Full transcript
0:00Question for you. Actually, two questions. Do you have WinRAR installed on your Windows computer? Second question. Do you know what version of WinRAR? Because if you haven't updated in a little bit, you might have to update WinRAR tools now because a thread actor group romcom and others are exploiting a new zeroday vulnerability.
0:21This is very new in recent research from ESET. They discovered a new vulnerability in WinRAR being exploited in the wild under the guise of job application documents like resumes or cover letters that uses weaponized archives exploiting a path traversal flaw to compromise targets. Big shout out, big kudos. Credit where credit is due, Anton, Peter, and Damian. Of
0:43course, these are the individuals putting out this blog post, and I'll have that linked for you to review down below. But this is a zero day. That means you have had zero days to prepare for this and that it's new completely groundbreaking new previously unknown vulnerability exploited by a Russia aligned group called Romcom. Now romcom has done this before or at least similar
1:04things where they'll exploit a significant zero day for other software in the wild. 2023 they had CVE 2023 36884 for Microsoft Word. They beat this up with other vulnerabilities within Windows and Firefox, Thunderbird, Tour, etc. So, look, you need to update WinRAR if you haven't already because now there
1:26is CVE 20258088 that affects versions up to 7.12 on Windows. Now, I say Windows specifically because, well, this uses a feature or metadata technique of the Windows file system, NTFS, and we'll get into that. But the little bit of the background context and story here, July 18th is
1:48when they saw this activity in the wild. Some strange DL called MS Edge. DLL meant to look like the web browser, but clearly not that was contained inside of a RAR file, a RAR archive that had unusual paths that caught their attention. Once they communicated and contacted the developer of WinRAR, they
2:09went ahead and pushed out a fix for WinRAR 7.13 published July 30th. So, make sure you're using version 7.13, if not later by the time you watch this video. But there is one really important tidbit here. Note that software solutions relying on publicly available Windows versions of Unar.dll or its
2:29corresponding source code are affected as well. So, unar.dll DL like the extracting capability, the library, the module, what this and WinRAR is built on is still susceptible when it's an unpatched version. Even like RAR.exe, the command line capability, not just the guey. Even if you've patched or updated on your machine, you hear a lot about penetration testers, cyber threat
2:51emulation, or adversaries and threat actors themselves living off the land where they use things that are present on the device. they could just as easily bring their own land and just pull in this vulnerable version of WinRAR to use that within their own campaigns. So, food for thought. Anyway, this CVE CVE 20258088
3:11uses alternate data streams for path traversal. Now, we've talked about alternate data streams before. We have another video on that showcasing how they can be used and even abused and leveraged within Windows. And that is a Windows specific trick. That's some of the metadata, some of the stuff you can do in the NTFS file system. So, ESET
3:29found this strange looking RAR file, an archive that looked like it just had a single PDF present there. But if you were to extract this, WinRAR will unpack and extract it along with all of the alternate data streams or ads. So for this specific instance using that Eli Rosenfeld CV, their resume or whatever
3:51job application documents, it ends up deploying that malicious DL MS edge.dll into your temporary directory and then a malicious LNK file or Windows shortcut is put into the Windows startup directory. So it automatically has persistence to execute this DL or run other code. Maybe the next time you reboot or log in or whatever, they use
4:12that writing capabilities to the file system and leverage that to gain code execution later, not right now in the moment. And romcom, these bad actors actually did a couple more tricks here. They intentionally added increasing depth of parent directory relative path elements like a dot dot slash dot dot slash to try and move up or climb up the
4:34file system. But it actually used not real, completely illegitimate, non-existent paths that Winar visibly warns and complains about. It just dumps all this down below. And you can see, of course, dot dot slash dot dot slash, etc., etc., etc. I think that's just to add noise, a little bit of confusion. Oh, make this look strange. But if you
4:55were to scroll down and actually see that, uh, hey, anyone kind of knowing this knows that that's sketchy. Is discusses this. Hey, we suspect they did that just so the victim doesn't notice the DLL and LNK paths. You would need to scroll down to see those revealed uh as they do down previously. So, that's what we've got here. ESET has seen this
5:14spread out across a handful of fishing campaigns, more social engineering laws where these adversaries are including different attachments for job application documents, resume, CV, etc., etc., including the email address that they came from, the title, the attached file, and a quick sample of what this looks like. Hi, I'm Eli Rosenfeld. I'm a
5:36seasoned web 3 software developer, blah blah blah. All of course to attach the RAR file and then chain execution based off of the CBE 20258088 and then do further damage with more post exploitation with mythic and other different malware samples. Again, I won't fall down the rabbit hole for all
5:56of this. I'll link that in the video description. But this set the stage for what we will talk about. First, let's go explore what the RAR file actually looked like and then can we recreate this? Can we put it together and understand a little bit more of how this vulnerability comes together? We'll do all that super duper soon. But first,
