exploitfarm 1.6.8__tar.gz → 1.7.0__tar.gz

{exploitfarm-1.6.8 → exploitfarm-1.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: exploitfarm
-Version: 1.6.8
+Version: 1.7.0
 Summary: Exploit Farm client
 Home-page: https://github.com/pwnzer0tt1/exploitfarm
 Author: Pwnzer0tt1

{exploitfarm-1.6.8 → exploitfarm-1.7.0}/exploitfarm/__init__.py

@@ -1,5 +1,5 @@
 __version__ = (
-    "1.6.8" if "{" not in "1.6.8" else "0.0.0"
+    "1.7.0" if "{" not in "1.7.0" else "0.0.0"
 )
 
 from exploitfarm.utils import try_tcp_connection

{exploitfarm-1.6.8 → exploitfarm-1.7.0}/exploitfarm/models/dbtypes.py

@@ -7,6 +7,7 @@ from pydantic import BaseModel, BeforeValidator
 EnvKey = str
 ClientID = str
 ExploitID = UUID
+ExploitTemplateID = UUID
 ServiceID = UUID
 TeamID = int
 AttackGroupID = UUID

exploitfarm-1.7.0/exploitfarm/models/exploit_template.py

@@ -0,0 +1,23 @@
+from pydantic import AwareDatetime, BaseModel, Field
+
+from exploitfarm.models.dbtypes import ExploitTemplateID
+from exploitfarm.models.enums import Language
+
+
+class ExploitTemplateDTO(BaseModel):
+    id: ExploitTemplateID
+    name: str
+    description: str | None = None
+    language: Language
+    run: str
+    interpreter: str | None = None
+    hash: str
+    created_at: AwareDatetime
+
+
+class ExploitTemplateEditForm(BaseModel):
+    name: str | None = Field(None, min_length=1)
+    description: str | None = None
+    language: Language | None = None
+    run: str | None = Field(None, min_length=1)
+    interpreter: str | None = None

{exploitfarm-1.6.8 → exploitfarm-1.7.0}/exploitfarm/tui/exploitinit.py

@@ -1,3 +1,4 @@
+import os
 from uuid import UUID
 from typing import List
 
@@ -11,7 +12,13 @@ from exploitfarm.utils.config import ClientConfig
 from exploitfarm.models.enums import Language
 from exploitfarm.utils.config import ExploitConfig
 from exploitfarm.utils.config import check_exploit_config_exists
+from exploitfarm.utils.templates import (
+    DEFAULT_TEMPLATE_ID,
+    extract_cached_template,
+    templates_for_language,
+)
 from rich import print
+from rich.markup import escape
 
 class ExploitConf(App[int]):
     
@@ -20,7 +27,8 @@ class ExploitConf(App[int]):
         edit:bool,
         name:str|None = None,
         lang:Language|None = None,
-        service:str|None = None
+        service:str|None = None,
+        templates: list[dict] | None = None,
     ):
         super().__init__()
         self.config = config
@@ -37,6 +45,8 @@ class ExploitConf(App[int]):
         self.title = f"xFarm - {'Editing' if self.edit else 'Creating'} Exploit"
         self.service_name = ""
         self.exploit_name = name if name else ""
+        self.templates = templates or []
+        self.template_id = DEFAULT_TEMPLATE_ID
     
     BINDINGS = [
         ("ctrl+s", "save()", "Save exploit"),
@@ -101,6 +111,15 @@ class ExploitConf(App[int]):
         
         yield Select(self.langs, id="lang", classes="input-label", value=self.lang, allow_blank=False)
         yield Select(self.services, id="srv", classes="input-label", value=self.service, allow_blank=False)
+        if not self.edit:
+            yield Label("[bold]Template:[/]", classes="input-label")
+            yield Select(
+                self.template_options(),
+                id="template",
+                classes="input-label",
+                value=self.template_id,
+                allow_blank=False,
+            )
         
