [4.0K]  cmd
│   │   │   └── [ 103]  cmd.hpp
│   │   ├── [4.0K]  console
│   │   │   └── [ 164]  console.hpp
│   │   ├── [ 771]  core.hpp
│   │   └── [4.0K]  paths
│   │       └── [ 908]  paths.hpp
│   ├── [4.0K]  src
│   │   ├── [4.0K]  ads
│   │   │   └── [5.1K]  ads.cpp
│   │   ├── [4.0K]  cmd
│   │   │   └── [ 228]  cmd.cpp
│   │   ├── [4.0K]  console
│   │   │   └── [ 352]  console.cpp
│   │   ├── [1.2K]  core.cpp
│   │   └── [4.0K]  paths
│   │       └── [2.6K]  paths.cpp
│   ├── [5.3K]  valentines.vcxproj
│   ├── [1.9K]  valentines.vcxproj.filters
│   └── [ 225]  valentines.vcxproj.user
└── [1.1K]  valentines.sln

11 directories, 15 files

备注