mirror of
https://github.com/s-b-repo/rustsploit
synced 2026-06-27 09:54:12 +00:00
Compare commits
7 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| d0f4ca17c6 | |||
| 62916f46dc | |||
| df629fa3e3 | |||
| 873c12cbfa | |||
| 632cab6a26 | |||
| 0ac87b3e49 | |||
| c43b1e1ae3 |
+3
-1
@@ -18,7 +18,7 @@ anyhow = "1.0.97"
|
||||
|
||||
#teminal color
|
||||
colored = "3.0.0"
|
||||
|
||||
rustyline = "15.0.0"
|
||||
#ftp brute force module
|
||||
async_ftp = "6.0.0"
|
||||
|
||||
@@ -28,3 +28,5 @@ tokio-socks = "0.5.2"
|
||||
threadpool = "1.8.1"
|
||||
crossbeam-channel = "0.5.15"
|
||||
telnet = "0.2.3"
|
||||
|
||||
walkdir = "2.5.0"
|
||||
|
||||
+267
@@ -0,0 +1,267 @@
|
||||
the internal architecture, how to add or modify modules, and how the CLI and shell interact with the framework.
|
||||
|
||||
---
|
||||
|
||||
# 🛠️ Developer Documentation: RouterSploit-Rust Framework
|
||||
|
||||
> This document explains the architecture, core logic, CLI, shell system, and how to add or modify exploit/scanner/credential modules. It is meant for developers looking to extend or maintain this Rust-based pentesting framework.
|
||||
|
||||
---
|
||||
|
||||
## 🧠 Framework Philosophy
|
||||
|
||||
This tool is a **modular, extensible**, and **safe-by-default** Rust rewrite of the RouterSploit concept. Each exploit, scanner, or credential brute-forcer lives in its own **module file**, and can be invoked via:
|
||||
|
||||
- 📟 Command-Line Interface (CLI)
|
||||
- 🖥️ Interactive Shell
|
||||
|
||||
---
|
||||
|
||||
## 🗂️ Directory Structure
|
||||
|
||||
```
|
||||
routersploit_rust/
|
||||
├── Cargo.toml
|
||||
└── src
|
||||
├── main.rs # Entry point
|
||||
├── cli.rs # Parses CLI args
|
||||
├── shell.rs # Interactive shell (rsf> prompt)
|
||||
├── commands/ # Dispatch logic for exploit/scanner/creds
|
||||
│ ├── mod.rs
|
||||
│ ├── exploit.rs
|
||||
│ ├── scanner.rs
|
||||
│ └── creds.rs
|
||||
├── modules/ # All available attack modules
|
||||
│ ├── mod.rs
|
||||
│ ├── exploits/
|
||||
│ │ ├── mod.rs
|
||||
│ │ └── sample_exploit.rs
|
||||
│ ├── scanners/
|
||||
│ │ ├── mod.rs
|
||||
│ │ └── sample_scanner.rs
|
||||
│ └── creds/
|
||||
│ ├── mod.rs
|
||||
│ └── sample_cred_check.rs
|
||||
└── utils.rs # Utility helpers (e.g., list modules)
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🔗 Module System
|
||||
|
||||
Each **module** (exploit/scanner/cred checker) is self-contained:
|
||||
|
||||
### Anatomy of a Module
|
||||
|
||||
```rust
|
||||
pub async fn run(target: &str) -> Result<()> {
|
||||
println!("[*] Running <MODULE_NAME> on target {}", target);
|
||||
// Logic here
|
||||
Ok(())
|
||||
}
|
||||
```
|
||||
|
||||
Each module must:
|
||||
- Be placed inside the correct subfolder (e.g., `modules/exploits/`)
|
||||
- Have a `run(target: &str) -> Result<()>` function
|
||||
- Be declared in its parent's `mod.rs`
|
||||
- Be wired into the corresponding command handler (e.g., `commands/exploit.rs`)
|
||||
|
||||
---
|
||||
|
||||
## ⚙️ CLI Internals
|
||||
|
||||
Handled via **Clap** in `cli.rs`:
|
||||
|
||||
```
|
||||
cargo run -- --command exploit --module sample_exploit --target 192.168.1.1
|
||||
```
|
||||
|
||||
- Parses command like `--command scanner`, `--module sample_scanner`, `--target 192.168.1.1`
|
||||
- Passed into `commands::handle_command()` for dispatch
|
||||
|
||||
---
|
||||
|
||||
## 🖥️ Interactive Shell
|
||||
|
||||
Start with:
|
||||
|
||||
```
|
||||
cargo run
|
||||
```
|
||||
|
||||
Inside the shell:
|
||||
|
||||
```
|
||||
rsf> help
|
||||
rsf> modules
|
||||
rsf> use exploits/sample_exploit
|
||||
rsf> set target 192.168.1.1
|
||||
rsf> run
|
||||
```
|
||||
|
||||
Shell maintains internal state:
|
||||
- `current_module` (e.g., `exploits/sample_exploit`)
|
||||
- `current_target` (e.g., `192.168.1.1`)
|
||||
|
||||
When `run` is called, it dispatches via `commands::run_module()`.
