CVE-2023-38831 Exploit - Bait and Switch Archive Generator

Overview

This Python script is designed to generate a "bait and switch" archive file. It is meant for educational and ethical hacking purposes only. Please ensure that you have the necessary permissions before using this script.

A "bait and switch" archive is an archive that contains two different versions of files with the same extension, making it difficult for security software to detect malicious content. It typically includes a legitimate file (bait) and a malicious script (switch). When an unsuspecting user or system extracts and opens the archive, the script can be executed, potentially compromising the system.

Usage

Syntax

python cve-2023-38831.py <BAIT_NAME> <SCRIPT_NAME> <OUTPUT_NAME>

Parameters

• <BAIT_NAME>: The name of the bait file (e.g., test.pdf).
• <SCRIPT_NAME>: The name of the malicious script file (e.g., script.bat).
• <OUTPUT_NAME>: The name of the output bait and switch archive file (e.g., test.rar).

Special Command

You can also run a proof-of-concept (poc) command to see how the script works without creating an archive:

python cve-2023-38831.py poc

How It Works

1. The script takes the bait file, script file, and output name as input parameters.
2. It creates a temporary directory named TEMPLATE.
3. Inside the TEMPLATE directory, it creates a subdirectory with the same name as the bait file (e.g., my_bait.pdfA).
4. It copies the script file into the subdirectory with the name <BAIT_NAME>A.cmd (e.g., my_bait.pdfA.cmd) and the bait file into the TEMPLATE directory with the name <BAIT_NAME>B (e.g., my_bait.pdfB).
5. It compresses the TEMPLATE directory into a ZIP archive.
6. It opens the ZIP archive, replaces occurrences of <BAIT_NAME>A with <BAIT_NAME> and <BAIT_NAME>B with <BAIT_NAME> in the binary content.
7. It saves the modified content as the specified output name.

Important Note

This script is for educational purposes only and should not be used for any malicious activities. Use it responsibly and with proper authorization. Unauthorized use of this script may violate laws and regulations

POC