cve/2018/CVE-2018-20250.md

### [CVE-2018-20250](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20250)
![](https://img.shields.io/static/v1?label=Product&message=WinRAR&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-36%3A%20Absolute%20Path%20Traversal&color=brighgreen)

### Description

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.

### POC

#### Reference
- http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html
- https://github.com/blau72/CVE-2018-20250-WinRAR-ACE
- https://research.checkpoint.com/extracting-code-execution-from-winrar/
- https://www.exploit-db.com/exploits/46552/
- https://www.exploit-db.com/exploits/46756/

#### Github
- https://github.com/00xtrace/Red-Team-Ops-Toolbox
- https://github.com/0xT11/CVE-POC
- https://github.com/0xdeadgeek/Red-Teaming-Toolkit
- https://github.com/1o24er/RedTeam
- https://github.com/20142995/sectool
- https://github.com/2lambda123/m0chan-Red-Teaming-Toolkit
- https://github.com/3m1za4/100-Best-Free-Red-Team-Tools-
- https://github.com/6R1M-5H3PH3RD/Red_Teaming_Tool_Kit
- https://github.com/ARPSyndicate/cvemon
- https://github.com/Adastra-thw/KrakenRdi
- https://github.com/AeolusTF/CVE-2018-20250
- https://github.com/Al1ex/APT-GUID
- https://github.com/Al1ex/Red-Team
- https://github.com/Apri1y/Red-Team-links
- https://github.com/AzyzChayeb/Redteam
- https://github.com/CVEDB/PoC-List
- https://github.com/CVEDB/awesome-cve-repo
- https://github.com/CVEDB/top
- https://github.com/CnHack3r/Penetration_PoC
- https://github.com/CyberSecurityUP/Adversary-Emulation-Matrix
- https://github.com/DANIELVISPOBLOG/WinRar_ACE_exploit_CVE-2018-20250
- https://github.com/DanielEbert/winafl
- https://github.com/EchoGin404/-
- https://github.com/EchoGin404/gongkaishouji
- https://github.com/Echocipher/Resource-list
- https://github.com/Ektoplasma/ezwinrar
- https://github.com/Fa1c0n35/Red-Teaming-Toolkit
- https://github.com/GhostTroops/TOP
- https://github.com/HacTF/poc--exp
- https://github.com/HildeTeamTNT/Red-Teaming-Toolkit
- https://github.com/IversionBY/PenetratInfo
- https://github.com/JERRY123S/all-poc
- https://github.com/LamSonBinh/CVE-2018-20250
- https://github.com/Mr-xn/Penetration_Testing_POC
- https://github.com/Mrnmap/RedTeam
- https://github.com/Ondrik8/RED-Team
- https://github.com/Ostorlab/KEV
- https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
- https://github.com/QAX-A-Team/CVE-2018-20250
- https://github.com/RxXwx3x/Redteam
- https://github.com/STP5940/CVE-2018-20250
- https://github.com/Saidul-M-Khan/Red-Teaming-Toolkit
- https://github.com/Team-BT5/WinAFL-RDP
- https://github.com/Th3k33n/RedTeam
- https://github.com/WyAtu/CVE-2018-20250
- https://github.com/YIXINSHUWU/Penetration_Testing_POC
- https://github.com/albovy/ransomwareMALW
- https://github.com/allwinnoah/CyberSecurity-Tools
- https://github.com/alphaSeclab/sec-daily-2019
- https://github.com/arkangel-dev/CVE-2018-20250-WINRAR-ACE-GUI
- https://github.com/astroicers/pentest_guide
- https://github.com/avboy1337/Vulnerabilities
- https://github.com/bacon-tomato-spaghetti/WinAFL-RDP
- https://github.com/bb33bb/Vulnerabilities
- https://github.com/blunden/UNACEV2.DLL-CVE-2018-20250
- https://github.com/cyberanand1337x/bug-bounty-2022
- https://github.com/developer3000S/PoC-in-GitHub