|
||||
|
||||
---
|
||||
|
||||
## 🧪 Running a Module (Backend Flow)
|
||||
|
||||
1. Shell or CLI calls `commands::run_module("exploits/sample_exploit", "192.168.1.1")`
|
||||
2. `commands/mod.rs` matches `exploits/` and calls `commands/exploit.rs`
|
||||
3. `commands/exploit.rs` matches `sample_exploit` and calls `modules/exploits/sample_exploit.rs`
|
||||
4. `run(target: &str)` executes async exploit logic
|
||||
5. Results are printed back to the user
|
||||
|
||||
---
|
||||
|
||||
## ➕ How to Add a New Exploit/Scanner/Cred Module
|
||||
|
||||
### 1. Create the Module File
|
||||
|
||||
Example: `src/modules/exploits/my_new_exploit.rs`
|
||||
|
||||
```rust
|
||||
use anyhow::{Result, Context};
|
||||
use reqwest;
|
||||
|
||||
pub async fn run(target: &str) -> Result<()> {
|
||||
println!("[*] Launching my_new_exploit on {}", target);
|
||||
let url = format!("http://{}/pwn", target);
|
||||
let resp = reqwest::get(&url)
|
||||
.await
|
||||
.context("Request failed")?
|
||||
.text()
|
||||
.await?;
|
||||
|
||||
if resp.contains("owned") {
|
||||
println!("[+] Target is vulnerable!");
|
||||
} else {
|
||||
println!("[-] Not vulnerable.");
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 2. Register It in `mod.rs`
|
||||
|
||||
```rust
|
||||
// src/modules/exploits/mod.rs
|
||||
pub mod sample_exploit;
|
||||
pub mod my_new_exploit;
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 3. Wire It into the Command Handler
|
||||
|
||||
```rust
|
||||
// src/commands/exploit.rs
|
||||
match module_name {
|
||||
"sample_exploit" => exploits::sample_exploit::run(target).await?,
|
||||
"my_new_exploit" => exploits::my_new_exploit::run(target).await?,
|
||||
_ => eprintln!("Unknown exploit module"),
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 🛑 Error Handling
|
||||
|
||||
- All `run()` functions return `Result<()>` using `anyhow` for easy error context.
|
||||
- Errors are automatically printed when the main shell or CLI fails.
|
||||
|
||||
---
|
||||
|
||||
## ⚡ Async Support
|
||||
|
||||
- The project uses `tokio` runtime and `reqwest` async client.
|
||||
- All modules can use `async fn run(...) -> Result<()>` safely.
|
||||
|
||||
---
|
||||
|
||||
## 📡 HTTP Requests
|
||||
|
||||
- Use `reqwest` for sending requests to the target:
|
||||
```rust
|
||||
let response = reqwest::get(&url).await?;
|
||||
```
|
||||
|
||||
- Or with a custom client and headers/auth:
|
||||
```rust
|
||||
let client = reqwest::Client::new();
|
||||
let resp = client.post(&url).json(&data).send().await?;
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🧪 Example Use Cases
|
||||
|
||||
### CLI Mode
|
||||
|
||||
```
|
||||
# Exploit a router
|
||||
cargo run -- --command exploit --module sample_exploit --target 192.168.0.1
|
||||
```
|
||||
|
||||
### Shell Mode
|
||||
|
||||
```
|
||||
rsf> use exploits/sample_exploit
|
||||
rsf> set target 192.168.0.1
|
||||
rsf> run
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🧼 Resetting Shell State
|
||||
|
||||
There is no persistent state between runs. All values (`module`, `target`) must be set each time unless you're adding support for config files or persistence.
|
||||
|
||||
---
|
||||
|
||||
## 🔐 Real Exploit Integration
|
||||
|
||||
To adapt a real-world CVE:
|
||||
|
||||
- Convert the PoC into an async HTTP request
|
||||
- Simulate or validate the vulnerable response pattern
|
||||
- Follow the above module creation workflow
|
||||
|
||||
If the exploit is based on open TCP/UDP, you can use `tokio::net::TcpStream` or `tokio::net::UdpSocket`.