6:15please let me take a moment to tell you about the sponsor of today's video, Anti-Siphon Training. Amongst the other companies powered by Black Hills Information Security like Wild West Hackingfest, RECO Publishing and Active Counter Measures, Anti-Siphon Training provides hands-on education and learning with ondemand courses, live courses with instructors for all things in cyber
6:36security. There's a link below in the video description for you to take a look at their upcoming live courses, including some from instructors like John Strand, Tim Papa, Zack Hill, Hal Denton, and many, many more across tons of different categories like red team, blue team, Python programming, forensics, including some student testimonials with my friend Michelle
6:57over at Huntress. Shout out Michelle. And of course, hands-on labs and their environment in the cyber range. But one of the best things about anti-ciphon training is their pay forward. what you can material. Anti-ciphon training knows that not everyone can afford the high price of a lot of different cyber security training in the industry. So, their pay forward what you can model
7:17lets you dive into any of the courses that you're interested in at whatever price you'd like. But whatever you pay lets you pay it forward for others that can attend in the future. Let's take a look at the security operations center core skills with John Strand. Just as one example, it's 16 hours of material, live support from expert instructors,
7:36certificate of completion, and up to 12 months of access to the cyber range. But take a look. If I click enroll now, it'll bring us where we could select our price for the training. Whether we want to pay $25, $50, or more, or if we scroll all the way down, you could pay as little as $0. But if you want to pay
7:53it forward, any monetary amount you select will help contribute for others in the future. And this model is sponsored by other friends of the channel, Flare and Plexra, amongst others. Anti-Siphon Training is an incredible collection of phenomenal instructors, top tier education and training, and you can check it out with the link below in the video description. Take a look at similar courses and see
8:13what you can dive into with anti-ciphon training. All right, now I'm inside of my Windows 11 virtual machine, and I really recommend you do the same. Work and operate inside of a virtual environment, especially when you work with weird, sketchy malware, software, or vulnerabilities. And big thanks to the ESET team, especially with this blog and reference here. They have shared a
8:32lot of the indicators of compromise and the files that they were discussing alongside their hashes. Again, I'll put a link to this in the video description if folks are interested. But ultimately, I want to go see if we can get a copy of Eli Rosenberg or whatever his name was, his CV. Ah, Eli Rosenfeld CV2 copy parenthetical 10. Let's try and grab
8:54that hash. And I am going to use virus total here, truth be told, just to be able to search for this, see if we have the sample. Looks like we do. Let's see if we can download it and then play with it. Now, we basically already know what this thing does. But just in case we wanted it for any understanding of, oh,
9:11what are the other artifacts? What's the full copy dump of the warnings that it gave us when we were using this? I want to be able to look at this inside of a dynamic sandbox so I could get that text and maybe have better understanding of what's really going on. Say maybe you're trying to recreate a proof of concept.
9:28You're trying to understand what this thing is. And hey, them at least sharing that file does clue us in and let us explore and see things more. So I do want to be pretty quick here. I know this will be a little bit extraneous and it's going to be very very hard to see this in action when we are using any run
9:44as the cloud online sandbox that I'm using just to interact with this. This would end up extracting again what I've downloaded from virus total. So the raar archive is inside. Let me just say eli.raar will be the actual name for this document. You might not be able to see whatsoever but yeah we will be using the winar archiver. If I take a look at
10:04the info here, the about winar will tell me this is basically using old old old version 5.9 way back in their instance here, but you could barely see it. There's Eli's CV in a horribly rendered uh anti-alias text. But if I were to extract this out now, this is all of the same messages that we were able to see
10:24referenced in a screenshot within ESET's blog. If I wanted to copy that out though, again, I just want to use their clipboard capability so I could receive all the data that we just got out of trying to extract it inside of the virtual machine. But now we can see this a little bit more. I know there's not a
10:41lot to that. I just wanted to show you that process as a reminder. Hey, you could do that to get a little bit more understanding and then be able to see just as they mention the updater. Lnk or the MSedge. DLL here present etc. We could even use some other utilities like the terminal. Let's use the raar.exe
11:03and let's go take a look on the desktop inside of whatever directory we had. Eli.rawar. Tell me everything that you know about it. If you want to look at some of the arguments for raar.exe. We certainly could. Maybe that's actually worth doing first. We could see all the things that it could do like tell us about different
11:20information on this archive, verbose technical information, etc. even list some of the files like would you be able to see will roar.exe exe the command line utility actually know what files are in there? Would it be able to see more than just Eli's CVPDF? So, it's LTA is what I saw, right? L to
