Compare commits

..

7 Commits

Author SHA1 Message Date
S.B d0f4ca17c6 Merge pull request #1 from s-b-repo/rewrite
Rewrite
2025-04-11 01:03:54 +02:00
S.B 62916f46dc Update Cargo.toml 2025-04-11 00:53:03 +02:00
S.B df629fa3e3 Add files via upload 2025-04-11 00:52:34 +02:00
S.B 873c12cbfa Delete src directory 2025-04-11 00:51:33 +02:00
S.B 632cab6a26 Update doc.md 2025-04-10 23:10:48 +02:00
S.B 0ac87b3e49 Update doc.md 2025-04-10 23:10:10 +02:00
S.B c43b1e1ae3 Create doc.md 2025-04-10 23:08:28 +02:00
11 changed files with 418 additions and 84 deletions
+3 -1
View File
@@ -18,7 +18,7 @@ anyhow = "1.0.97"
#teminal color
colored = "3.0.0"
rustyline = "15.0.0"
#ftp brute force module
async_ftp = "6.0.0"
@@ -28,3 +28,5 @@ tokio-socks = "0.5.2"
threadpool = "1.8.1"
crossbeam-channel = "0.5.15"
telnet = "0.2.3"
walkdir = "2.5.0"
+267
View File
@@ -0,0 +1,267 @@
the internal architecture, how to add or modify modules, and how the CLI and shell interact with the framework.
---
# 🛠️ Developer Documentation: RouterSploit-Rust Framework
> This document explains the architecture, core logic, CLI, shell system, and how to add or modify exploit/scanner/credential modules. It is meant for developers looking to extend or maintain this Rust-based pentesting framework.
---
## 🧠 Framework Philosophy
This tool is a **modular, extensible**, and **safe-by-default** Rust rewrite of the RouterSploit concept. Each exploit, scanner, or credential brute-forcer lives in its own **module file**, and can be invoked via:
- 📟 Command-Line Interface (CLI)
- 🖥️ Interactive Shell
---
## 🗂️ Directory Structure
```
routersploit_rust/
├── Cargo.toml
└── src
├── main.rs # Entry point
├── cli.rs # Parses CLI args
├── shell.rs # Interactive shell (rsf> prompt)
├── commands/ # Dispatch logic for exploit/scanner/creds
│ ├── mod.rs
│ ├── exploit.rs
│ ├── scanner.rs
│ └── creds.rs
├── modules/ # All available attack modules
│ ├── mod.rs
│ ├── exploits/
│ │ ├── mod.rs
│ │ └── sample_exploit.rs
│ ├── scanners/
│ │ ├── mod.rs
│ │ └── sample_scanner.rs
│ └── creds/
│ ├── mod.rs
│ └── sample_cred_check.rs
└── utils.rs # Utility helpers (e.g., list modules)
```
---
## 🔗 Module System
Each **module** (exploit/scanner/cred checker) is self-contained:
### Anatomy of a Module
```rust
pub async fn run(target: &str) -> Result<()> {
println!("[*] Running <MODULE_NAME> on target {}", target);
// Logic here
Ok(())
}
```
Each module must:
- Be placed inside the correct subfolder (e.g., `modules/exploits/`)
- Have a `run(target: &str) -> Result<()>` function
- Be declared in its parent's `mod.rs`
- Be wired into the corresponding command handler (e.g., `commands/exploit.rs`)
---
## ⚙️ CLI Internals
Handled via **Clap** in `cli.rs`:
```
cargo run -- --command exploit --module sample_exploit --target 192.168.1.1
```
- Parses command like `--command scanner`, `--module sample_scanner`, `--target 192.168.1.1`
- Passed into `commands::handle_command()` for dispatch
---
## 🖥️ Interactive Shell
Start with:
```
cargo run
```
Inside the shell:
```
rsf> help
rsf> modules
rsf> use exploits/sample_exploit
rsf> set target 192.168.1.1
rsf> run
```
Shell maintains internal state:
- `current_module` (e.g., `exploits/sample_exploit`)
- `current_target` (e.g., `192.168.1.1`)
When `run` is called, it dispatches via `commands::run_module()`.