- https://github.com/dk47os3r/hongduiziliao
- https://github.com/easis/CVE-2018-20250-WinRAR-ACE
- https://github.com/eastmountyxz/CSDNBlog-Security-Based
- https://github.com/eastmountyxz/CVE-2018-20250-WinRAR
- https://github.com/eastmountyxz/NetworkSecuritySelf-study
- https://github.com/eastmountyxz/SystemSecurity-ReverseAnalysis
- https://github.com/githuberxu/Safety-Books
- https://github.com/googleprojectzero/winafl
- https://github.com/gyaansastra/Red-Team-Toolkit
- https://github.com/hardik05/winafl-powermopt
- https://github.com/hasee2018/Penetration_Testing_POC
- https://github.com/hasee2018/Safety-net-information
- https://github.com/hectorgie/PoC-in-GitHub
- https://github.com/hktalent/TOP
- https://github.com/hudunkey/Red-Team-links
- https://github.com/huike007/penetration_poc
- https://github.com/huike007/poc
- https://github.com/hwiwonl/dayone
- https://github.com/jbmihoub/all-poc
- https://github.com/jnadvid/RedTeamTools
- https://github.com/john-80/-007
- https://github.com/joydragon/Detect-CVE-2018-20250
- https://github.com/kimreq/red-team
- https://github.com/landscape2024/RedTeam
- https://github.com/likescam/CVE-2018-20250
- https://github.com/lions2012/Penetration_Testing_POC
- https://github.com/lnick2023/nicenice
- https://github.com/lp008/Hack-readme
- https://github.com/lxg5763/cve-2018-20250
- https://github.com/manulqwerty/Evil-WinRAR-Gen
- https://github.com/mave12/Doc-PDF-exploit-collection
- https://github.com/mooneee/Red-Teaming-Toolkit
- https://github.com/mrinconroldan/red-teaming-toolkit
- https://github.com/n4r1b/WinAce-POC
- https://github.com/nmweizi/CVE-2018-20250-poc-winrar
- https://github.com/nobiusmallyu/kehai
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/password520/Penetration_PoC
- https://github.com/pranav0408/WinAFL
- https://github.com/qazbnm456/awesome-cve-poc
- https://github.com/ray-cp/Vuln_Analysis
- https://github.com/scriptsboy/Red-Teaming-Toolkit
- https://github.com/sec00/AwesomeExploits
- https://github.com/shengshengli/NetworkSecuritySelf-study
- https://github.com/slimdaddy/RedTeam
- https://github.com/soapffz/soapffzblogposts
- https://github.com/soosmile/POC
- https://github.com/ssumachai/CS182-Project
- https://github.com/svbjdbk123/-
- https://github.com/t31m0/Red-Teaming-Toolkit
- https://github.com/tannlh/CVE-2018-20250
- https://github.com/teasmiler/CVE-18-20250
- https://github.com/technicaldada/hack-winrar
- https://github.com/thezimtex/red-team
- https://github.com/twensoo/PersistentThreat
- https://github.com/tzwlhack/CVE-2018-20250
- https://github.com/v3nt4n1t0/DetectWinRARaceVulnDomain.ps1
- https://github.com/wateroot/poc-exp
- https://github.com/weeka10/-hktalent-TOP
- https://github.com/winterwolf32/CVE-S---Penetration_Testing_POC-
- https://github.com/wrlu/Vulnerabilities
- https://github.com/x86trace/Red-Team-Ops-Toolbox
- https://github.com/xbl3/Red-Teaming-Toolkit_infosecn1nja
- https://github.com/xbl3/awesome-cve-poc_qazbnm456
- https://github.com/xiaoZ-hc/redtool
- https://github.com/xuetusummer/Penetration_Testing_POC
- https://github.com/ycdxsb/Exploits
- https://github.com/yedada-wei/-
- https://github.com/yedada-wei/gongkaishouji
- https://github.com/yrime/WinAflCustomMutate
- https://github.com/yut0u/RedTeam-BlackBox
- https://github.com/zeronohacker/CVE-2018-20250