         yield Label("[bold]New service name:[/]", classes="input-label hidden add-srv")
         yield Input(
@@ -127,6 +146,33 @@ class ExploitConf(App[int]):
     def show_error(self, s:str):
         self.query_one("#error", Label).update(s)
         self.query_one("#error", Label).remove_class("hidden")
+
+    def template_options(self):
+        custom_templates = templates_for_language(self.templates, self.lang)
+        return [("Default template", DEFAULT_TEMPLATE_ID)] + [
+            (f"{template['name']} ({template['run']})", str(template["id"]))
+            for template in custom_templates
+        ]
+
+    def selected_template(self):
+        if self.template_id == DEFAULT_TEMPLATE_ID:
+            return None
+        return next(
+            (
+                template
+                for template in templates_for_language(self.templates, self.lang)
+                if str(template["id"]) == self.template_id
+            ),
+            None,
+        )
+
+    def refresh_template_options(self) -> None:
+        if self.edit:
+            return
+        self.template_id = DEFAULT_TEMPLATE_ID
+        selector = self.query_one("#template", Select)
+        selector.set_options(self.template_options())
+        selector.value = self.template_id
     
     @on(Select.Changed, "#lang")
     def lang_changed(self, event: Select.Changed) -> None:
@@ -135,6 +181,7 @@ class ExploitConf(App[int]):
         else:
             self.query_one("#error", Label).add_class("hidden")
         self.lang = event.value
+        self.refresh_template_options()
     
     @on(Select.Changed, "#srv")
     def srv_changed(self, event: Select.Changed) -> None:
@@ -144,6 +191,10 @@ class ExploitConf(App[int]):
             self.query(".add-srv").add_class("hidden")
             self.query_one("#srv_name_errors_box", Horizontal).add_class("hidden")
         self.service = event.value
+
+    @on(Select.Changed, "#template")
+    def template_changed(self, event: Select.Changed) -> None:
+        self.template_id = str(event.value)
     
     def action_save(self):
         self.save()
@@ -156,16 +207,27 @@ class ExploitConf(App[int]):
         input_forms: List[Input] = self.query(".form-input")
         errors = []
         for form in input_forms:
+            # Skip validating the service name input if we are using an existing service
+            if form.id == "srv_name" and self.service is not None:
+                continue
             errors.extend([ele.failure_description for ele in form.validators if ele.failure_description and not ele.success()])
         
+        # Manually validate service name for empty/spaces if creating a new service
+        if self.service is None:
+            srv_name_val = self.query_one("#srv_name", Input).value
+            if not srv_name_val.strip():
+                errors.append("Service name cannot be empty")
+        
         if len(errors) == 0 and self.exploit_name:
+            selected_template = None
             if self.service is None:
                 try:
-                    self.service  = UUID(self.config.reqs.new_service({"name": self.service_name})["id"])
+                    srv_name_val = self.query_one("#srv_name", Input).value.strip()
+                    self.service  = UUID(self.config.reqs.new_service({"name": srv_name_val})["id"])
                     self.config.fetch_status()
                 except Exception as e:
-                    print(f"[bold yellow] Service not subscribed!: {e}")
-                    self.service = UUID("00000000-0000-0000-0000-000000000000")
+                    self.show_error(f"[bold red]Failed to create service:[/] {escape(str(e))}")
+                    return
             if self.edit:
                 x_conf = ExploitConfig.read(".")
                 x_conf.name = self.exploit_name
@@ -176,7 +238,16 @@ class ExploitConf(App[int]):
                     self.show_error(f"[bold red]The exploit named '{self.exploit_name}' already exists")
                     return
                 x_conf = ExploitConfig.new(self.exploit_name, Language(self.lang), self.service, generate_folder=True)
-            x_conf.write(exists_ok=True)
+                selected_template = self.selected_template()
+                if selected_template:
+                    x_conf.run = selected_template["run"]
+                    x_conf.interpreter = selected_template.get("interpreter")
+                    os.makedirs(x_conf.folder, exist_ok=True)
+                    extract_cached_template(selected_template, x_conf.folder)
+            x_conf.write(
+                exists_ok=True,
+                create_default_source=not self.edit and selected_template is None,
+            )
             try:
                 x_conf.publish_exploit(self.config)
             except Exception:
@@ -184,7 +255,7 @@ class ExploitConf(App[int]):
                 return
             self.exit(0)
         else:
-            self.show_error(f"[bold red]{', '.join(errors)}")
+            self.show_error(f"[bold red]{escape(', '.join(errors))}")
             
