s-b-repo-rustsploit/src/modules/exploits/AUDIT.md

Exploit Module Audit Tracker

Rolling per-module checklist. Update as each module is reviewed. Keep short — one row per module.

Per-module checklist

Each module should pass all 9 (check() is centralized in scanners/vuln_checker.rs — not per-module):

1. run() bails early (≤2 s) when target doesn't speak the expected protocol
2. No .unwrap() / .expect() on network-derived values
3. All user knobs exposed via cfg_prompt_* (no hardcoded consts)
4. Uses crate::utils::tcp_connect_str or tcp_connect_addr instead of raw TcpStream::connect
5. Uses crate::utils::build_http_client / build_http_client_with (not raw reqwest::Client::builder)
6. references: populated with real URLs
7. Doc block at top of file with CVE / vendor / affected versions
8. ModuleRank honest — observed reliability
9. Loot / host / service registered in workspace on success

Status legend

• ✅ audited — all 10 pass
• 🔶 partial — listed sub-items still outstanding
• ❌ broken — known runtime failure; fix required
• ⏳ pending — not yet reviewed

Progress (updated per session)

Category	Audited	Total
network_infra	0	30
webapps	0	25
frameworks	0	15
ssh	0	15
routers	0	25
vnc / telnet / voip / cameras	0	21
dos	0	12
honeytrap / snare / cowrie / dionaea / safeline	0	15
crypto / ftp / ipmi / windows / bluetooth / payloadgens	0	12
Total	0	170 (excludes sample_exploit and 10 duplicates)

Session order (E1 → E10)

1. E1 — network_infra CVEs (fortinet, ivanti, citrix, palo_alto, sonicwall, f5, hpe, kubernetes, commvault, vmware, trend_micro)
2. E2 — webapps RCE (craftcms, flowise, n8n, xwiki, roundcube, sharepoint, wordpress, sap, misp, mcpjam, dify, langflow, solarwinds, zabbix, zimbra, spotube, termix, react, vite, laravel, nextjs)
3. E3 — frameworks (apache_tomcat, apache_camel, jenkins, nginx, php, wsus, http2, exim, mongo)
4. E4 — ssh family (libssh_auth_bypass, asyncssh, paramiko ×2, erlang_otp, sshpwn ×5, libssh2_rogue_server, openssh_regresshion, opensshserver_9_8p1race)
5. E5 — router CVEs (tplink ×13, ruijie ×7, netgear, dlink, zte, zyxel, tenda, ubiquiti)
6. E6 — vnc ×13 + telnet ×1 + voip ×1 + cameras ×6
7. E7 — dos ×12 (flood + amplification; already gated with require_root in A3)
8. E8 — honeytrap ×2 + snare ×2 + cowrie ×3 + dionaea ×4 + safeline ×6
9. E9 — crypto ×2 + ftp ×2 + ipmi ×1 + windows ×1 + bluetooth ×1 + payloadgens ×5
10. E10 — catch-all review + regression pass

Module status matrix

Populate during audit. Blank = pending.

network_infra/

Module	Status	Notes
citrix/cve_2025_5777_citrixbleed2	⏳
commvault/cve_2025_34028_commvault_rce	⏳	reqwest migrated in B2b
f5/cve_2025_53521_f5_bigip_rce	⏳	reqwest migrated; fire_results showed OK_err classification — verify
fortinet/forticloud_sso_auth_bypass_cve_2026_24858	⏳	batch: "Handshake failed" — likely TLS mismatch; review client config
fortinet/fortigate_rce_cve_2024_21762	⏳
fortinet/fortimanager_rce_cve_2024_47575	⏳
fortinet/fortios_auth_bypass_cve_2022_40684	⏳
fortinet/fortios_heap_overflow_cve_2023_27997	⏳	batch row flagged memcached_servers prompt — likely fire_all_modules.py idx→module misalignment (prompt actually belongs to exploits/dos/memcached_amplification). Re-run batch with per-module prompt dicts to verify.
fortinet/fortios_ssl_vpn_cve_2018_13379	⏳	same — prompt ntp_servers belongs to dos/ntp_amplification.
fortinet/fortisiem_rce_cve_2025_64155	⏳	tcp_connect_str migrated
fortinet/fortiweb_rce_cve_2021_22123	⏳
fortinet/fortiweb_sqli_rce_cve_2025_25257	⏳
hpe/cve_2025_37164_hpe_oneview_rce	⏳	reqwest migrated
ivanti/cve_2025_0282_ivanti_preauth_rce	⏳	reqwest migrated
ivanti/cve_2025_22457_ivanti_ics_rce	⏳	reqwest migrated
ivanti/ivanti_connect_secure_stack_based_buffer_overflow	⏳
ivanti/ivanti_epmm_cve_2023_35082	⏳
ivanti/ivanti_ics_auth_bypass_cve_2024_46352	⏳
ivanti/ivanti_neurons_rce_cve_2025_22460	⏳
kubernetes/cve_2025_1974_ingress_nginx_rce	⏳	reqwest migrated
qnap/qnap_qts_rce_cve_2024_27130	⏳
sonicwall/cve_2025_40602_sonicwall_sma_rce	⏳	reqwest migrated
trend_micro/cve_2025_5777	⏳
trend_micro/cve_2025_69258	⏳	tcp_connect_str migrated
trend_micro/cve_2025_69259	⏳	tcp_connect_str migrated
trend_micro/cve_2025_69260	⏳	tcp_connect_str migrated
vmware/esxi_auth_bypass_cve_2024_37085	⏳
vmware/esxi_vm_escape_check	⏳
vmware/esxi_vsock_client	⏳	uses std::net blocking — audit performance
vmware/vcenter_backup_rce	⏳
vmware/vcenter_file_read	⏳	uses std::fs::read_to_string — audit async
vmware/vcenter_rce_cve_2024_37079	⏳