|
||||
|
||||
---
|
||||
|
||||
## 🛠️ Feature Ideas
|
||||
|
||||
- 🧰 Add wordlist brute-forcers (like rockyou support)
|
||||
- 📄 Export results to a file
|
||||
- ⚡ Parallel scanning via `tokio::spawn`
|
||||
- 🔌 Plugin system for runtime module loading
|
||||
- 🔒 Encrypted config/profile saving
|
||||
- 🧪 Integration with Shodan/Censys APIs
|
||||
|
||||
---
|
||||
|
||||
## 👥 Contributors
|
||||
|
||||
- Main Developer: You.
|
||||
- Language: 100% Rust
|
||||
- Base Concept: Inspired by RouterSploit, Metasploit, and pwntools.
|
||||
|
||||
---
|
||||
|
||||
## 🧾 License
|
||||
|
||||
---
|
||||
|
||||
Would you like me to convert this into a Markdown file (`docs.md`) and drop it into your project as-is? Or would you like GitHub-flavored `.md` formatting tailored with headers, badges, collapsible trees, etc.?
|
||||
+13
-20
@@ -1,26 +1,19 @@
|
||||
use anyhow::Result;
|
||||
use crate::modules::creds;
|
||||
use crate::modules::creds::telnet_bruteforce;
|
||||
use anyhow::{Result, bail};
|
||||
|
||||
use crate::modules::creds::generic::{
|
||||
ftp_anonymous,
|
||||
ftp_bruteforce,
|
||||
sample_cred_check,
|
||||
telnet_bruteforce,
|
||||
};
|
||||
|
||||
pub async fn run_cred_check(module_name: &str, target: &str) -> Result<()> {
|
||||
match module_name {
|
||||
"sample_cred_check" => {
|
||||
creds::sample_cred_check::run(target).await?;
|
||||
},
|
||||
"ftp_bruteforce" => {
|
||||
creds::ftp_bruteforce::run(target).await?;
|
||||
},
|
||||
"ftp_anonymous" => {
|
||||
creds::ftp_anonymous::run(target).await?;
|
||||
},
|
||||
|
||||
"telnet_bruteforce" => {
|
||||
telnet_bruteforce::run_module(target).await?;
|
||||
},
|
||||
// Add more creds modules here ...
|
||||
_ => {
|
||||
eprintln!("Creds module '{}' not found.", module_name);
|
||||
},
|
||||
"generic/sample_cred_check" => sample_cred_check::run(target).await?,
|
||||
"generic/ftp_bruteforce" => ftp_bruteforce::run(target).await?,
|
||||
"generic/ftp_anonymous" => ftp_anonymous::run(target).await?,
|
||||
"generic/telnet_bruteforce" => telnet_bruteforce::run(target).await?,
|
||||
_ => bail!("Creds module '{}' not found.", module_name),
|
||||
}
|
||||
|
||||
Ok(())
|
||||
|
||||
+69
-24
@@ -1,51 +1,96 @@
|
||||
// src/commands/mod.rs
|
||||
|
||||
pub mod exploit;
|
||||
pub mod scanner;
|
||||
pub mod creds;
|
||||
|
||||
use anyhow::Result;
|
||||
use crate::cli::Cli;
|
||||
use walkdir::WalkDir;
|
||||
|
||||
|
||||
/// Handle CLI commands like: --command exploit --module creds/generic/ftp_anonymous --target x.x.x.x
|
||||
pub async fn handle_command(command: &str, cli_args: &Cli) -> Result<()> {
|
||||
let target = cli_args.target.clone().unwrap_or_default();
|
||||
let module = cli_args.module.clone().unwrap_or_default();
|
||||
|
||||
match command {
|
||||
"exploit" => {
|
||||
let target = cli_args.target.clone().unwrap_or_default();
|
||||
let module = cli_args.module.clone().unwrap_or_default();
|
||||
exploit::run_exploit(&module, &target).await?;
|
||||
let trimmed = module.trim_start_matches("exploits/"); // normalize
|
||||
exploit::run_exploit(trimmed, &target).await?;
|
||||
},
|
||||
"scanner" => {
|
||||
let target = cli_args.target.clone().unwrap_or_default();
|
||||
let module = cli_args.module.clone().unwrap_or_default();
|
||||
scanner::run_scan(&module, &target).await?;
|
||||
let trimmed = module.trim_start_matches("scanners/");
|
||||
scanner::run_scan(trimmed, &target).await?;
|
||||
},
|
||||
"creds" => {
|
||||
let target = cli_args.target.clone().unwrap_or_default();
|
||||
let module = cli_args.module.clone().unwrap_or_default();
|
||||
creds::run_cred_check(&module, &target).await?;
|
||||
let trimmed = module.trim_start_matches("creds/");