---
## 🧪 Running a Module (Backend Flow)
1. Shell or CLI calls `commands::run_module("exploits/sample_exploit", "192.168.1.1")`
2. `commands/mod.rs` matches `exploits/` and calls `commands/exploit.rs`
3. `commands/exploit.rs` matches `sample_exploit` and calls `modules/exploits/sample_exploit.rs`
4. `run(target: &str)` executes async exploit logic
5. Results are printed back to the user
---
## How to Add a New Exploit/Scanner/Cred Module
### 1. Create the Module File
Example: `src/modules/exploits/my_new_exploit.rs`
```rust
use anyhow::{Result, Context};
use reqwest;
pub async fn run(target: &str) -> Result<()> {
println!("[*] Launching my_new_exploit on {}", target);
let url = format!("http://{}/pwn", target);
let resp = reqwest::get(&url)
.await
.context("Request failed")?
.text()
.await?;
if resp.contains("owned") {
println!("[+] Target is vulnerable!");
} else {
println!("[-] Not vulnerable.");
}
Ok(())
}
```
---
### 2. Register It in `mod.rs`
```rust
// src/modules/exploits/mod.rs
pub mod sample_exploit;
pub mod my_new_exploit;
```
---
### 3. Wire It into the Command Handler
```rust
// src/commands/exploit.rs
match module_name {
"sample_exploit" => exploits::sample_exploit::run(target).await?,
"my_new_exploit" => exploits::my_new_exploit::run(target).await?,
_ => eprintln!("Unknown exploit module"),
}
```
---
---
## 🛑 Error Handling
- All `run()` functions return `Result<()>` using `anyhow` for easy error context.
- Errors are automatically printed when the main shell or CLI fails.
---
## ⚡ Async Support
- The project uses `tokio` runtime and `reqwest` async client.
- All modules can use `async fn run(...) -> Result<()>` safely.
---
## 📡 HTTP Requests
- Use `reqwest` for sending requests to the target:
```rust
let response = reqwest::get(&url).await?;
```
- Or with a custom client and headers/auth:
```rust
let client = reqwest::Client::new();
let resp = client.post(&url).json(&data).send().await?;
```
---
## 🧪 Example Use Cases
### CLI Mode
```
# Exploit a router
cargo run -- --command exploit --module sample_exploit --target 192.168.0.1
```
### Shell Mode
```
rsf> use exploits/sample_exploit
rsf> set target 192.168.0.1
rsf> run
```
---
## 🧼 Resetting Shell State
There is no persistent state between runs. All values (`module`, `target`) must be set each time unless you're adding support for config files or persistence.
---
## 🔐 Real Exploit Integration
To adapt a real-world CVE:
- Convert the PoC into an async HTTP request
- Simulate or validate the vulnerable response pattern
- Follow the above module creation workflow
If the exploit is based on open TCP/UDP, you can use `tokio::net::TcpStream` or `tokio::net::UdpSocket`.
---
## 🛠️ Feature Ideas
- 🧰 Add wordlist brute-forcers (like rockyou support)
- 📄 Export results to a file
- ⚡ Parallel scanning via `tokio::spawn`
- 🔌 Plugin system for runtime module loading
- 🔒 Encrypted config/profile saving
- 🧪 Integration with Shodan/Censys APIs
---
## 👥 Contributors
- Main Developer: You.
- Language: 100% Rust
- Base Concept: Inspired by RouterSploit, Metasploit, and pwntools.
---
## 🧾 License
---
Would you like me to convert this into a Markdown file (`docs.md`) and drop it into your project as-is? Or would you like GitHub-flavored `.md` formatting tailored with headers, badges, collapsible trees, etc.?
+13 -20
View File
@@ -1,26 +1,19 @@
use anyhow::Result;
use crate::modules::creds;
use crate::modules::creds::telnet_bruteforce;
use anyhow::{Result, bail};
use crate::modules::creds::generic::{
ftp_anonymous,
ftp_bruteforce,
sample_cred_check,
telnet_bruteforce,
};
pub async fn run_cred_check(module_name: &str, target: &str) -> Result<()> {
match module_name {
"sample_cred_check" => {
creds::sample_cred_check::run(target).await?;
},
"ftp_bruteforce" => {
creds::ftp_bruteforce::run(target).await?;
},
"ftp_anonymous" => {
creds::ftp_anonymous::run(target).await?;
},
"telnet_bruteforce" => {
telnet_bruteforce::run_module(target).await?;
},
// Add more creds modules here ...
