安全研究
CVE-2023-38831 WinRAR 欺骗漏洞：归档文件伪装执行的 0click 攻击
Thinking
2023-08-23
1 分钟阅读
研究档案
#漏洞分析#代码审计#恶意软件
WinRAR 的解压逻辑有一个隐藏行为——当归档里同时存在「同名目录+同名可执行文件」时，WinRAR 会优先解压可执行文件到当前目录，并自动执行。攻击者精心构造的「看似安全图片」就是可执行文件。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9247686c78229690cc05eab1aeba1042c52e76357d2d2631002610af20c3f2932a8ebbe5fbb297c0f8e7e90cc9cde57a05cf0915a8117909c2045b401ae9eb46f924703222a82aa57035c4765bd2d0896c2d7999883d702c85abcb815ec08160016dd019fea587bec10cbd2ae9c9cbc18db978c208ed5dcaa15dbb4483928a6ca013e3ae7379527ba83f0327f94425d0a2f6b8e5542380edc902b3d8745c8bcd015dfda73688452bace75aceffca6b6f4daeb3159194f21957f71619fdc500361e6a9914ada5946fd28b5dd7918da65432fdc4dd42aa6f58d447cbf6a8c8821044bf1bc7432ac3d48c9458cbb7bc76beab8286a9833e768a2ebedcdffefa2bf9cfd8fa745435940c590b4104dbceac016caec6f6f29a4d166fa7bf5c0ef2b0a133ab7ac7f598d959a04c5774dace7971c521c33d39d38c5b5fd306ff2fb46c1220755addad6331c5f6b2456179de1ede885a8075bfa4d16a926b0efbf1c3512377d71e2c9fcf4179664ea0f69969e4a43972067c7467469dcb4525bb0caf228460143f2c998efa796972cbd72dd4630029d46abf075a7eb44daa593f19c0ae9a430e1d7570a7efb50c32529c6713fbe8096d6514c939a808f186e7f2457c0859f0ebe17b12a550690dc916eba2cd71d533ea301c1d2f8492e2a30c92e5a1d330875e86f16ee19497cb9444a403f949056e8303a2d78441f7b2f7b08e2918873dfe4472ebd6474e17288f6f2a50d90897dc6659e5ff59be8ba08ef9ff9d11fafb0503b0950d0306b0208c678250890ff5096c02ba42c14b179e8afdef1a0edc7c4412d13293a69af9ae9f5322aeabcd7e82b626b465097b6241517f65434df9b78630fe72dfdafe9df19d3739897fda5b258ad3aa51f6dcc08668e2ad7469b898a8b4b512895b05f79be90f543b6cd1cec0017f5b55c38d4451a6161a5d685c3958dd6c84a94e7c4d7e9ec94197c736ca5f2f9d75bb9cfdb5460b2424fa7f27e3f1cdd3f3d2dacc818d5d846bceb9c2fb2f420f36b33362a4c688cfc5b3b3ef6f30771b087456f6699c8c54597ebe648282f3685ffe81c2c973683e2aae43bd9ff66390dcd1b544c58399d861a715fb09fb94040aec3cafd763993311de45680db9fc55e995bc4e21c2b93a680c941498fa50b293c670aa6858f2134d6e5831068085da2c0514d294f337a257f1a0b14390d198530d2c01b6bdbfec54ca41fac457080102b904dc7e5d3a8fd024176c6e2b50fca8e74461ad12f1461ef54c970a7e98ccbded05f08d500817bb73b59645e4adab0ae511f45d44e981413ce62ee61939e8ccdf37764468a3595ab9e6f2c177bfdf4cd187104ba7dba43cc55b2746114e281f4da6ff5b25129c7b912a406357f081806c6799632d22ebbcb68d397aae945771a73207ede4157a3f474fc973266ed974a7a3bec2dab2da5ed2db52815a166bee764a1c2d83080fa1551cffa55e2fce1be9f1059fed229aa2e96ac1e5bf9ca2534df0ba914783260e35a315db1eae5b0db2658bf453e16aacea998819e27d26d7ac79420eb938d265175b52d7826cd6531ec4076b54bf13f39ca62960599fc42244419e884961d95202bf06e202a50651df75a798ab554e06cb79b9ed84901ae004af2f4781fc057a1349bde47ed1fa519a5631e108a831f745e7b076b79af2a2ea547ba0a873689a4703b75a1c2c1a71c640c3224a30b0573a6d87adba15644a6dde1b1a29b9e9dc3d41a9c8974e4ff6825e51424ea96fc0560ced04758875bc9003aba48baed33df2e001349dbf5cf41fc244b52096a5772c1a94e2864aa4a681b776fefffa9506232a1c433d943b6845ccef1880c1f7632df21d4929b00cc00dd93496e001eeae120b1631702716e7baf8a3dde1a1981c7504717b37499ccaf63efb