Description

This is my implementation of the CVE-2025-8088 Winrar exploit. It uses Alternate Data Streams (ADS) and path patching within the archive. When a victim extracts the infected archive, the patched ADS payload (e.g., executable, powershell script, or some funny png) is redirected into the target path (usually startup folder). On the next system start, the payload is automatically executed due to it being in startup

drawbacks

• You need to know the victims Windows username, to reach their Startup folder. This is usually easy to get, so not a huge issue.
• Winrar has patched this on the latest version, so this will only be effective for the next 5-6 months. (most people havent updated in years)

Repository

• Requires zlib
• Supports C++ 20 and higher

Usage

Run your compiled executable and follow the prompts:

1. Enter the Windows username of the target. The payload will only drop into Startup if the username matches exactly.

2. Enter the folder path containing the files you want the rar to visibly include. These are the "real" files shown in the archive.

3. Enter the payload file path. This can be any file type, i like doing png's myself to troll but you can do malware executables, anything you want. It will be copied into startup and executed on next system start.

showcase

example.mp4

This repository is intended for educational purposes only.