_ => {
eprintln!("Creds module '{}' not found.", module_name);
},
"generic/sample_cred_check" => sample_cred_check::run(target).await?,
"generic/ftp_bruteforce" => ftp_bruteforce::run(target).await?,
"generic/ftp_anonymous" => ftp_anonymous::run(target).await?,
"generic/telnet_bruteforce" => telnet_bruteforce::run(target).await?,
_ => bail!("Creds module '{}' not found.", module_name),
}
Ok(())
+69 -24
View File
@@ -1,51 +1,96 @@
// src/commands/mod.rs
pub mod exploit;
pub mod scanner;
pub mod creds;
use anyhow::Result;
use crate::cli::Cli;
use walkdir::WalkDir;
/// Handle CLI commands like: --command exploit --module creds/generic/ftp_anonymous --target x.x.x.x
pub async fn handle_command(command: &str, cli_args: &Cli) -> Result<()> {
let target = cli_args.target.clone().unwrap_or_default();
let module = cli_args.module.clone().unwrap_or_default();
match command {
"exploit" => {
let target = cli_args.target.clone().unwrap_or_default();
let module = cli_args.module.clone().unwrap_or_default();
exploit::run_exploit(&module, &target).await?;
let trimmed = module.trim_start_matches("exploits/"); // normalize
exploit::run_exploit(trimmed, &target).await?;
},
"scanner" => {
let target = cli_args.target.clone().unwrap_or_default();
let module = cli_args.module.clone().unwrap_or_default();
scanner::run_scan(&module, &target).await?;
let trimmed = module.trim_start_matches("scanners/");
scanner::run_scan(trimmed, &target).await?;
},
"creds" => {
let target = cli_args.target.clone().unwrap_or_default();
let module = cli_args.module.clone().unwrap_or_default();
creds::run_cred_check(&module, &target).await?;
let trimmed = module.trim_start_matches("creds/");
creds::run_cred_check(trimmed, &target).await?;
},
_ => {
eprintln!("Unknown command '{}'", command);
}
}
Ok(())
}
// Called from the interactive shell
/// Called from the interactive shell (e.g. 'use creds/generic/ftp_anonymous' + 'run')
pub async fn run_module(module_path: &str, target: &str) -> Result<()> {
if module_path.starts_with("exploits/") {
let module_name = module_path.trim_start_matches("exploits/").to_string();
exploit::run_exploit(&module_name, target).await?;
} else if module_path.starts_with("scanners/") {
let module_name = module_path.trim_start_matches("scanners/").to_string();
scanner::run_scan(&module_name, target).await?;
} else if module_path.starts_with("creds/") {
let module_name = module_path.trim_start_matches("creds/").to_string();
creds::run_cred_check(&module_name, target).await?;
} else {
eprintln!("Unknown module path '{}'", module_path);
let available = discover_modules();
if !available.contains(&module_path.to_string()) {
eprintln!("Unknown module '{}'. Available modules:", module_path);
for module in available {
println!(" {}", module);
}
return Ok(());
}
// Split path like "creds/generic/ftp_anonymous" -> ("creds", "generic/ftp_anonymous")
let mut parts = module_path.splitn(2, '/');
let category = parts.next().unwrap_or("");
let module_name = parts.next().unwrap_or("");
match category {
"exploits" => {
exploit::run_exploit(module_name, target).await?;
},
"scanners" => {
scanner::run_scan(module_name, target).await?;
},
"creds" => {
creds::run_cred_check(module_name, target).await?;
},
_ => {
eprintln!("Category '{}' is not supported.", category);
}
}
Ok(())
}
/// Discover modules in src/modules/{exploits,scanners,creds} recursively up to 6 levels deep
pub fn discover_modules() -> Vec<String> {
let mut modules = Vec::new();
let categories = ["exploits", "scanners", "creds"];
for category in categories {
let base_path = format!("src/modules/{}", category);
let walker = WalkDir::new(&base_path).max_depth(6);
for entry in walker.into_iter().filter_map(|e| e.ok()) {
let path = entry.path();
if path.is_file() && path.extension().map(|e| e == "rs").unwrap_or(false) {
