mirror of
https://github.com/s-b-repo/rustsploit
synced 2026-06-27 09:54:12 +00:00
Update changelog.md
This commit is contained in:
S.B
+646
-231
@@ -1981,11 +1981,10 @@ let pair = {
|
||||
guard.recv().await
|
||||
};
|
||||
|
||||
let Some((user, pass)) = pair else { break };
|
||||
|
||||
if stop_flag.load(Ordering::Relaxed) { // ❌ Check happens AFTER receiving work
|
||||
break;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -2393,6 +2392,12 @@ Removed unused import: Removed Read from the imports since it's not directly use
|
||||
Fixed error type: FtpError::ConnectionError expects an Error type, not a String. Changed it to use std::io::Error::new() to create a proper error from the I/O error.
|
||||
|
||||
|
||||
let Some((user, pass)) = pair else { break };
|
||||
|
||||
if stop_flag.load(Ordering::Relaxed) { // ❌ Check happens AFTER receiving work
|
||||
break;
|
||||
}
|
||||
|
||||
Removed the unused rdp dependency, which should eliminate the atomic-polyfill and atty warnings. The RDP bruteforce module uses external commands (xfreerdp/rdesktop), not the rdp crate.
|
||||
For the async-std warning from suppaftp, it's a transitive dependency and only a warning (not a vulnerability). We can wait for suppaftp to update or consider alternatives later.
|
||||
Summary of fixes:
|
||||
@@ -2415,46 +2420,6 @@ The remaining async-std warning is from suppaftp's transitive dependencies and i
|
||||
|
||||
|
||||
|
||||
### migration to 2024
|
||||
|
||||
Fixed the Rust 2024 edition compatibility issues:
|
||||
|
||||
Fixed binding modifiers in fortinet_bruteforce.rs:
|
||||
|
||||
Removed ref from pattern matches (if let Some(ref r) = realm → if let Some(r) = realm)
|
||||
Rust 2024's improved match ergonomics automatically handle references, so ref is no longer needed
|
||||
|
||||
Fixed unsafe function calls in shell.rs:
|
||||
Wrapped env::set_var and env::remove_var calls in unsafe blocks
|
||||
In Rust 2024, these functions are marked unsafe because they can cause data races in multi-threaded contexts
|
||||
|
||||
The code should now compile with Rust 2024 edition. The changes are:
|
||||
Match ergonomics: Rust 2024 automatically infers when you need a reference, so explicit ref is unnecessary
|
||||
Unsafe environment variables: Environment variable manipulation is now unsafe to prevent data races
|
||||
|
||||
Environment variables (thread-safe):
|
||||
Added a Mutex to synchronize access to environment variable operations
|
||||
Prevents data races when multiple threads access env vars
|
||||
The unsafe block is still needed (Rust 2024 requirement), but it's now thread-safe
|
||||
|
||||
Buffer conversions (bounds-checked):
|
||||
Added bounds checking before converting MaybeUninit buffers to slices
|
||||
Prevents buffer overflows
|
||||
The unsafe block is still needed for the raw pointer conversion, but it's now validated
|
||||
|
||||
System calls (documented):
|
||||
libc::geteuid() is a simple read-only system call that can't cause memory safety issues
|
||||
Added a comment explaining it's safe in practice
|
||||
|
||||
Why we can't completely eliminate unsafe:
|
||||
|
||||
env::set_var/remove_var: Marked unsafe in Rust 2024 due to potential data races; we use a Mutex to make it thread-safe
|
||||
std::slice::from_raw_parts: Required for converting uninitialized buffers from raw sockets; we validate bounds first
|
||||
libc::geteuid(): Required for system calls; it's a safe read-only operation
|
||||
The code is now as safe as possible while still performing these low-level operations. The unsafe blocks are guarded with synchronization and validation.
|
||||
If you want to avoid unsafe entirely, we'd need to:
|
||||
Use a different approach for proxy configuration (e.g., pass proxy settings directly to reqwest instead of using env vars)
|
||||
Use higher-level socket APIs that don't require raw buffer manipulation
|
||||
|
||||
|
||||
|
||||
@@ -2472,196 +2437,646 @@ Use higher-level socket APIs that don't require raw buffer manipulation
|
||||
|
||||
|
||||
|
||||
Summary of API fixes
|
||||
hickory-client 0.25.2:
|
||||
Changed AsyncClient → Client
|
||||
Moved rr imports from hickory_client::rr to hickory_proto::rr
|
||||
Moved ResponseCode from hickory_client::proto::op to hickory_proto::op
|
||||
suppaftp 7.0.7:
|
||||
Changed imports from suppaftp::{AsyncFtpStream, ...} to suppaftp::tokio::{AsyncFtpStream, ...}
|
||||
Changed suppaftp::async_native_tls::TlsConnector to suppaftp::tokio::native_tls::TlsConnector
|
||||
rustls (via tokio-rustls 0.26.4):
|
||||
Added use rustls::pki_types::ServerName;
|
||||
Changed tokio_rustls::rustls::ServerName to ServerName
|
||||
Removed .with_safe_defaults() (no longer needed in newer rustls)
|
||||
All compilation errors should be resolved. Try running cargo build or cargo run again. If there are remaining issues, share the error messages.