9cd05b36cc47b404147ec30af5b69573587591dfe99f9396f09762b498715d148a49b54de395bfb4ff35384053847fa92b6ee0cbcab8295bdf1267226bacd9a876711792c0b20edc498dedcb5d527aa1d4605b256edf66517dae45da5b8d88250bc0e564793f5f96284fc0c99150687f459705e070e5baf2b4179ca11864cb3b85ff2345b04969f5599343eb2c98fc4bc4fa7b89cf311b51e6fe1052768d37d2975f51c088392a193142c9ca696ebfdbad444ba7f95d38da9d069912eebdeb6f711a7337a789e17a14061cfb8bb2e2f9352f7485be1a0622af1c8c2fb424a3b0f824ebbc77e3f39393a7683bf722ff8ad32fee83cc46822556c59a150f9eb57af11a21cd2f563b119b14a35e4a296ebdf2c13b9d64a7916e92b4722cc8e394b3a65d7e3b278ab600e7744c014384ac414ac2c4d7c76adccd93c61ee9ea1cc43a5cde5af0b904408bd37b7706442bc1bb57c9284c551f52279f7dcb7143c27f719bfd391f7f04584fdb298e30ef88885fe1ade758ee5da034615ea7ad4c9b00faebeede16d68efe66ed5b654ad9a85222a1d5d53fba914d72d8922990f6d669d738753efdcedd075c74b406c84627bed86410772efc70469f605493022c196dc64cd4bdfbb09f0aeefa1dda9690c13966ef4f8e989366df94108b4b67673870789b827465dd7897c5c69257501c912dbf28785e9fe113ba414d3038757c88266b5274f6d0c372c4b14caa5493f9ebc697daf9fe1d974e6e6efe1511888f9c5605c4d3630ff8c27e01a65d879b6289c1994d0d8cb9e66adb87654d17a12928d381375b1715017db253094d28af66ca3c107b18a4fafc90d787493e4f8f5f4c95b5b9d7c7d00da6f25e0092b315ce2a326f5c97d96970bee4f58800f87b24511eb0f1af410eadf39ffb48b23f1716018b45d1aed894ae2c5172a65bb1ed019e6448543d9a8202b23d5f657b7fcfe03427d8239709e6e02c1c42197e67f97b21fa9c17f2d389af8e90d4cfdbc3451dbda0a5121015052ebefcefd501158034cab83ebb5718912a4b22531021dd08f767fbf5afac4c1be90c6b8ae9bfd04786e8a3f05ee436a88e172bd16f58f4222fc0b55132182223d124dea416a1999bdc90974cf9829883e0820674573d61be4b5513d87f4083929a790559b7687a1a82faf8eb4fde0035d0fe3ab672d69f49d05fd5a9896e5b80e1db34de1286e1a5189c41b76ee036c7c43f9d8f20237b8951c025eb1ec8cc85144255593dbe650e7cfa2cf01efb20e4133b2db357aa51c975c974a345efd2caf7f06aa8e4432ccc912c3b3e3fc65c2bc3d4179c602e30ff47a3538c9f14ce6de9619079a8f1785c705d3dc83f5379c1f70acde0f01da3293c9836eebddafba9ff1edd2a6c223d4f57535d1e63d70264c59302b6fc392b1a4fd87427636b8a7ce43e1011438fa1bea818b4eb3a38ae0867c0e730724960cf02d2a28a568303bf61caa810f6e3f6385f7fa767fcf2194806b288572ef95c81b963abc61a62e34d1233ed5dce2e0206e2a8822cec99861ef5ecfc30294e5da9969dcac20d4448812f382338a6f6d3e71d6bf4f3e823410376cd4e9bfbc372c208a0936c8e7bf9d2ceb5aba8fc87d28d60bb396d8327b070019cf481496306a6868f69e80aa035743ab866cbebd5502e7bcac9ccdf07842cac910775c44b1f3fb66560a40ad9ee537b80ec9d4b3f611a81ac71a432d05633e2830600a8ebff6e102e8bbe5dbb420d93bb785ea8add77d866c12963d79ed0ecda968d91e540dfe1305010ed02d7b7a0c36513128b9d25fe448ba26817e2588c499a9bc9cab5d73f4743e7c44780f1c3c9292cbea06443ec9c192d6711ee6fc7d0e8e22b9664c65ec3a140c4ca765141b493b59301ca57f96be6dde2b5a23c7fd90a4a7ee3a464618776b142154e8a2fddf67e91e06556f6dd7f320fc992c7fc68cd8df2a79d0b920e5233c60a347fd21d9d454ec2c37aab7ba40f80a14efb0e412a245f05cea1a2780d39ce0d313c9dc3fbe9545741aefeac5fd14198fbbbab5dbb4e9ab45006fc58298b11b983657480b9ddd2429dbd8ba8467fb0155308d