{"uuid": "036293b2-e8f5-4990-924e-c82bb211be2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25157", "type": "seen", "source": "https://t.me/hacking_Attack/119634", "content": "Black Hat Ethical Hacking\nFake WinRAR PoC on GitHub Spreads VenomRAT Malware\n\nFake WinRAR PoC on GitHub Spreads VenomRAT Malware\nPost Views: 3 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA threat actor recently attempted to distribute VenomRAT malware by uploading a fake proof-of-concept (PoC) exploit for a recently fixed WinRAR vulnerability on GitHub.Palo Alto Networks\u2019 Unit 42 team of researchers identified this malicious activity, noting that the attacker published the malicious code on GitHub on August 21, 2023.\n\nAlthough this attack is no longer active, it serves as a reminder of the potential dangers associated with obtaining PoCs from GitHub and running them without careful scrutiny to ensure their safety. Fake WinRAR PoC\n\nThe Fake WinRAR PoC The counterfeit PoC pertains to the CVE-2023-40477 vulnerability, which is an arbitrary code execution flaw that can be triggered when specially crafted RAR files are opened on versions of WinRAR released before version 6.23.\n\nThe Trend Micro Zero Day Initiative discovered this vulnerability and reported it to WinRAR on June 8, 2023. However, they did not publicly disclose it until August 17, 2023. WinRAR promptly addressed the issue in version 6.23, released on August 2.\n\nAn actor known as \u201cwhalersplonk\u201d wasted no time, taking advantage of the situation by attempting to distribute malware under the guise of an exploit code for the newly discovered WinRAR vulnerability.\nCVE-2023-40477\u8fd9\u4e2aPoc\u6709\u95ee\u9898\n\u6709\u95ee\u9898\u7684Github\u5730\u5740\uff1ahttps://t.co/UXVQpTk1wq\n\u4e0d\u8981\u5c1d\u8bd5\u8fd0\u884c\u8be5Poc\uff01\uff01\uff01\nPlease do not attempt to run this Poc\uff01\uff01\uff01 pic.twitter.com/8BZJlt9GKP\n\n\u2014 \u66fe\u54e5 (@AabyssZG) August 22, 2023\n\u201cRed teamer\u201d warns about the malicious PoC on Twitter\n\nThe threat actor went to great lengths to lend credibility to the malicious package. They included a summary in the README file and a Streamable video demonstrating how to use the PoC.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nHowever, Unit 42\u2019s investigation revealed that the counterfeit Python PoC script was actually a modified version of a publicly available exploit for another vulnerability, CVE-2023-25157. This particular flaw is a critical SQL injection vulnerability affecting GeoServer.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/Security/30/real-mod.png Real PoC (left) and modified script (right) (Unit 42)\n\nWhen executed, instead of running the exploit, the PoC generates a batch script that downloads an encoded PowerShell script and executes it on the victim\u2019s machine.\n\nThis PowerShell script downloads the VenomRAT malware and schedules it to run every three minutes. VenomRAT Infections\n\nOnce VenomRAT infiltrates a Windows device, it initiates a key logger that records all keystrokes and stores them in a local text file.\nSubsequently, the malware establishes communication with a command and control (C2) server. From there, it can receive one of nine commands for execution on the compromised device:\n\n1. plu_gin: Activates a registry-stored plugin.\n2. HVNCStop: Terminates the \u201ccvtres\u201d process.\n3. loadofflinelog: Transmits offline key logger data from %APPDATA%.\n4. save_Plugin: Saves a plugin to the registry under a hardware ID.\n5. runningapp: Displays active processes.\n6. keylogsetting: Updates the key log file in %APPDATA%.\n7. init_reg: Deletes subkeys in the Software registry under a hardware ID.\n8. Po_ng: Measures the time between sending a PING to the C2 server and receiving this command.\n9. filterinfo: Lists installed apps and active processes from the registry.\n\nAs the VenomRAT malware can potentially be used to deploy additional payloads and steal credentials, anyone who executed thi[...]", "creation_timestamp": "2026-09-01T20:00:47.530502Z"}