11:42list archive contents, T for technical, and then A for all. So, we could lta that Eli.ar file and then it will spit out a lot of stuff including the alternate data streams that are present in there. So, we could actually copy all of this out to get more data that would be helpful for us in understanding and
12:02potentially recreating a proof of concept for how this bug comes to life. But yeah, take a look. RAR 5.91 old school. And now, of course, everything that's there, including the real files and then NTFS, alternate data streams, and all the bogus nonsense junk that they might have put in there as a red herring. All to hide what we see at the
12:23very end are appd data roaming Microsoft Windows start menu program startupd updater.link the full file system path for the malicious window shortcut file that will execute and run and then stage a lot of the capability with msge.dll DL somewhere else on the file system because they basically have this arbitrary write primitive thanks to
12:46WinRAR and CV20258088 just writing out the contents that are stored within an alternate data stream given the name of some path traversal moving along the file system get in one place and if we wanted to see this we could of course get to our start directory let me get to app data not sure how well you can see this but app
13:05data Microsoft Windows Windows start menu programs startup. There is our updator.lk back to our Windows virtual machine. So I showcased that in any run for a little bit just so we could see some of the steps that maybe you'll go through if you want to learn a little bit more and experiment see oh how that's all put
13:26together. But of course get the latest version of Winroar so that it is patched on your machine. Looks like 7.13 is the only thing out and about for Windows currently. But I'll admit I do have a old copy of 7.12. I don't have WinRAR installed quite yet. So I do want to extract this installer. So with that I
13:45could install this old and vulnerable version of WinRAR. Run that with user account control. Yep. Totally fine. A. Okay. Now WinRAR is of course using the RAR file format and that is their proprietary format not based off of zip or any of the others. Sevenzip, of course, a good one, but RAR is only kind
14:06of all handled and you cannot write other RAW files without using their utility. There aren't even Python libraries for the thing. But with it installed now, ooh, they even add a little security warning about updating to the latest version. Nice. Thank you for the infinite trial that lasts forever. We did buy the WinRAR bag. I'll be the first to say that's on its way.
14:24But okay, 7.12. That is how of course the help about WinRAR, you'll see how you could track down that version number. Now, let's try a little proof of concept. There is a proof of concept already out and about for this. You can find it online. It is out on GitHub and I think that's hit the street already
14:39like since last week. Of course, folks have been chatting about this. But I did want a chance to see it in action. And while we won't spend the time in this video trying to hand jam and craft and create our own proof of concept just off the cuff cuz again I was saying I was struggling with it and I'll tell you
14:54why. Because we can use this as an example and to learn a little bit from. Of course it's a Python script. So let's look through the code. They're using arg pars to take arguments, os to work with the operating system, strruck to work with some type, subprocess to run some commands, cis text wrap, z-lib, pathlib, etc. And they have a couple raar 5
15:13constants here. Now, you might be knowing a little bit of the raar file format history. I think raar 5 is now the modern one that modern Windows versions of winar will always put you into raw 5. Though there is raar 4, which there are older command line utilities from roar.exe exe that will let you output raw 4 archives. I don't
15:34think you can any longer, but this is still something that affects up to raw 5. So the signature raar 5 sig variable is just these magic bytes at the very beginning of the file and they have a couple little markers here. HFL extra hl data. These are for the different headers that make up the blocks inside of the raw file format. Now we have a
15:54couple convenience functions that are defined for the proof of concept. This is just run obviously. Hey, to run a command line command, they're using subprocess as the module to be able to do this. Shell equals true. You can get sketchy heebiejeebies there if you want. And then autofind raar is the convenience function just to be able to
16:13determine if you have on your Windows system as you run this proof of concept script the version of roar.exe that lets you make a RAR file. It's just making sure WinRAR is installed. Neat thing is you could basically have the patched version of WinRAR and then still run this because what this proof of concept does is actually just making a regular
16:34RAR file and then patching it or modifying it to put the alternate data streams and the dot dot/path traversal syntax in there. Neat little fun fact here. They're making literally a placeholder because alternate data streams when you add a colon to like the file on Windows to create an alternate data stream, it doesn't even let you use
16:57forward slashes or have another colon in there, right? So, you are limited in the characters. So, these aren't particularly real alternate data streams like you could just see or create on Windows. These are literally manipulating the bytes of the RAR, the file that WinRAR spits out to be able to make them that way. By default, it ends
17:18up creating with the RAR executable from installed WinRAR as that function you saw above. A to create an archive, I think it's EP and OS to actually specify and set the names of these within the RAR. But vint is where it kind of lost me because you're getting into the raw bytes, headers, and blocks of the file
17:38format. Raar, from what I understand, and again, please school me, let me know, it uses variable length integers that are le 128. What that means is they're little Indian base 128. So, it does some math magic here that I don't think I'd be able to just explain off the cuff for you. But after it has modified these and manipulated the
18:00placeholders that it created for these files because ultimately it needs to have all these entries for files in the blocks of the archive and it needs to be able to keep track of them with a CRC or a cyclic redundancy check. I think that you can kind of think of it as like a checksum. Hey, making sure all the data
18:19is there as it should be. But this needs to be recalculated because you've now modified or manipulated or added in these alternate data streams. Again, dot dot / dot do/path traversal and the contents of the files that you add. So now it's using those little marker header file values of header hl extra
18:40and hl data all with the get variable length integer function that's defined up here. So all of that is just to patch or modify, hot swap in place and tamper with the builtout RAW file. Path traversal could be done with however many dot dot slash or up directories that you would like, but then it strips
19:01the C drive that's ever in there. It handles all the capability and then ultimately gives you all of the arguments that you could use to play with this. Obviously, this only affects Windows. The proof of concept could really only be built well at least. so far easily enough on Windows to work with the NTFS metadata and attach these
19:20alternate data streams. So it makes sure that you are running Windows and then it gives you all these potential options. It makes sure that these exist so you could play with them and then it finds where your WinRAR installation is where we could use roar.exe exe to build and create a placeholder raw file, patch it and work with it so that it's all staged
19:40to have these alternate data streams and then clean it up so that now you have a payload that's dropped once you extract the archive. Does that make sense? That's 243 lines of Python code here and there heebie-jebies that uh I know I was just steamrolling over, but that's that. So, let's do it. Let me open up the
20:01Windows terminal here. I do have Python installed that I'll move into my desktop so I could run our CBE20258088. py Python script. Now, these are the arguments that we need. Remember, we needed a decoy file like the Eli Rosenfeld CV2. PDF that's inside of the
20:21RAR archive. Then, of course, the payload or the actual file that we want to execute. And then the drop location or the destination. Where do we want to put it? If I were to put this in startup, I'm in PowerShell, so I do want app data and I think it's Microsoft Windows start menu programs startup. And there's clearly nothing in that right
20:41now, but I want that location so that when I run Python with a decoy file. Let's create a decoy file. First of all, let's create just a please subscribe into a please subscribe.ext file. And now we need a payload. So super simple. Well, let's just get C Windows system 32 calc for the moment.
21:02Of course, this could be your mythic implant, your sliver agent, your beacon, your havoc, your cobalt strike, whatever. But for now, let's just use calc.exe. Sika showcase. Let me fire this up with our decoy now being our please subscribe, our payload being our calc.exe, and then our drop location
21:23being startup. If I enter on this, it's done. Okay, it just did it. Part of me wonders if the double quote will get in the way there. But we can experiment and play with this. But look at how this happened, right? Patched it on disk, recomputed the CRC for the different header blocks, and now we have, if I
21:41look on my desktop, our malicious RAR archive. Actually, I am a little bit weirded out by that double quote there. I want to remove the RAR file that we have currently and then try that once again. I think it's the backslash there cuz it's like trying to escape quote. So, I'm going remove that and okay,
22:02cool. Now, that looks clean. I think it worked. So, let's see if it does it back on our desktop. Here is our malicious raw archive. Let me clean up the desktop just cuz I want to be able to extract here nice and easy. And let me actually open up explorer to go look back at the startup folder to see would we properly
22:23get persistence the way that we would expect. Okay, empty right now. But if I go extract our please subscribe.ext. Oh, I dig it. Looks so innocent. Nice and easy there. Extracting that out to our desktop or whatever we want now. Ooh, looks like a strange artifact that still keeps coming through. But calc is in there. this even if it okay maybe
22:45whatever strange oddity of the proof of concept that we're playing with that won't be able to trigger or fire execute but this has so if I were to now log back in or reboot this computer or whatever the case may be this thing should be infected with the CVE 2025 8088 let's restart all right let me log
23:03back in here do we have calc fire okay and then it tries to run the exe file yeah open it the cursor. Just let the AI vibe code bros get it. Help fired though. Remember that's basically put together with a couple different ingredients. You've got alternate data streams that NTFS capability within
23:23Windows. You have path traversal just using dot dot slash dot dot slash to climb up the file system and then move wherever you want to go that you can write content any location that you want like the startup folder. One easy place for persistence but could still be used and abused. So patch your WinRAR version, upgrade to 7.13.