Directory Traversal in RARLAB UnRAR Extraction on Linux and UNIX

This repository contains a single Metasploit module (modules/exploits/linux/fileformat/unrar_cve_2022_30333.rb) that exploits CVE-2022-30333, a path traversal vulnerability in unRAR on Linux. The exploit works by creating a malicious RAR archive containing a symlink and a payload file. When the archive is extracted with a vulnerable version of unRAR, the symlink allows the payload file to be written to an arbitrary location on the filesystem, potentially leading to code execution or system compromise. The module allows the user to specify a custom payload file or generate one, as well as control the target extraction path and symlink filename. The attack vector is local, requiring the victim to extract the malicious archive. The only file in the repository is a Ruby script compatible with the Metasploit framework, and it is fully operational for generating weaponized RAR files targeting unpatched unRAR installations on Linux.

This repository contains a single Metasploit module targeting CVE-2022-30333, a path traversal vulnerability in unRAR as used by Zimbra Collaboration Suite on Linux. The exploit generates a malicious RAR file that, when processed by a vulnerable Zimbra server (typically via email), writes a JSP-based web shell into the public web directory using path traversal. The module then attempts to trigger the web shell via HTTP requests, resulting in remote code execution (default payload: Meterpreter reverse shell). The exploit is operational, requiring the attacker to send the crafted RAR file to any user on the target Zimbra server. The module is well-structured, with clear options for customizing the payload location and filename, and includes logic to check for successful exploitation. The main attack vector is via email (RAR attachment), and the exploit targets specific file paths on the Zimbra server. No hardcoded IPs or domains are present; the exploit is generic for any vulnerable Zimbra instance.

This repository provides a proof-of-concept exploit for CVE-2022-30333, a path traversal vulnerability in unRAR versions prior to 6.11. The main exploit script (cve-2022-30333.rb) is a Ruby program that generates a malicious .rar archive. The archive is crafted such that, when extracted by a vulnerable unRAR, it writes an attacker-supplied file (payload) to an arbitrary location on the filesystem, as specified by the attacker (including via path traversal). This can be used to plant web shells or other backdoors, as demonstrated in the README with an example targeting Zimbra's web directory. The exploit does not include a payload itself but allows the user to supply any file as the payload. The repository consists of a single exploit script, a README with usage instructions and context, and a .gitignore. No network endpoints are hardcoded; the attack vector is local file extraction. The exploit is a POC and not part of a framework.

This repository provides a proof-of-concept exploit for CVE-2022-30333, a vulnerability in Zimbra's use of the UNRAR utility (up to version 6.11). The exploit consists of a Python script (CVE-2022-30333_webroot.py) that takes a user-supplied RAR archive containing a webshell (JSP file) and crafts a malicious RAR file. When this file is processed by a vulnerable Zimbra server, it results in the webshell being written to the webroot, allowing remote code execution via HTTP. The repository includes a placeholder for the webshell (root_ver/shell.jsp) and a README with usage instructions. The main attack vector is network-based, requiring the attacker to deliver the malicious archive to the target server (e.g., via email). The exploit is a POC and requires the attacker to supply their own webshell.