Sploitus

winrar-exploit

CVE-2025-8088

kitploit · 2026-08-25

Exploit Code

MARKDOWN26 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-STARFALLREVERIE-WINRAR-EXPLOIT
## Description

This is my implementation of the `CVE-2025-8088` Winrar exploit. It uses Alternate Data Streams (ADS) and path patching within the archive. When a victim extracts the infected archive, the patched ADS payload (e.g., executable, powershell script, or some funny png) is redirected into the target path (usually startup folder). On the next system start, the payload is automatically executed due to it being in startup

## Repository

  * Requires `zlib`
  * Supports `C++ 20` and higher



## Usage

Run your compiled executable and follow the prompts:

  1. Enter the **Windows username** of the target. The payload will only drop into Startup if the username matches exactly.

  2. Enter the **folder** path containing the files you want the rar to visibly include. These are the "real" files shown in the archive.

  3. Enter the payload **file** path. This can be any file type, i like doing png's myself to troll but you can do malware executables, anything you want. It will be copied into startup and executed on next system start.




## showcase