RonF98 Exploits and Proofs of Concept

Showing 5 PoCs on this page

GitHub

RonF98/CVE-2023-38831-POC

Repository PoC3Created 2026-03-08ExploitCVE-2023-388313 files

6.6 KiB

Analysisdeepseek-v4-pro:cloud · 2026-08-09

Technical assessment

The artifact contains a Python script (payload withheld) that crafts a malicious RAR archive exploiting CVE-2023-38831. The script takes a decoy file and a malicious script as input, creates a ZIP archive with manipulated filenames using trailing spaces, and outputs a .rar file. When a victim opens the decoy file in vulnerable WinRAR, the malicious script is executed instead.

Backdoor review

No backdoor observed in reviewed code

The repository contains a README and a Python script (payload withheld) that implement a proof-of-concept for CVE-2023-38831. The script crafts a ZIP archive with ambiguous filenames to trigger the WinRAR vulnerability. No backdoor, concealed operator-directed harm, or unrelated payload is present. The script's behavior is fully disclosed in the README and limited to generating a crafted RAR file.

ClassificationExploit

Model confidence98%

AuthenticationNot required

Languagespython

Target softwareWinRAR

Attack typesarbitrary code executionfile spoofing

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The Python script (payload withheld) actively generates a weaponized RAR file that exploits CVE-2023-38831 to achieve arbitrary code execution. It does not merely detect or report the vulnerability; it produces a functional exploit artifact.

exploit.py:1-54README.md:22-37

Requirements

Victim must open the crafted RAR archive and attempt to view the decoy file using a vulnerable version of WinRAR (< 6.23).README.md:6-7
Attacker must provide a decoy file and a malicious script (e.g., .cmd) to the exploit generation script.exploit.py:8-9

Observed behavior

The script prompts the user for a decoy file, a script file, and an output RAR name.exploit.py:6-10
It creates a temporary directory structure where the malicious script is placed inside a subfolder named after the decoy file with an appended 'X', and the decoy file is placed outside with an appended 'Y'.exploit.py:28-34
A ZIP archive is created from this structure, and the 'X' and 'Y' characters in the archive's binary data are replaced with spaces to create ambiguous filenames.exploit.py:37-43
The modified ZIP data is written directly to a .rar file, producing the final exploit archive.exploit.py:46-47

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File: Payload withheldPython script that generates a crafted RAR file exploiting CVE-2023-38831 by manipulating filenames in a ZIP archive.exploit.py:1-54
File: Payload withheldDocumentation explaining the vulnerability, the PoC usage, and the underlying logic.README.md:1-60

Review boundaries

What the analysis did not establish

One file (DoS.cmd) is referenced in the README but its content is not included in the evidence; its exact behavior is unknown.
The evidence does not include the actual execution or testing of the generated exploit against a live WinRAR instance.
One file (DoS.cmd) is referenced in the README but not included in the supplied text evidence; its content is unknown.
Binary content of the repository (e.g., images) was not analyzed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub