s-b-repo-rustsploit/docs/Exploit-Modules-Guide.md

Exploit Modules Guide

Best practices for writing and extending exploit modules in Rustsploit.

---

CVE Referencing

Always mention CVE IDs, vendor names, and affected products in:

• The module file docstring / top-level comments
• Output messages (e.g., [*] Testing CVE-2025-14847 on {}, target)
• The Module Catalog

---

Response Validation

Validate server responses before declaring success — false positives hurt credibility:

if response.status() == 200 && body.contains("expected_indicator") {
    println!("{} Confirmed vulnerable: {}", "[+]".green(), target);
} else {
    println!("{} Not vulnerable or patched", "[-]".red());
}

---

Artifact Handling

If the exploit downloads or writes files (e.g., memory dumps, webshells):

• Store in the current working directory or a named subfolder
• Name files descriptively: mongobleed_results_{target}.txt, nginx_pwner_results_{target}.txt
• Inform the operator where output was written

---

Clean-Up Instructions

If the exploit adds credentials or accounts (e.g., camera modules), document:

• The impact of the change
• How to revert (e.g., default creds to restore, commands to run)

---

Interactive Options

Use cfg_prompt_* helpers from crate::utils if end-user input is needed. These respect the priority chain (API custom_prompts > global options > interactive stdin), ensuring modules work in shell, API, and CLI modes:

use crate::utils::{cfg_prompt_default, cfg_prompt_yes_no};

let command = cfg_prompt_default("command", "Command to execute", "id").await?;
let deploy = cfg_prompt_yes_no("deploy_webshell", "Deploy webshell?", true).await?;

---

Mass-Scan Support

For modules supporting internet-wide scanning (target 0.0.0.0/0):

if target == "0.0.0.0" || target == "0.0.0.0/0" || target == "random" {
    loop {
        let ip = generate_random_public_ip();
        if !is_excluded_ip(ip) {
            execute(ip.to_string().as_str()).await.ok();
        }
    }
}

See EXCLUDED_RANGES documentation in Security & Validation.

Disable honeypot detection in mass-scan mode to avoid interactive prompts blocking the scan loop.

---

Module-Specific Notes

Hikvision RCE (CVE-2021-36260)

• Safe check — writes/reads a test file to verify exploitability
• Unsafe reboot — reboots the device to confirm (destructive)
• Command exec — output retrieved, supports blind mode
• SSH shell — deploys Dropbear SSH on port 1337

MongoBleed (CVE-2025-14847)

• Sends malicious compressed packet with inflated uncompressedSize
• Parses error response to extract leaked memory chunks (field names / types)
• Prints any leaked strings (potential credentials / data) to console
• Includes deep-scan mode for extended analysis

n8n RCE (CVE-2025-68613)

• Authenticates via /rest/login (token / cookie-based)
• Creates a malicious workflow with expression injection payload
• Triggers via /rest/workflows/{id}/run
• Cleans up test workflow after execution
• 6 payload types: Info, Command, Environment, Read File, Write File, Reverse Shell

FortiWeb SQLi → RCE (CVE-2025-25257)

• SQL injection via Authorization: Bearer ';{injection} header
• Writes webshell via SELECT INTO OUTFILE
• Uses .pth trigger for Python chmod execution
• Interactive modes: deploy webshell, execute command, test SQLi only

NginxPwner

• 10 checks: version disclosure, CRLF injection, PURGE method, variable leakage, merge slashes, header bypass / IP spoofing, alias traversal, X-Accel-Redirect bypass, PHP detection, CVE-2017-7529 integer overflow
• Results saved to nginx_pwner_results_{target}.txt
• Prints reminders for manual checks (Redis, CORS, request smuggling)

DoS / Stress Testing

⚠️ Authorized testing only. These modules can cause service disruption.