     @on(Button.Pressed, "#cancel")
     def cancel(self):
@@ -212,4 +283,3 @@ class ExploitConf(App[int]):
         else:
             error_box.add_class("hidden")
             self.service_name = event.input.value
-

exploitfarm-1.7.0/exploitfarm/tui/template.py

@@ -0,0 +1,227 @@
+import os
+from typing import Any
+
+from rich.markup import escape
+from textual import on
+from textual.app import App, ComposeResult
+from textual.containers import Horizontal
+from textual.widgets import Button, Footer, Header, Input, Label, OptionList, Select
+
+from exploitfarm.models.enums import Language
+from exploitfarm.utils.exploit import get_filename, get_interpreter
+
+
+class TemplateMetadataForm(App[dict[str, Any] | None]):
+    def __init__(
+        self,
+        path: str | None = None,
+        template: dict[str, Any] | None = None,
+    ):
+        super().__init__()
+        self.path = path
+        self.template = template or {}
+        self.edit = template is not None
+        self.title = f"xFarm - {'Edit' if self.edit else 'Add'} Exploit Template"
+        self.langs = [(lang.value, lang.value) for lang in list(Language)]
+        self.template_name = self.template.get("name") or self.default_name(path)
+        self.description = self.template.get("description") or ""
+        self.language = self.template.get("language") or Language.python.value
+        self.run_file = self.template.get("run") or get_filename(Language(self.language))
+        self.interpreter = (
+            self.template.get("interpreter")
+            if self.edit
+            else get_interpreter(Language(self.language))
+        ) or ""
+
+    BINDINGS = [
+        ("ctrl+s", "save()", "Save template"),
+        ("ctrl+c", "cancel()", "Cancel operation"),
+    ]
+
+    CSS = """
+    Input, Select {
+        margin: 1 2;
+    }
+    .input-label {
+        margin: 1 2;
+    }
+    #error {
+        margin: 1 2;
+    }
+    .button-box {
+        height: 4;
+        margin: 2 0;
+        margin-top: 1;
+    }
+    Button {
+        margin: 1 2;
+    }
+    """
+
+    @staticmethod
+    def default_name(path: str | None) -> str:
+        if path is None:
+            return ""
+        abs_path = os.path.abspath(path)
+        if os.path.basename(abs_path):
+            return os.path.basename(abs_path)
+        return os.path.basename(os.path.dirname(abs_path))
+
+    def compose(self) -> ComposeResult:
+        yield Header(f"xFarm - {'Edit' if self.edit else 'Add'} Exploit Template")
+        if self.path:
+            yield Label(
+                f"[bold]Template source:[/] [gray62]{escape(os.path.abspath(self.path))}[/]",
+                classes="input-label",
+            )
+        yield Label("[bold]Template name:[/]", classes="input-label")
+        yield Input(
+            value=self.template_name,
+            placeholder="Python requests skeleton",
+            id="name",
+        )
+        yield Label("[bold]Description:[/]", classes="input-label")
+        yield Input(
+            value=self.description,
+            placeholder="Optional description",
+            id="description",
+        )
+        yield Label("[bold]Language:[/]", classes="input-label")
+        yield Select(self.langs, value=self.language, allow_blank=False, id="language")
+        yield Label("[bold]Run file:[/]", classes="input-label")
+        yield Input(value=self.run_file, placeholder="main.py", id="run")
+        yield Label("[bold]Interpreter:[/]", classes="input-label")
+        yield Input(value=self.interpreter, placeholder="python3", id="interpreter")
+        yield Label("", id="error")
+        yield Horizontal(
+            Button("Save", id="save", variant="success"),
+            Button("Cancel", id="cancel", variant="error"),
+            classes="button-box",
+        )
+        yield Footer()
+
+    def action_save(self):
+        self.save()
+
+    def action_cancel(self):
+        self.cancel()
+
+    def validate_inputs(self) -> str | None:
