CVE-2023-38831 PoC — WinRAR 安全漏洞

Source

https://github.com/Tolu12wani/Demonstration-of-CVE-2023-38831-via-Reverse-Shell-Execution

Associated Vulnerability

Title:WinRAR 安全漏洞 (CVE-2023-38831)
Description:RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.

Description

This project demonstrates a simulated exploitation of the WinRAR vulnerability CVE-2023-38831 to execute a reverse shell. The purpose of this task was to showcase how attackers can weaponize compressed archive files to gain remote access to a target machine.

Readme

# CVE-2023-38831 Reverse Shell Demonstration

This repository contains a PDF summary and screenshots of a lab-based demonstration of CVE-2023-38831. The vulnerability allows attackers to embed and execute malicious payloads in compressed files. In this case, the payload triggers a reverse shell.

## What's Inside:
- summary_report.pdf: A detailed explanation of the lab process
- /screenshots: Visual proof of steps and outcome

## Note:
- This repository does NOT contain any executable code or malware.
- All actions were performed for educational purposes in an isolated environment.

File Snapshot


 [4.0K]  /data/pocs/86498d6939f52f6ec6d7a881286600adbf206766
├── [2.7K]  CVE-2023-38831_Exploit_Report.pdf
├── [ 589]  README.md
├── [136K]  Screenshot 2025-08-03 224934.png
└── [304K]  Screenshot 2025-08-03 230300.png

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!