|
||||
|
||||
|
||||
hickory-client UdpClientStream import:
|
||||
Changed from hickory_client::udp::UdpClientStream to hickory_proto::udp::UdpClientStream
|
||||
In version 0.25, the UDP module moved to hickory_proto
|
||||
suppaftp TlsConnector import:
|
||||
Changed from suppaftp::tokio::native_tls::TlsConnector to native_tls::TlsConnector
|
||||
TlsConnector comes from the native-tls crate, not from suppaftp
|
||||
rustls ServerName lifetime issue:
|
||||
ServerName::try_from() requires a 'static lifetime
|
||||
Converted host to an owned String first: let host_owned = host.to_string();
|
||||
Then used: ServerName::try_from(host_owned.as_str())
|
||||
Applied to both occurrences in the HTTP/2 exploit module
|
||||
|
||||
1. Async architecture
|
||||
Replaced threadpool and crossbeam-channel with tokio async runtime
|
||||
Converted all I/O operations to async/await
|
||||
Uses tokio::net::TcpStream for async networking
|
||||
2. Statistics tracking
|
||||
Added Statistics struct to track attempts, successes, failures, errors, and retries
|
||||
Real-time progress reporting with colored output
|
||||
Final statistics summary with success rates
|
||||
3. Multiple operation modes
|
||||
Mode 1: Single Target Bruteforce (advanced)
|
||||
Mode 2: Subnet Bruteforce (CIDR notation)
|
||||
Mode 3: Batch Scanner (multiple targets)
|
||||
Mode 4: Quick Default Check (single target)
|
||||
Mode 5: Subnet Default Check (CIDR)
|
||||
4. Configuration management
|
||||
JSON configuration file support (save/load)
|
||||
Interactive configuration builder
|
||||
Configuration validation
|
||||
5. Advanced features
|
||||
Retry on error with configurable max retries
|
||||
Pre-validation of SMTP targets
|
||||
Configurable delays between attempts
|
||||
Connection and read timeouts
|
||||
Custom auth method selection (PLAIN, LOGIN)
|
||||
Append mode for output files
|
||||
6. Streaming mode
|
||||
Automatic detection of large wordlists (>500MB)
|
||||
Streaming mode for memory efficiency
|
||||
Memory mode for faster processing
|
||||
7. Improved output
|
||||
Colored output with better formatting
|
||||
Progress indicators
|
||||
Better error messages
|
||||
Banner display
|
||||
The module now matches the telnet module's functionality while keeping SMTP-specific authentication logic (AUTH PLAIN and AUTH LOGIN). All code compiles without errors or warnings.
|
||||
|
||||
|
||||
Refactored the FTP bruteforce module to match the telnet module's features. Changes:
|
||||
1. Async architecture
|
||||
Uses tokio async runtime with channels
|
||||
Worker/producer pattern for concurrent execution
|
||||
Async I/O operations throughout
|
||||
2. Statistics tracking
|
||||
Added Statistics struct to track attempts, successes, failures, errors, and retries
|
||||
Real-time progress reporting with colored output
|
||||
Final statistics summary with success rates
|
||||
3. Multiple operation modes
|
||||
Mode 1: Single Target Bruteforce (advanced)
|
||||
Mode 2: Subnet Bruteforce (CIDR notation)
|
||||
Mode 3: Batch Scanner (multiple targets)
|
||||
Mode 4: Quick Default Check (single target)
|
||||
Mode 5: Subnet Default Check (CIDR)
|
||||
4. Configuration management
|
||||
JSON configuration file support (save/load)
|
||||
Interactive configuration builder
|
||||
Configuration validation
|
||||
5. Advanced features
|
||||
Retry on error with configurable max retries
|
||||
Pre-validation of FTP targets
|
||||
Configurable delays between attempts
|
||||
Connection and read timeouts
|
||||
FTPS support (optional)
|
||||
Append mode for output files
|
||||
6. Streaming mode
|
||||
Automatic detection of large wordlists (>500MB)
|
||||
Streaming mode for memory efficiency
|
||||
Memory mode for faster processing
|
||||
7. Improved output
|
||||
Colored output with better formatting
|
||||
Progress indicators
|
||||
Better error messages
|
||||
Banner display
|
||||
The module now matches the telnet module's functionality while preserving FTP-specific features (plain FTP and FTPS support). All code compiles with only minor warnings about unused imports that can be cleaned up if needed.
|
||||
|
||||
|
||||
Dead Code Removal Summary
|
||||
Removed format_addr() — replaced by normalize_target() used throughout
|
||||
Removed BUFFER_SIZE constant — unused
|
||||
Removed unused SocketAddr import — no longer needed after removing format_addr()
|
||||
Fixed unused socket variable in check_port() — removed unused parsing
|
||||
Verification
|
||||
All functions are wired up and used:
|
||||
run() → mode selection functions
|
||||
Mode functions → execution functions (run_ftp_bruteforce, execute_batch_scan, etc.)
|
||||
Execution functions → worker/producer functions
|
||||
All utility functions are called from the execution paths
|
||||
All configuration functions are used in interactive mode
|
||||
All prompt functions are used for user input
|
||||
The module compiles with no linter errors or warnings. All code is implemented and wired up.
|
||||
|
||||
|
||||
|
||||
ONVIF Bruteforce Module Complete
|
||||
|
||||
Created an ONVIF bruteforce module similar to telnet_bruteforce.rs with:
|
||||
|
||||
Features implemented:
|
||||
HTTP Authentication Support:
|
||||
HTTP Digest authentication (MD5-based)
|
||||
HTTP Basic authentication (Base64-encoded)
|
||||
Automatic fallback between methods
|
||||
|
||||
Operation Modes:
|
||||
Single Target Bruteforce (advanced)
|
||||
Subnet Bruteforce (CIDR notation)
|
||||
Batch Scanner (multiple targets)
|
||||
Quick Default Check (single target)
|
||||
Subnet Default Check (CIDR)
|
||||
|
||||
Advanced Features:
|
||||
Async architecture using tokio
|
||||
Statistics tracking with atomic counters
|
||||
Configuration management (JSON save/load)
|
||||
Wordlist streaming for large files
|
||||
Retry logic with configurable attempts
|
||||
Progress reporting
|
||||
Concurrent worker threads
|
||||
Stop-on-success option
|
||||
|
||||
ONVIF-Specific:
|
||||
Default ports: 8000, 8888, 8999
|
||||
Configurable ONVIF path (default: /onvif/device_service)
|
||||
Default credentials for security cameras/NVRs
|
||||
HTTP Digest challenge parsing and response generation
|
||||
|
||||
Module Integration:
|
||||
Added to mod.rs for proper module registration
|
||||
Follows the same structure as other bruteforce modules
|
||||
No linting errors
|
||||
The module is ready to use and will be automatically discovered by the build system since it has the pub async fn run(target: &str) signature.