+        if not self.template_name.strip():
+            return "Template name is required"
+        if not self.run_file.strip():
+            return "Run file is required"
+        normalized_run = self.run_file.replace("\\", "/").strip()
+        if normalized_run.startswith("/") or normalized_run in ["", "."]:
+            return "Run file must be a relative file path"
+        if ".." in normalized_run.split("/"):
+            return "Run file cannot contain '..'"
+        return None
+
+    @on(Button.Pressed, "#save")
+    def save(self):
+        error = self.validate_inputs()
+        if error:
+            self.query_one("#error", Label).update(f"[bold red]{escape(error)}[/]")
+            return
+        self.exit(
+            {
+                "name": self.template_name.strip(),
+                "description": self.description.strip() or None,
+                "language": self.language,
+                "run": self.run_file.replace("\\", "/").strip(),
+                "interpreter": self.interpreter.strip() or None,
+            }
+        )
+
+    @on(Button.Pressed, "#cancel")
+    def cancel(self):
+        self.exit(None)
+
+    @on(Input.Changed, "#name")
+    def name_changed(self, event: Input.Changed) -> None:
+        self.template_name = event.value
+
+    @on(Input.Changed, "#description")
+    def description_changed(self, event: Input.Changed) -> None:
+        self.description = event.value
+
+    @on(Select.Changed, "#language")
+    def language_changed(self, event: Select.Changed) -> None:
+        self.language = str(event.value)
+        if not self.edit:
+            lang = Language(self.language)
+            self.run_file = get_filename(lang)
+            self.interpreter = get_interpreter(lang) or ""
+            self.query_one("#run", Input).value = self.run_file
+            self.query_one("#interpreter", Input).value = self.interpreter
+
+    @on(Input.Changed, "#run")
+    def run_changed(self, event: Input.Changed) -> None:
+        self.run_file = event.value
+
+    @on(Input.Changed, "#interpreter")
+    def interpreter_changed(self, event: Input.Changed) -> None:
+        self.interpreter = event.value
+
+
+class TemplateSelect(App[dict[str, Any] | None]):
+    def __init__(self, templates: list[dict[str, Any]]):
+        super().__init__()
+        self.title = "xFarm - Select Exploit Template"
+        self.templates = templates
+
+    BINDINGS = [
+        ("ctrl+c", "cancel()", "Cancel operation"),
+    ]
+
+    CSS = """
+    #selector {
+        margin: 2 5 0 5;
+        height: 80%;
+    }
+    .button-box {
+        height: 4;
+        margin: 2 0;
+        margin-top: 1;
+    }
+    Button {
+        margin: 1 2;
+    }
+    """
+
+    def compose(self) -> ComposeResult:
+        yield Header("xFarm - Select Exploit Template")
+        yield OptionList(id="selector")
+        yield Horizontal(
+            Button("Edit", id="select", variant="success"),
+            Button("Cancel", id="cancel", variant="error"),
+            classes="button-box",
+        )
+        yield Footer()
+
+    def on_mount(self) -> None:
+        self.query_one("#selector", OptionList).add_options(
+            [
+                f"\n  [bold blue]{escape(template['name'])}[/] "
+                f"([gray62]{escape(template['id'])}[/])\n"
+                f"  [bold]language:[/] [gray62]{escape(template['language'])}[/] "
+                f"[bold]run:[/] [gray62]{escape(template['run'])}[/]\n"
+                for template in self.templates
+            ]
+        )
+
+    def action_cancel(self):
+        self.cancel()
+
+    @on(Button.Pressed, "#select")
+    def select(self):
+        self.query_one("#selector", OptionList).action_select()
+
+    @on(OptionList.OptionSelected, "#selector")
+    def template_selected(self, event: OptionList.OptionSelected) -> None:
+        self.exit(self.templates[event.option_index])
+
+    @on(Button.Pressed, "#cancel")
+    def cancel(self):
+        self.exit(None)