|
||||
creds::run_cred_check(trimmed, &target).await?;
|
||||
},
|
||||
_ => {
|
||||
eprintln!("Unknown command '{}'", command);
|
||||
}
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
// Called from the interactive shell
|
||||
/// Called from the interactive shell (e.g. 'use creds/generic/ftp_anonymous' + 'run')
|
||||
pub async fn run_module(module_path: &str, target: &str) -> Result<()> {
|
||||
if module_path.starts_with("exploits/") {
|
||||
let module_name = module_path.trim_start_matches("exploits/").to_string();
|
||||
exploit::run_exploit(&module_name, target).await?;
|
||||
} else if module_path.starts_with("scanners/") {
|
||||
let module_name = module_path.trim_start_matches("scanners/").to_string();
|
||||
scanner::run_scan(&module_name, target).await?;
|
||||
} else if module_path.starts_with("creds/") {
|
||||
let module_name = module_path.trim_start_matches("creds/").to_string();
|
||||
creds::run_cred_check(&module_name, target).await?;
|
||||
} else {
|
||||
eprintln!("Unknown module path '{}'", module_path);
|
||||
let available = discover_modules();
|
||||
|
||||
if !available.contains(&module_path.to_string()) {
|
||||
eprintln!("Unknown module '{}'. Available modules:", module_path);
|
||||
for module in available {
|
||||
println!(" {}", module);
|
||||
}
|
||||
return Ok(());
|
||||
}
|
||||
|
||||
// Split path like "creds/generic/ftp_anonymous" -> ("creds", "generic/ftp_anonymous")
|
||||
let mut parts = module_path.splitn(2, '/');
|
||||
let category = parts.next().unwrap_or("");
|
||||
let module_name = parts.next().unwrap_or("");
|
||||
|
||||
match category {
|
||||
"exploits" => {
|
||||
exploit::run_exploit(module_name, target).await?;
|
||||
},
|
||||
"scanners" => {
|
||||
scanner::run_scan(module_name, target).await?;
|
||||
},
|
||||
"creds" => {
|
||||
creds::run_cred_check(module_name, target).await?;
|
||||
},
|
||||
_ => {
|
||||
eprintln!("Category '{}' is not supported.", category);
|
||||
}
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Discover modules in src/modules/{exploits,scanners,creds} recursively up to 6 levels deep
|
||||
pub fn discover_modules() -> Vec<String> {
|
||||
let mut modules = Vec::new();
|
||||
|
||||
let categories = ["exploits", "scanners", "creds"];
|
||||
|
||||
for category in categories {
|
||||
let base_path = format!("src/modules/{}", category);
|
||||
let walker = WalkDir::new(&base_path).max_depth(6);
|
||||
|
||||
for entry in walker.into_iter().filter_map(|e| e.ok()) {
|
||||
let path = entry.path();
|
||||
|
||||
if path.is_file() && path.extension().map(|e| e == "rs").unwrap_or(false) {
|
||||
if let Ok(relative) = path.strip_prefix("src/modules") {
|
||||
let module_path = relative
|
||||
.with_extension("") // remove .rs
|
||||
.to_string_lossy()
|
||||
.replace("\\", "/"); // Windows compatibility
|
||||
modules.push(module_path);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
modules
|
||||
}
|
||||
|
||||
@@ -0,0 +1,6 @@
|
||||
|
||||
pub mod sample_cred_check;
|
||||
pub mod ftp_bruteforce;
|
||||
pub mod ftp_anonymous;
|
||||
pub mod telnet_bruteforce;
|
||||
|
||||
+1
-1
@@ -8,7 +8,7 @@ use threadpool::ThreadPool;
|
||||
use crossbeam_channel::{unbounded};
|
||||
use telnet::Telnet;
|
||||
|
||||
pub async fn run_module(target: &str) -> Result<()> {
|
||||
pub async fn run(target: &str) -> Result<()> {
|
||||
println!("\n=== Telnet Bruteforce Module (RustSploit) ===\n");
|
||||
|
||||
let target = target.to_string();
|
||||
@@ -1,4 +1 @@
|
||||
pub mod sample_cred_check;
|
||||
pub mod ftp_bruteforce;
|
||||
pub mod ftp_anonymous;
|
||||
pub mod telnet_bruteforce;
|
||||
pub mod generic; // <-- lowercase folder name