|
||||
|
||||
Bugs Fixed:
|
||||
MD5 import issue: Changed from use md5::{Md5, Digest} to use md5; and updated all Md5::digest() calls to md5::compute() to match the md5 crate version 0.8.0 API used in the codebase.
|
||||
Address handling bug: Fixed URL construction where normalize_target returns "host:port" but the code was using it directly in URLs, causing malformed URLs like "http://host:port:8000/...". Now extracts just the IP/hostname using socket_addr.ip().to_string().
|
||||
Missing chrono import: Added use chrono; for chrono::Local::now() and chrono::Utc::now() calls.
|
||||
Parameter naming: Updated spawn_worker function parameter from addr to host to match the corrected usage.
|
||||
|
||||
|
||||
|
||||
|
||||
### arc 2 nimla patching
|
||||
|
||||
|
||||
Summary of fixes
|
||||
Removed unused imports:
|
||||
Removed SocketAddr from top-level imports (used locally where needed)
|
||||
Removed AsyncReadExt from top-level imports (used locally where needed)
|
||||
Removed unused constant:
|
||||
Removed BUFFER_SIZE constant that was never used
|
||||
Fixed unused variable warning:
|
||||
Changed return_code to _return_code in validate_mqtt_target to indicate it's intentionally unused
|
||||
Module wiring verified:
|
||||
Module registered in src/modules/creds/generic/mod.rs
|
||||
Public run function exists with correct signature: pub async fn run(target: &str) -> Result<()>
|
||||
Worker functions correctly call try_mqtt_login
|
||||
All prompt functions are defined and accessible
|
||||
All helper functions are implemented
|
||||
The MQTT bruteforce module is now:
|
||||
Warning-free
|
||||
Properly wired into the module system
|
||||
Ready to be discovered by the build script
|
||||
Fully functional with all features implemented
|
||||
The module can be used via:
|
||||
Interactive shell: run creds/generic/mqtt_bruteforce <target>
|
||||
CLI: --command creds --module generic/mqtt_bruteforce --target <target>
|
||||
API: Through the API endpoint for running modules
|
||||
All code is working and properly integrated.
|
||||
|
||||
Analyze and fix ABUS variant1 module - add colored output, standardize features
|
||||
Analyze and fix ABUS variant2 module - add colored output, standardize features
|
||||
Review and standardize other exploit modules for consistency
|
||||
Verify all modules compile and logic is correct
|
||||
Based on my analysis, here are the key features that should be standardized across exploit modules where compatible:
|
||||
Colored output using the colored crate for better UX
|
||||
Timeout configuration for HTTP clients
|
||||
IPv6 normalization
|
||||
SSL certificate skip for testing targets with self-signed certs
|
||||
Informative banners/output with status indicators
|
||||
Let me update the ABUS variant1 module to have these standardized features:
|
||||
|
||||
|
||||
ABUS Security Camera CVE-2023-26609 Modules
|
||||
Variant 1 (abussecurity_camera_cve202326609variant1.rs)
|
||||
|
||||
Features added:
|
||||
|
||||
Colored output using the colored crate for better UX
|
||||
Display banner with module information
|
||||
Timeout configuration (10 second default)
|
||||
Improved prompts with colored formatting
|
||||
Stage indicators (Stage 1/2/3) for the SSH persistence flow
|
||||
Better error messages with red coloring for failures
|
||||
Status-based output - green for success, red for failure
|
||||
Variant 2 (abussecurity_camera_cve202326609variant2.rs)
|
||||
|
||||
Features added:
|
||||
|
||||
Colored output using the colored crate
|
||||
Display banner with module information
|
||||
Timeout configuration (10 second default)
|
||||
Input validation - checks for empty username/password
|
||||
Stage indicators for the SSH persistence flow
|
||||
Improved user feedback with colored status messages
|
||||
Other Modules Updated
|
||||
I also standardized these modules with colored output, banners, timeouts, and improved UX:
|
||||
ACTi ACM-5611 RCE - Added banner, colored output, port prompts, vulnerability check feedback
|
||||
AVTech Camera CVE-2024-7029 - Added banner, colored output, improved shell interface
|
||||
TP-Link WR740N DoS - Added banner, colored output, improved prompts
|
||||
Zabbix SQL Injection - Added banner, colored output, timing-based detection improvement
|
||||
Uniview NVR Password Disclosure - Added banner, colored output, improved feedback
|
||||
Sample Exploit - Added banner, colored output for demonstration
|
||||
Standardized Features Across All Modules
|
||||
|
||||
The following features are now consistently available where compatible:
|
||||
|
||||
Feature Description
|
||||
Colored Output Using colored crate for cyan info, yellow warnings, green success, red errors
|
||||
Display Banners ASCII art banners showing module name, CVE, and description
|
||||
Timeout Configuration Configurable HTTP timeouts (default 10 seconds)
|
||||
SSL Certificate Skip danger_accept_invalid_certs(true) for testing self-signed certs
|
||||
IPv6 Normalization Proper handling of IPv6 addresses with bracket normalization
|
||||
Input Validation Checking for empty required fields
|
||||
Stage Indicators Yellow stage markers for multi-step exploits
|
||||
All modules compile successfully with no warnings from cargo clippy. The code logic remains intact and all original functionality is preserved.