{exploitfarm-1.6.8 → exploitfarm-1.7.0}/exploitfarm/utils/config.py

@@ -157,11 +157,11 @@ EXPLOIT_CONFIG_FILE_NAME = "config.toml"
 
 class ExploitConfig(BaseModel):
     uuid: UUID
-    name: str
+    name: str | None = None
     interpreter: str | None = None
     run: str
-    language: Language
-    service: UUID
+    language: Language | None = None
+    service: UUID | None = None
 
     __exploit_lock = None
     __folder = "."
@@ -178,13 +178,16 @@ class ExploitConfig(BaseModel):
     ) -> Self:
         if isinstance(lang, str):
             lang = get_lang(lang)
+            if not lang:
+                raise ValueError(f"Unknown language: {lang}")
+
         obj = cls(
             uuid=uuid4(),
             name=name,
             language=lang,
             service=srv,
-            interpreter=get_interpreter(lang),
             run=get_filename(lang),
+            interpreter=get_interpreter(lang),
         )
         if generate_folder:
             obj.__folder = generate_exploit_folder_name(name, obj.uuid)
@@ -193,13 +196,17 @@ class ExploitConfig(BaseModel):
         return obj
 
     def model_dump_toml(self) -> str:
-        return toml.dumps(self.model_dump(mode="json"))
+        return toml.dumps(self.model_dump(mode="json", exclude_none=True))
 
     @classmethod
     def model_validate_toml(cls, data: str) -> Self:
         return cls(**toml.loads(data))
 
-    def write(self, exists_ok: bool = False):
+    @property
+    def folder(self) -> str:
+        return self.__folder
+
+    def write(self, exists_ok: bool = False, create_default_source: bool = True):
         # Autogenerated path
         pathexists = os.path.exists(self.__folder)
         if not pathexists and not exists_ok:
@@ -210,25 +217,45 @@ class ExploitConfig(BaseModel):
 
         if not pathexists:
             os.makedirs(self.__folder)
-            with open(
-                os.path.join(self.__folder, get_filename(self.language)), "wt"
-            ) as f:
-                f.write(get_default_file(self.language))
+            if create_default_source:
+                with open(
+                    os.path.join(self.__folder, get_filename(self.language)), "wt"
+                ) as f:
+                    f.write(get_default_file(self.language))
 
         with open(os.path.join(self.__folder, EXPLOIT_CONFIG_FILE_NAME), "w") as f:
             f.write(self.model_dump_toml())
 
     def publish_exploit(self, config: ClientConfig):
-        config.reqs.new_exploit(
-            {
-                "id": self.uuid,
-                "name": self.name,
-                "language": self.language.value,
-                "status": ExploitStatus.disabled.value,
-                "service": self.service,
-                "created_by": config.client_id,
-            }
-        )
+        data_to_edit = {}
+        if self.name is not None:
+            data_to_edit["name"] = self.name
+        if self.service is not None:
+            data_to_edit["service"] = self.service
+        if self.language is not None:
+            data_to_edit["language"] = self.language.value
+
+        if not data_to_edit:
+            return
+
+        if self.name is not None and self.service is not None:
+            config.reqs.new_exploit(
+                {
+                    "id": self.uuid,
+                    "name": self.name,
+                    "language": self.language.value if self.language else Language.other.value,
+                    "status": ExploitStatus.disabled.value,
+                    "service": self.service,
+                    "created_by": config.client_id,
+                }
+            )
+        else:
+            config.reqs.edit_exploit(self.uuid, data_to_edit)
+
+        self.name = None
+        self.service = None
+        self.language = None
+        self.write(exists_ok=True, create_default_source=False)
 
     @property
     def lock(self):