Module	Notes
null_syn_exhaustion	Raw socket, IP spoofing, XorShift128+ RNG, configurable PPS, >1M PPS capable
connection_exhaustion_flood	FD-bounded semaphore, supports infinite mode with graceful Ctrl+C
tcp_connection_flood	DNS pre-resolved, high-concurrency handshake stress, infinite mode
http2_rapid_reset	CVE-2023-44487 — HTTP/2 stream reset flood

---

Framework-Level Multi-Target Support

All exploit modules automatically benefit from the framework's multi-target dispatcher. There is no need to implement target iteration inside individual modules. The framework handles:

• Comma-separated targets — 192.168.1.1,192.168.1.2,192.168.1.3
• CIDR ranges — 192.168.1.0/24 expands to all hosts in the subnet
• File-based targets — pass a file path containing one target per line
• Random targets — random or 0.0.0.0/0 generates random public IPs with EXCLUDED_RANGES enforcement

The dispatcher calls the module's run() function once per resolved target. Modules only need to handle a single target string.

---

Payload Mutation Engine

The payload mutation engine (src/native/payload_engine.rs) is available to all exploit modules for encoding and obfuscating payloads before delivery. This is useful for bypassing signature-based detection (AV, IDS/IPS, WAF).

Available transformations:

Encoding	Description
XOR	Single-byte or multi-byte XOR with configurable key
Base64	Standard and URL-safe Base64 encoding
Hex	Hexadecimal string encoding
Zero-width	Unicode zero-width character steganography
Custom	User-defined alphabet substitution

Integration example:

use crate::native::payload_engine::{encode_payload, EncodingType};

// XOR-encode a command payload
let payload = b"id; cat /etc/passwd";
let encoded = encode_payload(payload, EncodingType::Xor { key: 0x42 })?;

// Chain multiple encodings
let double_encoded = encode_payload(&encoded, EncodingType::Base64)?;

Modules that generate payloads (narutto_dropper, polymorph_dropper, payload_encoder, batgen, lnkgen) use the mutation engine internally. New exploit modules that deliver payloads should prefer using the engine over inline encoding.

---

WPair BLE Module

The exploits/bluetooth/wpair module exploits a flaw in the Google Fast Pair protocol to hijack Bluetooth accessories. This is the framework's first Bluetooth Low Energy (BLE) module.

Attack flow:

1. Discovery -- Scans for BLE advertisements matching Fast Pair service UUIDs
2. Bonding hijack -- Initiates pairing before the legitimate device by responding faster to the Fast Pair provider
3. Account key injection -- Writes a crafted Account Key to the device's Fast Pair service, associating it with the attacker's Google account
4. Audio interception -- Once bonded, audio streams (A2DP/HFP) route through the attacker's device

Requirements:

• Linux with BlueZ 5.50+
• Bluetooth adapter supporting BLE (most USB adapters work)
• Root privileges for raw HCI access

Usage notes:

• The module requires physical proximity to the target Bluetooth accessory (typically <10 meters)
• Success depends on winning the race condition against the legitimate pairing device
• Some accessories implement additional pairing verification that may prevent the attack

---

DoS Module Development

Shared Infrastructure

All raw-packet DoS modules use shared utilities from crate::native::dos_utils:

Utility	Purpose
FastRng::with_thread_seed(id)	Per-thread XorShift128+ PRNG
FastRng::gen_ipv4_public()	Random public IPv4 (avoids private/reserved/multicast)
FastRng::gen_ephemeral_port()	Random port 49152-65535
checksum_16(data)	RFC 1071 Internet checksum
sum_16(data, init)	Partial checksum accumulator
is_spoof_enabled()	Check setg spoof_ip true global option

Source IP Spoofing

Raw-packet modules (SYN flood, UDP flood, ICMP flood, amplification attacks) support source IP spoofing via socket2::Type::RAW with IP_HDRINCL. Enable globally:

setg spoof_ip true

Modules with user prompts (null_syn_exhaustion, udp_flood, icmp_flood) use the global as the default value. Amplification modules (DNS, NTP, SSDP, Memcached) always spoof the victim IP as source.

TCP-based modules (slowloris, RUDY, HTTP flood, connection exhaustion) cannot spoof — TCP requires a valid 3-way handshake.