|
||||
|
||||
|
||||
Credential Modules Standardized
|
||||
Camera Modules
|
||||
acti_camera_default.rs - Added colored output, display banner, timeout constant, and colored status messages for FTP/SSH/Telnet/HTTP checks
|
||||
Generic Modules
|
||||
Module Changes
|
||||
ftp_anonymous.rs Added display_banner(), colored output, timeout constant
|
||||
ftp_bruteforce.rs Added display_banner(), updated header styling
|
||||
sample_cred_check.rs Added display_banner(), colored output, timeout with danger_accept_invalid_certs
|
||||
ssh_bruteforce.rs Already had banner and statistics - unchanged
|
||||
telnet_bruteforce.rs Already had comprehensive banner and statistics - unchanged
|
||||
rdp_bruteforce.rs Added display_banner(), updated header styling
|
||||
smtp_bruteforce.rs Added display_banner(), improved colored output for success/failure
|
||||
pop3_bruteforce.rs Already had banner and statistics - unchanged
|
||||
snmp_bruteforce.rs Added display_banner(), updated header styling
|
||||
rtsp_bruteforce_advanced.rs Added display_banner(), updated header styling
|
||||
l2tp_bruteforce.rs Added display_banner(), updated header styling
|
||||
fortinet_bruteforce.rs Added display_banner(), updated header styling
|
||||
enablebruteforce.rs Added display_banner(), full colored output
|
||||
Standard Features Added
|
||||
|
||||
All modules now have:
|
||||
|
||||
✅ Cyan-bordered ASCII banner with module title
|
||||
✅ Colored target information ([*] in cyan)
|
||||
✅ Green success messages ([+])
|
||||
✅ Yellow warning/failure messages ([-])
|
||||
✅ Red error messages ([!])
|
||||
✅ Consistent use of colored crate
|
||||
✅ IPv6 address handling where applicable
|
||||
✅ Timeout constants where applicable
|
||||
The project compiles cleanly with cargo build and passes cargo clippy with no warnings.
|
||||
|
||||
Critical Issues Found:
|
||||
SSH Bruteforce - Semaphore acquired BEFORE spawning task (blocks task creation)
|
||||
FTP/RDP/SNMP Bruteforce - Missing progress statistics
|
||||
Several modules - Missing retry logic and connection rate limit handling
|
||||
Let me fix these:
|
||||
|
||||
|
||||
Critical Fixes:
|
||||
|
||||
1. SSH Bruteforce - Fixed concurrency bug
|
||||
|
||||
The semaphore was being acquired BEFORE spawning the task, which serialized task creation. Now acquires permit INSIDE the spawned task for true concurrent execution.
|
||||
|
||||
2. Enable Bruteforce (ulimit) - Fixed non-functional code
|
||||
|
||||
Running ulimit -n 65535 in a subprocess does NOT affect the parent process. Rewrote to use setrlimit() syscall directly, which actually raises the file descriptor limit in the current process.
|
||||
Standardized Features Added
|
||||
|
||||
Added Statistics tracking and real-time progress reporting to:
|
||||
Module Concurrency Model Progress Reporting Added
|
||||
FTP Bruteforce tokio async + Semaphore ✅
|
||||
RDP Bruteforce tokio async + Semaphore ✅
|
||||
SNMP Bruteforce tokio async + spawn_blocking ✅
|
||||
RTSP Bruteforce tokio async + Semaphore ✅
|
||||
L2TP Bruteforce tokio async + Semaphore ✅
|
||||
Fortinet Bruteforce tokio async + Semaphore ✅
|
||||
SMTP Bruteforce ThreadPool + crossbeam ✅
|
||||
Already Correctly Implemented
|
||||
|
||||
Module Notes:
|
||||
|
||||
Telnet Bruteforce Uses tokio async TcpStream (correctly async), already has statistics
|
||||
POP3 Bruteforce Uses ThreadPool + crossbeam (correct for blocking I/O), already has statistics
|
||||
Concurrency Models Verified
|
||||
Async modules (FTP, RDP, SSH, RTSP, L2TP, Fortinet, Telnet): Use tokio::net::TcpStream or spawn_blocking for blocking libraries -
|
||||
|
||||
this is correct
|
||||
|
||||
Blocking modules (POP3, SMTP): Use ThreadPool with crossbeam_channel - this is correct for blocking socket I/O
|
||||
|
||||
All modules now have consistent:
|
||||
|
||||
Real-time progress reporting (attempts/s rate)
|
||||
Statistics summary at completion
|
||||
Colored output for success/failure/errors
|
||||
|
||||
|
||||
|
||||
All fixed. The warnings are resolved:
|
||||
|
||||
enablebruteforce.rs - Removed unused std::process::Command import (no longer needed since we now use the libc syscalls directly)
|
||||
ftp_bruteforce.rs - Removed unused log function (replaced with inline colored output)
|
||||
fortinet_bruteforce.rs - Removed unused log function (replaced with inline colored output)
|
||||
|
||||
|
||||
Standardized Features Added:
|
||||
|
||||
Scanner Banner Colored Output Statistics Progress Save Results
|
||||
sample_scanner.rs ✅ Added ✅ Added ✅ Added ✅ ✅ Added
|
||||
http_title_scanner.rs ✅ Enhanced ✅ Enhanced ✅ Added ✅ Added ✅ Already had
|
||||
http_method_scanner.rs ✅ Enhanced ✅ Enhanced ✅ Added N/A ✅ Already had
|
||||
dns_recursion.rs ✅ Added ✅ Enhanced ✅ Added N/A N/A (targets output)
|
||||
ssdp_msearch.rs ✅ Added ✅ Already had ✅ Added N/A ✅ Added
|
||||
port_scanner.rs ✅ Already had ✅ Already had ✅ Already had ✅ Already had ✅ Already had
|
||||
ping_sweep.rs ✅ Already had ✅ Already had ✅ Already had ✅ Already had ✅ Already had
|
||||
|
||||
Key Improvements:
|
||||
|
||||
Consistent Banners - All scanners now display a cyan-colored ASCII banner with module description
|
||||
Colored Output - Success (green), warnings (yellow), errors (red), info (cyan)
|
||||
Statistics - All scanners report:
|
||||
Total items scanned
|
||||
Successful/Failed counts
|
||||
Duration
|
||||
Rate (where applicable)
|
||||
Save Results - Option to save scan results to file
|
||||
Progress Reporting - Real-time progress for longer scans
|
||||
All modules compile cleanly with no warnings.