|
||||
|
||||
+58
-34
@@ -1,49 +1,73 @@
|
||||
use colored::*;
|
||||
use std::fs;
|
||||
use std::path::Path;
|
||||
use std::path::{Path,};
|
||||
|
||||
/// Dynamically checks if a module path exists
|
||||
pub fn module_exists(module_path: &str) -> bool {
|
||||
if let Some((category, name)) = module_path.split_once('/') {
|
||||
let path = format!("src/modules/{}/{}.rs", category, name);
|
||||
Path::new(&path).exists()
|
||||
} else {
|
||||
false
|
||||
/// Maximum folder depth to traverse
|
||||
const MAX_DEPTH: usize = 6;
|
||||
|
||||
/// Recursively list .rs files up to a certain depth
|
||||
fn collect_module_paths(dir: &Path, depth: usize) -> Vec<String> {
|
||||
let mut modules = Vec::new();
|
||||
|
||||
if depth > MAX_DEPTH || !dir.exists() {
|
||||
return modules;
|
||||
}
|
||||
}
|
||||
|
||||
/// Lists all available modules in exploits, scanners, and creds
|
||||
pub fn list_all_modules() {
|
||||
let categories = [
|
||||
("exploits", "Exploits"),
|
||||
("scanners", "Scanners"),
|
||||
("creds", "Credentials"),
|
||||
];
|
||||
if let Ok(entries) = fs::read_dir(dir) {
|
||||
for entry in entries.flatten() {
|
||||
let path = entry.path();
|
||||
|
||||
println!("{}", "Available modules:".bold().underline());
|
||||
if path.is_dir() {
|
||||
modules.extend(collect_module_paths(&path, depth + 1));
|
||||
} else if let Some(file_name) = path.file_name().and_then(|s| s.to_str()) {
|
||||
if file_name.ends_with(".rs") && file_name != "mod.rs" {
|
||||
let relative_path = path
|
||||
.strip_prefix("src/modules")
|
||||
.unwrap_or(&path)
|
||||
.with_extension("")
|
||||
.to_string_lossy()
|
||||
.replace('\\', "/"); // For Windows compatibility
|
||||
|
||||
for (folder, display_name) in categories {
|
||||
let mut modules = Vec::new();
|
||||
let dir_path = format!("src/modules/{}", folder);
|
||||
|
||||
if let Ok(entries) = fs::read_dir(&dir_path) {
|
||||
for entry in entries.flatten() {
|
||||
if let Some(file_name) = entry.file_name().to_str() {
|
||||
if file_name.ends_with(".rs") && file_name != "mod.rs" {
|
||||
let module_name = file_name.trim_end_matches(".rs").to_string();
|
||||
modules.push(module_name);
|
||||
}
|
||||
modules.push(relative_path);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
modules.sort();
|
||||
modules
|
||||
}
|
||||
|
||||
if !modules.is_empty() {
|
||||
println!("\n{}:", display_name.blue().bold());
|
||||
for module in modules {
|
||||
println!(" - {}", format!("{}/{}", folder, module).green());
|
||||
}
|
||||
/// Dynamically checks if a module path exists at any depth
|
||||
pub fn module_exists(module_path: &str) -> bool {
|
||||
let modules = collect_module_paths(Path::new("src/modules"), 0);
|
||||
modules.iter().any(|m| m == module_path)
|
||||
}
|
||||
|
||||
/// Lists all available modules recursively under src/modules/
|
||||
pub fn list_all_modules() {
|
||||
println!("{}", "Available modules:".bold().underline());
|
||||
|
||||
let modules = collect_module_paths(Path::new("src/modules"), 0);
|
||||
if modules.is_empty() {
|
||||
println!("{}", "No modules found.".red());
|
||||
return;
|
||||
}
|
||||
|
||||
let mut grouped = std::collections::BTreeMap::new();
|
||||
|
||||
for module in modules {
|
||||
let parts: Vec<&str> = module.split('/').collect();
|
||||
let category = parts.get(0).unwrap_or(&"Other").to_string();
|
||||
grouped
|
||||
.entry(category)
|
||||
.or_insert_with(Vec::new)
|
||||
.push(module.clone());
|
||||
}
|
||||
|
||||
for (category, paths) in grouped {
|
||||
println!("\n{}:", category.blue().bold());
|
||||
for path in paths {
|
||||
println!(" - {}", path.green());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user