3d202827473923851be67e9dc02ade32b5b1f38c1b08af215180cce80c02d38ec6d699020244f22964708607aadc980bbc1b5c7879c3fc7d57cbdd354e2fe82709192903469b3a26f2f4a225513e5e39575fc960f26c00ce6130b883f67e0a98fdb1843abfde78d1d8aeb12f46b2ff37abda5db885fb299f15bf747a4e62bd3500f3399b85812aeedcdcdd5ebbacffaad200c1acf5d211a401913088cc60999050b6d9d8aec160c79db77ce86769013e72ec1018adb0a8576d25ab7d1c9cf092d12d63bc9f35e32d817ffa0965e54f9983c3e87d7f5b74468d1ec9326e2a9507d6ee739ae6d859cc215be8c32112fd5f833d5f0ef2f643c2b7d8530317e182aaf1e2264107584e4e88a49021350bc8fa359be536a5d3a59717ad489c97171ce153c2d381089cbacf2bba953d7a52c31ef1a19f528e5d263e2efff1b23846c5a07d88fb4d0a2cb1a757075533390373bbd95cbe22a5727ea319c9b8053b1b67f0c6562a9a27798e544d0ab2c00066621d97a9731600dac18b59c8153d4c81f546f69939bdacfc4090ef00c091476f7857a50314bb44853c93742f285040a8d6212d85fa896758bce3a952a934e66606ddccbaafbd87b474bb46d32f124713d8fe7052edda57ba8725661ca0938cc2e5abd4a303fec1012770efff81fffa4b4c3b9c205304cf903d2a889bf9cf8d0bb813a49e04a1b361d7e54d89985a8206e9f4bd1cd3bb2513d0c5b4fb99eb96ba6a6c77039bf696b42eed7acf5f5161329e54923c04ee1c1a262cb278bc4c264d25a94b5b8a94e027b583ab79676ab0027965ecaa65e19343fb9bc541364da0423aebd8aa28bc46510360ddfaee9a0cd5943bd84df24377f5427ea1ec5842b42578caf99abfe6414c91591c5d4ba70bf6be78b4cb4109606c9bf07af16662a1f1ee5ee5e42e63193d1075fb45b96885553468c34f6dd813fc1456e20c3643bbbc8096607f555ca0caacb7077a88786df32850499f7f5c8144ffdb77b4a76529e8669fc036ec012cb1411c758c83fea436e22e7a870d4c67a3b836cf91d57003a419d8b462dcc4d6ce0a3bd54c8bb4ee8fe0b4ea6e1ed2958d3790ea6d9ccad85c582dbf6b9c22f327a161ff3723bc58f4fb5d4878c4d07279b0e02ef450d3f36a8833ebc4959aa7dd1c44d4c7ab08a0751138c9bb1079ee3d1310507effb3f2c320fd2f464ab0a7eea5ddeb246ad47e45ae1f6eb28f246f5681f275d448e47006a5b6aa5e21748f60904495521797773502307d2293fd1629de7682d9cf1bc8ebb0fff4654ca7c972e5813277e244f8a7924e7f46100454f318ddec49a1d977c1337e5970d4c8b5ccda09130fa691c0ff2ee1f49a2a7ad6b6c4ad5aa4001bcc804771fb3ba006949f582d539677857505558012437fcb7bb96a873e02ae7c4c117834e4407236d71584eb321791529c8efc0fa18801d5ec73556fa8706723031b89ed862b791feb9ccd7d076e27773933126aa61f5db8722fd881350cf8429c2482b077371a1fce33667610deec895355c908505d9921125c68f3f055651de16d20f428ccaaa73a3a2aa524f91f829cc532c84b793c3cc14e6432583bcd0ecd302c23245a66712a72df982ac9d160bbeac394356c9e85d4274d1e2bcff795fd673a95fb936bf4af43745c2da88eacfdac28f0dff3a9e546ec1e3511b756d1bf224ea34c1e9a496d1c9e02db8ec07d7831c9ef2838686f704b17478627c136f3f02b1431debb6a950f38379a1d0f4ea4cee191b5b7025c4a3e246ded78a95e21f88c4feb215f81bef4773ba7a9b627791709c1cf1b762eabb89c4eae248856058801602725d064998e5c645eded37ab53a613e8340743c24dd9babb2e2d3d4d93901ef7da63523a9582e45962842265b548463756c026308e4a90c2550bc6bf0f6b4e19d94dd9f9f8015b26e04ce07781a650470041bec0797d68509c98fbafae3904d9376c1ff8e82de63c3409ec2dd2083f3327df5dc89deff88e030d9514d5fa20ea52788e6537ab1e133b7447467a70815d2098bff7bfd3428653715459394163909498e9302c46e5746bfda4a96b92f1f7da641836