|
||||
|
||||
|
||||
Security Enhancements Summary
|
||||
|
||||
main.rs
|
||||
|
||||
Added validate_bind_address() - validates bind address format using SocketAddr::parse(), checks length limits, control characters
|
||||
Added validate_api_key() - validates API key length (max 256 chars), ensures only printable ASCII
|
||||
Added validate_ip_limit() - validates IP limit range (1-10,000)
|
||||
All CLI inputs are now validated before use
|
||||
|
||||
shell.rs
|
||||
|
||||
Added new constants: MAX_URL_LENGTH, MAX_PATH_LENGTH, MAX_PROMPT_INPUT_LENGTH
|
||||
|
||||
Enhanced prompt_for_path():
|
||||
|
||||
Length validation
|
||||
Control character rejection
|
||||
Path traversal prevention (.. blocked)
|
||||
|
||||
Enhanced prompt_string_default():
|
||||
|
||||
Length validation
|
||||
Control character rejection
|
||||
URL format validation (if input looks like URL)
|
||||
|
||||
Enhanced prompt_yes_no():
|
||||
|
||||
Max attempt limiting (10 attempts)
|
||||
Length validation
|
||||
Enhanced prompt_u64() and prompt_usize():
|
||||
Max attempt limiting
|
||||
Length validation
|
||||
Strict digit-only validation
|
||||
Overflow protection with saturating_add()
|
||||
|
||||
config.rs
|
||||
|
||||
Added MAX_TARGET_LENGTH and MAX_HOSTNAME_LENGTH constants
|
||||
|
||||
Enhanced set_target():
|
||||
|
||||
Length validation
|
||||
Control character rejection
|
||||
Path traversal prevention
|
||||
|
||||
Added validate_hostname_or_ip():
|
||||
|
||||
Hostname length validation (DNS max 253)
|
||||
Valid character regex check
|
||||
Format validation (no leading/trailing special chars)
|
||||
Consecutive dot detection
|
||||
|
||||
api.rs
|
||||
|
||||
Added RequestBodyLimitLayer (1MB max) to prevent DoS via large payloads
|
||||
Added MAX_TRACKED_IPS (100,000) and MAX_AUTH_FAILURE_ENTRIES (100,000) limits
|
||||
|
||||
Enhanced track_ip():
|
||||
|
||||
IP string length validation
|
||||
Automatic cleanup when tracker exceeds limits
|
||||
saturating_add() for overflow protection
|
||||
|
||||
Enhanced record_auth_failure():
|
||||
|
||||
IP string length validation
|
||||
Automatic cleanup of expired/old entries
|
||||
saturating_add() for overflow protection
|
||||
utils.rs (already well-secured)
|
||||
Already had comprehensive validation:
|
||||
MAX_TARGET_LENGTH, MAX_MODULE_PATH_LENGTH, MAX_FILE_SIZE
|
||||
Path traversal checks
|
||||
File size limits
|
||||
Proxy URL validation
|
||||
|
||||
|
||||
---
|
||||
|
||||
## v0.4.0 - Comprehensive Security Hardening (November 2025)
|
||||
|
||||
### Input Validation & Security (All Core Files)
|
||||
|
||||
#### main.rs
|
||||
|
||||
- **NEW:** `validate_bind_address()` - Validates bind address format using `SocketAddr::parse()`:
|
||||
- Length limits (max 128 characters)
|
||||
- Control character rejection
|
||||
- Socket address format validation
|
||||
- **NEW:** `validate_api_key()` - Validates API key:
|
||||
- Length limits (max 256 characters)
|
||||
- Only printable ASCII characters allowed
|
||||
- Empty/whitespace rejection
|
||||
- **NEW:** `validate_ip_limit()` - Validates hardening IP limit:
|
||||
- Range validation (1-10,000)
|
||||
- Prevents resource exhaustion
|
||||
|
||||
#### shell.rs
|
||||
|
||||
- **NEW Constants:**
|
||||
- `MAX_URL_LENGTH` (2048) - URL input length limit
|
||||
- `MAX_PATH_LENGTH` (4096) - File path length limit
|
||||
- `MAX_PROMPT_INPUT_LENGTH` (1024) - General prompt input limit
|
||||
|
||||
- **Enhanced `prompt_for_path()`:**
|
||||
- Length validation
|
||||
- Control character rejection
|
||||
- Path traversal prevention (`..` blocked)
|
||||
|
||||
- **Enhanced `prompt_string_default()`:**
|
||||
- Length validation
|
||||
- Control character rejection
|
||||
- Automatic URL format validation when input looks like URL
|
||||
|
||||
- **Enhanced `prompt_yes_no()`:**
|
||||
- Max attempt limiting (10 attempts before default)
|
||||
- Length validation (max 10 chars)
|
||||
- Prevents infinite loops on bad input
|
||||
|
||||
- **Enhanced `prompt_u64()` and `prompt_usize()`:**
|
||||
- Max attempt limiting (10 attempts)
|
||||
- Length validation (max 20 chars)
|
||||
- Strict digit-only validation
|
||||
- Overflow protection
|
||||
- Better error messages
|
||||
|
||||
#### config.rs
|
||||
|
||||
- **NEW Constants:**
|
||||
- `MAX_TARGET_LENGTH` (2048) - Target string limit
|
||||
- `MAX_HOSTNAME_LENGTH` (253) - DNS hostname limit
|
||||
|
||||
- **Enhanced `set_target()`:**
|
||||
- Length validation
|
||||
- Control character rejection
|
||||
- Path traversal prevention (`..`, `//` blocked)
|
||||
- Hostname/IP format validation
|
||||
|
||||
- **NEW:** `validate_hostname_or_ip()` - Validates hostname/IP:
|
||||
- Hostname length validation (DNS max 253)
|
||||
- Valid character regex check (`[a-zA-Z0-9.\-_:\[\]]+`)
|
||||
- Format validation (no leading/trailing special chars)
|
||||
