mirror of
https://github.com/s-b-repo/rustsploit
synced 2026-06-27 09:54:12 +00:00
S.B
136 lines
4.9 KiB
Markdown
136 lines
4.9 KiB
Markdown
# Exploit Modules Guide
|
|
|
|
Best practices for writing and extending exploit modules in Rustsploit.
|
|
|
|
---
|
|
|
|
## CVE Referencing
|
|
|
|
Always mention CVE IDs, vendor names, and affected products in:
|
|
- The module file docstring / top-level comments
|
|
- Output messages (e.g., `[*] Testing CVE-2025-14847 on {}`, target)
|
|
- The [Module Catalog](Module-Catalog.md)
|
|
|
|
---
|
|
|
|
## Response Validation
|
|
|
|
Validate server responses before declaring success — false positives hurt credibility:
|
|
|
|
```rust
|
|
if response.status() == 200 && body.contains("expected_indicator") {
|
|
println!("{} Confirmed vulnerable: {}", "[+]".green(), target);
|
|
} else {
|
|
println!("{} Not vulnerable or patched", "[-]".red());
|
|
}
|
|
```
|
|
|
|
---
|
|
|
|
## Artifact Handling
|
|
|
|
If the exploit downloads or writes files (e.g., memory dumps, webshells):
|
|
- Store in the current working directory or a named subfolder
|
|
- Name files descriptively: `mongobleed_results_{target}.txt`, `nginx_pwner_results_{target}.txt`
|
|
- Inform the operator where output was written
|
|
|
|
---
|
|
|
|
## Clean-Up Instructions
|
|
|
|
If the exploit adds credentials or accounts (e.g., camera modules), document:
|
|
- The impact of the change
|
|
- How to revert (e.g., default creds to restore, commands to run)
|
|
|
|
---
|
|
|
|
## Interactive Options
|
|
|
|
Use `cfg_prompt_*` helpers from `crate::utils` if end-user input is needed. These respect the priority chain (API custom_prompts > global options > interactive stdin), ensuring modules work in shell, API, and CLI modes:
|
|
|
|
```rust
|
|
use crate::utils::{cfg_prompt_default, cfg_prompt_yes_no};
|
|
|
|
let command = cfg_prompt_default("command", "Command to execute", "id").await?;
|
|
let deploy = cfg_prompt_yes_no("deploy_webshell", "Deploy webshell?", true).await?;
|
|
```
|
|
|
|
---
|
|
|
|
## Mass-Scan Support
|
|
|
|
For modules supporting internet-wide scanning (target `0.0.0.0/0`):
|
|
|
|
```rust
|
|
if target == "0.0.0.0" || target == "0.0.0.0/0" || target == "random" {
|
|
loop {
|
|
let ip = generate_random_public_ip();
|
|
if !is_excluded_ip(ip) {
|
|
execute(ip.to_string().as_str()).await.ok();
|
|
}
|
|
}
|
|
}
|
|
```
|
|
|
|
See `EXCLUDED_RANGES` documentation in [Security & Validation](Security-Validation.md).
|
|
|
|
Disable honeypot detection in mass-scan mode to avoid interactive prompts blocking the scan loop.
|
|
|
|
---
|
|
|
|
## Module-Specific Notes
|
|
|
|
### Hikvision RCE (CVE-2021-36260)
|
|
- **Safe check** — writes/reads a test file to verify exploitability
|
|
- **Unsafe reboot** — reboots the device to confirm (destructive)
|
|
- **Command exec** — output retrieved, supports blind mode
|
|
- **SSH shell** — deploys Dropbear SSH on port 1337
|
|
|
|
### MongoBleed (CVE-2025-14847)
|
|
- Sends malicious compressed packet with inflated `uncompressedSize`
|
|
- Parses error response to extract leaked memory chunks (field names / types)
|
|
- Prints any leaked strings (potential credentials / data) to console
|
|
- Includes deep-scan mode for extended analysis
|
|
|
|
### n8n RCE (CVE-2025-68613)
|
|
- Authenticates via `/rest/login` (token / cookie-based)
|
|
- Creates a malicious workflow with expression injection payload
|
|
- Triggers via `/rest/workflows/{id}/run`
|
|
- Cleans up test workflow after execution
|
|
- **6 payload types:** Info, Command, Environment, Read File, Write File, Reverse Shell
|
|
|
|
### FortiWeb SQLi → RCE (CVE-2025-25257)
|
|
- SQL injection via `Authorization: Bearer ';{injection}` header
|
|
- Writes webshell via `SELECT INTO OUTFILE`
|
|
- Uses `.pth` trigger for Python `chmod` execution
|
|
- Interactive modes: deploy webshell, execute command, test SQLi only
|
|
|
|
### NginxPwner
|
|
- **10 checks:** version disclosure, CRLF injection, PURGE method, variable leakage, merge slashes, header bypass / IP spoofing, alias traversal, `X-Accel-Redirect` bypass, PHP detection, CVE-2017-7529 integer overflow
|
|
- Results saved to `nginx_pwner_results_{target}.txt`
|
|
- Prints reminders for manual checks (Redis, CORS, request smuggling)
|
|
|
|
### DoS / Stress Testing
|
|
|
|
> ⚠️ Authorized testing only. These modules can cause service disruption.
|
|
|
|
| Module | Notes |
|
|
|--------|-------|
|
|
| `null_syn_exhaustion` | Raw socket, IP spoofing, XorShift128+ RNG, configurable PPS, >1M PPS capable |
|
|
| `connection_exhaustion_flood` | FD-bounded semaphore, supports infinite mode with graceful Ctrl+C |
|
|
| `tcp_connection_flood` | DNS pre-resolved, high-concurrency handshake stress, infinite mode |
|
|
| `http2_rapid_reset` | CVE-2023-44487 — HTTP/2 stream reset flood |
|
|
|
|
---
|
|
|
|
## Framework-Level Multi-Target Support
|
|
|
|
All exploit modules automatically benefit from the framework's multi-target dispatcher. There is no need to implement target iteration inside individual modules. The framework handles:
|
|
|
|
- **Comma-separated targets** — `192.168.1.1,192.168.1.2,192.168.1.3`
|
|
- **CIDR ranges** — `192.168.1.0/24` expands to all hosts in the subnet
|
|
- **File-based targets** — pass a file path containing one target per line
|
|
- **Random targets** — `random` or `0.0.0.0/0` generates random public IPs with `EXCLUDED_RANGES` enforcement
|
|
|
|
The dispatcher calls the module's `run()` function once per resolved target. Modules only need to handle a single target string.
|