CVE-2025-8088 WinRAR Exploit

Advanced WinRAR Path Traversal Exploit Tool

A sophisticated GUI tool for creating malicious RAR archives that exploit the WinRAR path traversal vulnerability (CVE-2025-8088) using ADS and RAR5 header manipulation.

Features

• ADS Exploitation - NTFS Alternate Data Streams for payload hiding
• RAR5 Header Manipulation - Direct header patching for path injection
• GUI Interface - Clean, modern user interface
• Startup Targeting - Automatic payload placement in Windows startup
• Custom Decoy Support - Use your own decoy files or default

Requirements

• Python 3.6+
• WinRAR CLI
• customtkinter

Quick Start

# Install dependencies
pip install -r requirements.txt

# Run the tool
python gui.py

Usage

1. Select Payload - Choose your executable file (.exe, .bat, etc.)
2. Choose Decoy - Select a decoy file or leave empty for default
3. Name Archive - Enter output RAR filename
4. Build - Generate the exploit archive

How It Works

The tool creates RAR archives with path traversal using:

1. ADS Creation - Hides payload in NTFS alternate data streams
2. RAR Building - Creates base RAR with ADS using WinRAR CLI
3. Header Patching - Injects traversal path into RAR5 headers
4. CRC Recalculation - Ensures archive integrity
5. Output - Delivers malicious RAR ready for extraction

Path Example: ..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\payload.exe

Disclaimer

This tool is for educational and authorized testing purposes only. Use only in controlled environments with proper consent.

Author

Made by @tcixt on Telegram

---

Advanced red team tool for CVE-2025-8088 exploitation