- Consecutive dot detection
|
||||
|
||||
#### api.rs
|
||||
|
||||
- **NEW:** `RequestBodyLimitLayer` (1MB max) - Prevents DoS via large request bodies
|
||||
- **NEW Constants:**
|
||||
- `MAX_REQUEST_BODY_SIZE` (1MB)
|
||||
- `MAX_TRACKED_IPS` (100,000)
|
||||
- `MAX_AUTH_FAILURE_ENTRIES` (100,000)
|
||||
|
||||
- **Enhanced `track_ip()`:**
|
||||
- IP string length validation (max 128 chars)
|
||||
- Automatic cleanup when tracker exceeds limits
|
||||
- Prunes oldest entries, keeps most recent half
|
||||
- `saturating_add()` for overflow protection
|
||||
|
||||
- **Enhanced `record_auth_failure()`:**
|
||||
- IP string length validation (max 128 chars)
|
||||
- Automatic cleanup of expired blocks and old entries (>1 hour)
|
||||
- `saturating_add()` for overflow protection
|
||||
- Memory-efficient housekeeping
|
||||
|
||||
#### Cargo.toml
|
||||
|
||||
- Added `limit` feature to `tower-http` for request body limiting
|
||||
|
||||
### Summary
|
||||
|
||||
All user-facing input paths now have:
|
||||
|
||||
- ✅ Length limits to prevent memory exhaustion
|
||||
- ✅ Control character rejection
|
||||
- ✅ Path traversal prevention
|
||||
- ✅ Format validation where applicable
|
||||
- ✅ Overflow protection
|
||||
- ✅ Maximum attempt limits on prompts
|
||||
- ✅ Automatic resource cleanup in API
|
||||
|
||||
|
||||
Documentation Updates Summary
|
||||
|
||||
|
||||
README.md (Main README)
|
||||
|
||||
|
||||
Highlights Section: Added security hardening to feature list, expanded credential modules to include SNMP, L2TP, Fortinet
|
||||
Module Catalog: Updated with all new modules (Flowise RCE, HTTP/2 Rapid Reset, Jenkins LFI, PAN-OS Auth Bypass, Heartbleed) and expanded scanner capabilities (SYN/ACK scans)
|
||||
Security Features Section: Added new "Input Validation & Security" subsection documenting:
|
||||
Request body limiting (1MB)
|
||||
API key validation
|
||||
Target validation
|
||||
Module path sanitization
|
||||
Resource limits with automatic cleanup
|
||||
Enhanced rate limiting with auto-cleanup
|
||||
Enhanced hardening mode with auto-pruning
|
||||
docs/readme.md (Developer Guide)
|
||||
Table of Contents: Added new "Security & Input Validation" section
|
||||
Code Layout: Updated to include api.rs, config.rs, and telnet-default/ directory
|
||||
NEW Section - Security & Input Validation: Comprehensive developer guide including:
|
||||
Input validation constants table (all limits across files)
|
||||
|
||||
Security patterns with code examples:
|
||||
|
||||
Input length validation
|
||||
Control character rejection
|
||||
Path traversal prevention
|
||||
Hostname/target validation
|
||||
Overflow protection
|
||||
Prompt attempt limiting
|
||||
API security implementation details
|
||||
File operations security guidelines
|
||||
lists/readme.md (Data Files Catalog)
|
||||
Available Files: Added telnet-default/ directory with its files (usernames.txt, passwords.txt, empty.txt)
|
||||
Ideas Section: Added suggestions for SNMP, Fortinet, and SSH default credential lists
|
||||
NEW Section - Security Notes: Guidelines for contributing wordlists:
|
||||
No malicious payloads
|
||||
File size limits
|
||||
UTF-8 encoding requirements
|
||||
Line format standards
|
||||
|
||||
changelog.md
|
||||
|
||||
NEW Section - v0.4.0: Complete documentation of all security enhancements:
|
||||
main.rs validation functions
|
||||
shell.rs prompt hardening
|
||||
config.rs target validation
|
||||
api.rs resource limits and cleanup
|
||||
Cargo.toml changes
|
||||
|
||||
---
|
||||
|
||||
## v0.4.1 - SSHPWN Integration (November 2025)
|
||||
|
||||
### New SSH Attack Modules
|
||||
|
||||
Integrated comprehensive SSH attack framework based on OpenSSH 10.0p1 vulnerability analysis.
|
||||
|
||||
#### SFTP Attack Module (`exploits/ssh/sshpwn_sftp_attacks`)
|
||||
|
||||
Based on sftp-server.c vulnerabilities:
|
||||
|
||||
- **Symlink Injection** (process_symlink) - Create symlinks to sensitive files, bypass chroot
|
||||
- **Setuid Bit Attack** (process_setstat 07777) - Set setuid/setgid bits on uploaded files
|
||||
- **Path Traversal** (process_open) - Escape chroot restrictions
|
||||
- **Partial Write Race** (process_write) - Exploit write atomicity issues
|
||||
|
||||
#### SCP Attack Module (`exploits/ssh/sshpwn_scp_attacks`)
|
||||
|
||||
Based on scp.c vulnerabilities:
|
||||
|
||||
- **Path Traversal** (sink function) - Write outside target directory
|
||||
- **Username Shell Injection** (okname) - Shell metacharacter injection
|
||||
- **Brace Expansion DoS** (brace_expand) - Client-side memory exhaustion
|
||||
- **Command Injection** (do_cmd) - Inject commands via arguments
|
||||
|
||||
#### Session Attack Module (`exploits/ssh/sshpwn_session`)
|
||||
|
||||
Based on session.c vulnerabilities:
|
||||
|
||||
- **Environment Variable Injection** (do_setup_env) - Inject LD_PRELOAD, PATH, etc.