…further categories mirrored below; fill in during E2+ sessions…

Session log

• Session 1 (2026-04-17): Phase A1/A2/A3 + B2a + B1 partial (14 sites) + B2b (47 sites) done. Build clean.
• Session 1 static-analysis: verified via grep —
  • .unwrap(): 0 hits across 252 files
  • .expect(...): 3 hits, all justified (src/modules/exploits/vnc/rfb.rs)
  • panic!/todo!/unimplemented!: 0 hits
  • println!/eprintln!/print! (MCP stdout-contaminating): 0 hits — all modules use crate::mprintln!/meprintln!
  • std::process::Command::new: 8 hits, all in exploits/bluetooth/wpair.rs calling bluetoothctl/pacat/parecord — legitimate for bluetooth exploitation
  • TODO/FIXME/HACK/XXX/BUG comments: 0 hits

Revised Phase D1 scope

Actual count needing check(): 114 modules total, breakdown:

• 58 CVE-named modules (highest priority — user probes by CVE)
• 56 non-CVE named

By category (category : missing-check count : CVE-named):

• routers: 29 missing (17 CVE)
• network_infra: 24 missing (19 CVE)
• dos: 13 missing (0 CVE) — defer all: flooding == the exploit, check() is indistinguishable
• webapps: 13 missing (9 CVE)
• frameworks: 10 missing (7 CVE)
• ssh: 7 missing (0 CVE)
• cameras: 6 missing (3 CVE)
• payloadgens: 5 missing (0 CVE) — defer all: no target, generates local files
• crypto: 2 missing (1 CVE)
• ftp / ipmi / telnet / windows: 4 missing (2 CVE)

Realistic Phase D1 target: ~96 modules (114 − 13 DoS − 5 payloadgens). Session D1a: 58 CVE-named first; Session D1b: remaining 38.

Template: see CHECK_TEMPLATE.md.

Revised Phase D2 scope

Static-analysis found far fewer hardcoded consts than the plan's 73 estimate:

• 10 modules: DEFAULT_PORT const without cfg_prompt_port call
• 5 modules: DEFAULT_PATH / *_PATH const without cfg_prompt_default("path", ...)
• 17 modules: USER_AGENT const without prompt (most of these are intentional — UA is a payload choice, not a user-configurable knob)

Realistic Phase D2 target: ~15 modules (10 port + 5 path; UA consts deferred as they're usually not user-facing knobs).

Concrete files:

• ports missing prompt: dos/ssdp_amplification, dos/ntp_amplification, dos/dns_amplification, dos/memcached_amplification, webapps/react/react2shell, cameras/abus/abussecurity_camera_cve202326609variant1, cameras/hikvision/hikvision_rce_cve_2021_36260, network_infra/fortinet/fortiweb_sqli_rce_cve_2025_25257, frameworks/mongo/mongobleed, vnc/rfb.rs
• paths missing prompt: webapps/misp_rce_cve_2025_27364, webapps/zimbra_sqli_auth_bypass_cve_2025_25064, webapps/sharepoint/cve_2025_53770_sharepoint_toolpane_rce, network_infra/kubernetes/cve_2025_1974_ingress_nginx_rce, network_infra/commvault/cve_2025_34028_commvault_rce