if let Ok(relative) = path.strip_prefix("src/modules") {
let module_path = relative
.with_extension("") // remove .rs
.to_string_lossy()
.replace("\\", "/"); // Windows compatibility
modules.push(module_path);
}
}
}
}
modules
}
+6
View File
@@ -0,0 +1,6 @@
pub mod sample_cred_check;
pub mod ftp_bruteforce;
pub mod ftp_anonymous;
pub mod telnet_bruteforce;
@@ -8,7 +8,7 @@ use threadpool::ThreadPool;
use crossbeam_channel::{unbounded};
use telnet::Telnet;
pub async fn run_module(target: &str) -> Result<()> {
pub async fn run(target: &str) -> Result<()> {
println!("\n=== Telnet Bruteforce Module (RustSploit) ===\n");
let target = target.to_string();
+1 -4
View File
@@ -1,4 +1 @@
pub mod sample_cred_check;
pub mod ftp_bruteforce;
pub mod ftp_anonymous;
pub mod telnet_bruteforce;
pub mod generic; // <-- lowercase folder name
+58 -34
View File
@@ -1,49 +1,73 @@
use colored::*;
use std::fs;
use std::path::Path;
use std::path::{Path,};
/// Dynamically checks if a module path exists
pub fn module_exists(module_path: &str) -> bool {
if let Some((category, name)) = module_path.split_once('/') {
let path = format!("src/modules/{}/{}.rs", category, name);
Path::new(&path).exists()
} else {
false
/// Maximum folder depth to traverse
const MAX_DEPTH: usize = 6;
/// Recursively list .rs files up to a certain depth
fn collect_module_paths(dir: &Path, depth: usize) -> Vec<String> {
let mut modules = Vec::new();
if depth > MAX_DEPTH || !dir.exists() {
return modules;
}
}
/// Lists all available modules in exploits, scanners, and creds
pub fn list_all_modules() {
let categories = [
("exploits", "Exploits"),
("scanners", "Scanners"),
("creds", "Credentials"),
];
if let Ok(entries) = fs::read_dir(dir) {
for entry in entries.flatten() {
let path = entry.path();
println!("{}", "Available modules:".bold().underline());
if path.is_dir() {
modules.extend(collect_module_paths(&path, depth + 1));
} else if let Some(file_name) = path.file_name().and_then(|s| s.to_str()) {
if file_name.ends_with(".rs") && file_name != "mod.rs" {
let relative_path = path
.strip_prefix("src/modules")
.unwrap_or(&path)
.with_extension("")
.to_string_lossy()
.replace('\\', "/"); // For Windows compatibility
for (folder, display_name) in categories {
let mut modules = Vec::new();
let dir_path = format!("src/modules/{}", folder);
if let Ok(entries) = fs::read_dir(&dir_path) {
for entry in entries.flatten() {
if let Some(file_name) = entry.file_name().to_str() {
if file_name.ends_with(".rs") && file_name != "mod.rs" {
let module_name = file_name.trim_end_matches(".rs").to_string();
modules.push(module_name);
}
modules.push(relative_path);
}
}
}
}
modules.sort();
modules
}
if !modules.is_empty() {
println!("\n{}:", display_name.blue().bold());
for module in modules {
println!(" - {}", format!("{}/{}", folder, module).green());
}
/// Dynamically checks if a module path exists at any depth
pub fn module_exists(module_path: &str) -> bool {
let modules = collect_module_paths(Path::new("src/modules"), 0);
modules.iter().any(|m| m == module_path)
}
/// Lists all available modules recursively under src/modules/
pub fn list_all_modules() {
println!("{}", "Available modules:".bold().underline());
let modules = collect_module_paths(Path::new("src/modules"), 0);
if modules.is_empty() {
println!("{}", "No modules found.".red());
return;
}
let mut grouped = std::collections::BTreeMap::new();
for module in modules {
let parts: Vec<&str> = module.split('/').collect();
let category = parts.get(0).unwrap_or(&"Other").to_string();
grouped
.entry(category)
.or_insert_with(Vec::new)
.push(module.clone());
}
for (category, paths) in grouped {
println!("\n{}:", category.blue().bold());
for path in paths {
println!(" - {}", path.green());
}
}
}