|
||||
- **Command Execution** - Execute commands on authenticated targets
|
||||
- **Reverse Shell** - Multiple payload types (bash, python, nc, perl, php, ruby)
|
||||
- **File Upload/Download** - SFTP-based file transfer
|
||||
|
||||
### New SSH Scanner (`scanners/ssh_scanner`)
|
||||
|
||||
Network reconnaissance for SSH services:
|
||||
|
||||
- CIDR range support
|
||||
- IPv4/IPv6 support
|
||||
- Banner grabbing
|
||||
- Concurrent scanning (configurable threads)
|
||||
- Results export
|
||||
|
||||
### New SSH Credential Modules
|
||||
|
||||
#### SSH User Enumeration (`creds/generic/ssh_user_enum`)
|
||||
|
||||
Timing attack for user enumeration (CVE-2018-15473 style):
|
||||
|
||||
- Measures authentication response timing
|
||||
- Compares against baseline for invalid users
|
||||
- Configurable samples and threshold
|
||||
- Wordlist support
|
||||
|
||||
#### SSH Password Spray (`creds/generic/ssh_spray`)
|
||||
|
||||
Spray single password across multiple targets:
|
||||
|
||||
- Avoids account lockouts
|
||||
- CIDR range support
|
||||
- Concurrent spraying
|
||||
- Results export
|
||||
|
||||
### Module Summary
|
||||
|
||||
| Module | Path | Type |
|
||||
|--------|------|------|
|
||||
| SFTP Attacks | `exploits/ssh/sshpwn_sftp_attacks` | Exploit |
|
||||
| SCP Attacks | `exploits/ssh/sshpwn_scp_attacks` | Exploit |
|
||||
| Session Attacks | `exploits/ssh/sshpwn_session` | Exploit |
|
||||
| SSH Scanner | `scanners/ssh_scanner` | Scanner |
|
||||
| SSH User Enum | `creds/generic/ssh_user_enum` | Credential |
|
||||
| SSH Spray | `creds/generic/ssh_spray` | Credential |
|
||||
|
||||
All modules feature:
|
||||
s
|
||||
- ✅ Colored output with status indicators
|
||||
- ✅ Interactive configuration prompts
|
||||
- ✅ Input validation
|
||||
- ✅ IPv4/IPv6 support
|
||||
- ✅ Results export capability
|
||||
|
||||
|
||||
|
||||
SSHPWN Integration Summary
|
||||
|
||||
New SSH Exploit Modules (src/modules/exploits/ssh/)
|
||||
|
||||
1. sshpwn_sftp_attacks.rs - SFTP Attacks
|
||||
|
||||
Based on sftp-server.c vulnerabilities:
|
||||
|
||||
Symlink Injection - Create symlinks to read sensitive files like /etc/passwd, /etc/shadow
|
||||
Setuid Bit Attack - Set setuid/setgid bits on uploaded files (07777 mask vulnerability)
|
||||
Path Traversal - Escape chroot restrictions via traversal paths
|
||||
Partial Write Race - Exploit write atomicity issues
|
||||
|
||||
2. sshpwn_scp_attacks.rs - SCP Attacks
|
||||
|
||||
Based on scp.c vulnerabilities:
|
||||
|
||||
Path Traversal - Protocol injection, null byte injection, newline injection
|
||||
Username Shell Injection - Exploit incomplete okname() filtering ($(), backticks, pipes)
|
||||
Brace Expansion DoS - Client-side memory exhaustion via {a,b}^n patterns
|
||||
Command Injection - ProxyCommand, rsync-path, ControlPath injection
|
||||
|
||||
3. sshpwn_session.rs - Session Attacks
|
||||
|
||||
Based on session.c vulnerabilities:
|
||||
|
||||
Environment Injection - LD_PRELOAD, LD_LIBRARY_PATH, PATH, BASH_ENV injection
|
||||
Command Execution - Execute arbitrary commands
|
||||
Reverse Shells - 8 payload types (bash, python, python3, nc, perl, php, ruby)
|
||||
File Upload/Download - SFTP-based transfer
|
||||
New SSH Scanner (src/modules/scanners/)
|
||||
|
||||
ssh_scanner.rs - SSH Service Scanner
|
||||
|
||||
CIDR range support (192.168.1.0/24)
|
||||
IP range support (192.168.1.1-254)
|
||||
IPv4/IPv6 support
|
||||
Banner grabbing
|
||||
Concurrent scanning with configurable threads
|
||||
Results export to file
|
||||
New SSH Credential Modules (src/modules/creds/generic/)
|
||||
|
||||
ssh_user_enum.rs - User Enumeration (Timing Attack)
|
||||
|
||||
CVE-2018-15473 style timing attack
|
||||
Measures authentication response times
|
||||
Compares against baseline timing
|
||||
Configurable samples and threshold
|
||||
Wordlist support
|
||||
|
||||
ssh_spray.rs - Password Spray
|
||||
|
||||
Spray single password across multiple targets/users
|
||||
Avoids account lockouts
|
||||
CIDR range support
|
||||
Concurrent spraying
|
||||
Results export
|
||||
Module Access Paths
|
||||
Module Full Path Short Name
|
||||
SFTP Attacks exploits/ssh/sshpwn_sftp_attacks sshpwn_sftp_attacks
|
||||
SCP Attacks exploits/ssh/sshpwn_scp_attacks sshpwn_scp_attacks
|
||||
Session Attacks exploits/ssh/sshpwn_session sshpwn_session
|
||||
SSH Scanner scanners/ssh_scanner ssh_scanner
|
||||
User Enumeration creds/generic/ssh_user_enum ssh_user_enum
|
||||
Password Spray creds/generic/ssh_spray ssh_spray
|
||||
All modules compile cleanly and follow the RustSploit patterns with colored output, interactive prompts, and input validation.
