Unpacking ¯\(°_o)/¯

[Teers2]

When unpacking, hi.exe is unpacked by creating another copy of the AppData folder on the desktop. Must be "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup". It turns out "C:\Users\user\ Desktop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
WinRar 5.61 release.

[WyAtu]

you set the target filename is C:\C:C:../AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hi.exe, but you unpacked this file in the C:\Users\user\Desktop\CVE-2018-20250, it is unpacked to C:\Users\user\Desktop\CVE-2018-20250\../AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hi.exe, that is why your hi.exe is in the C:\Users\user\Desktop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.

if you know the computer username of the victim, you can set the filename C:\C:\C:\Users\someone\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe, otherwise, set the filename like i wrote it in the exp, and if the victim unpacks the file in C:\Users\someone\Desktop\、 C:\Users\someone\Downloads、C:\Users\someone\Documents`, the new file will generate in the victim's user startup directory.

[Teers2]

God .. I checked everything and .. I was ashamed. Sorry for such questions.

[WyAtu]

It's nothing.🙂