|
||||
|
||||
|
||||
Summary of fixes:
|
||||
|
||||
Fixed format string error in sshpwn_scp_attacks.rs:227:
|
||||
Rust doesn't support Python's {:,} format for thousands separators
|
||||
Added a format_number() helper function that formats numbers with comma separators
|
||||
Removed unused import in sshpwn_sftp_attacks.rs:15:
|
||||
Changed use ssh2::{Session, Sftp} → use ssh2::Session
|
||||
Fixed unused variable in sshpwn_scp_attacks.rs:176:
|
||||
Changed port: u16 → _port: u16
|
||||
Fixed unused variable in sshpwn_session.rs:94:
|
||||
Changed timeout: u64 → _timeout: u64
|
||||
Build result: Finished dev profile [unoptimized + debuginfo] target(s) in 24.64s with exit code 0 - no warnings or errors!
|
||||
|
||||
New sshpwn_auth_passwd.rs Features:
|
||||
|
||||
Password Length DoS Test - Tests auth2-passwd.c's lack of explicit password length limit
|
||||
Password Change Information Leak - Documents server fingerprinting via password change responses
|
||||
Auth Timing Attack - User enumeration via mm_auth_password timing differences
|
||||
Bcrypt 72-byte Truncation Test - Detects if server uses bcrypt's password truncation
|
||||
Added Interactive Shell to sshpwn_session.rs:
|
||||
Continuous command execution loop
|
||||
Tracks current working directory
|
||||
Built-in !upload and !download commands
|
||||
exit/quit to disconnect
|
||||
|
||||
✅ Complete SSH Module Implementation
|
||||
|
||||
Module Path Attacks Implemented
|
||||
|
||||
SFTP Attacks exploits/ssh/sshpwn_sftp_attacks.rs Symlink injection, Setuid bit, Path traversal, Partial write
|
||||
SCP Attacks exploits/ssh/sshpwn_scp_attacks.rs Path traversal, Username injection, Brace DoS, Command injection
|
||||
Session Attacks exploits/ssh/sshpwn_session.rs Env injection, Command exec, Interactive shell, Reverse shell, Upload/Download
|
||||
Auth Password exploits/ssh/sshpwn_auth_passwd.rs Password length DoS, Password change info leak, Auth timing attack, Bcrypt truncation
|
||||
SSH Scanner scanners/ssh_scanner.rs CIDR scan, Banner grab, Concurrent scanning
|
||||
SSH User Enum creds/generic/ssh_user_enum.rs Timing-based user enumeration
|
||||
SSH Spray creds/generic/ssh_spray.rs Password spray across targets
|
||||
SSH Bruteforce creds/generic/ssh_bruteforce.rs Credential bruteforce
|
||||
|
||||
New sshpwn_auth_passwd.rs Features:
|
||||
|
||||
Password Length DoS Test - Tests auth2-passwd.c's lack of explicit password length limit
|
||||
Password Change Information Leak - Documents server fingerprinting via password change responses
|
||||
Auth Timing Attack - User enumeration via mm_auth_password timing differences
|
||||
Bcrypt 72-byte Truncation Test - Detects if server uses bcrypt's password truncation
|
||||
Added Interactive Shell to sshpwn_session.rs:
|
||||
Continuous command execution loop
|
||||
Tracks current working directory
|
||||
Built-in !upload and !download commands
|
||||
exit/quit to disconnect
|
||||
|
||||
✅ Build Complete - All Warnings Fixed
|
||||
|
||||
SSH Modules Wired:
|
||||
|
||||
Exploit Modules (6):
|
||||
|
||||
Module Description
|
||||
sshpwn_auth_passwd Auth password attacks (length DoS, timing, bcrypt truncation)
|
||||
sshpwn_pam PAM attacks (memory exhaustion, env injection, timing)
|
||||
sshpwn_session Session attacks (exec, revshell, interactive shell, upload/download)
|
||||
sshpwn_scp_attacks SCP attacks (traversal, username injection, brace DoS, cmd injection)
|
||||
sshpwn_sftp_attacks SFTP attacks (symlink, setuid, traversal, partial write)
|
||||
opensshserver_9_8p1race_condition Race condition exploit
|
||||
Credential Modules (3):
|
||||
Module Description
|
||||
ssh_bruteforce SSH credential brute force
|
||||
ssh_spray SSH password spraying
|
||||
ssh_user_enum SSH user enumeration (timing attack)
|
||||
Scanner Modules (1):
|
||||
Module Description
|
||||
ssh_scanner SSH service discovery and banner grabbing
|
||||
|
||||
Fixes Applied:
|
||||
|
||||
✅ Removed unused HashMap import from sshpwn_pam.rs
|
||||
✅ Removed unused Read import from sshpwn_auth_passwd.rs
|
||||
✅ Fixed unused port variable - now used in output
|
||||
✅ Removed unused DEFAULT_TIMEOUT_SECS constant
|
||||
✅ Removed unused prompt() function
|
||||
✅ Removed unused PathBuf imports from generator files
|
||||
✅ Added sshpwn_pam to mod.rs
|
||||
|
||||
Reference in New Issue
Block a user