iotsploit-exploits 0.0.6__py3-none-any.whl

iotsploit_exploits/ip_scan/ip_scan.py

@@ -0,0 +1,196 @@
+import logging
+import pluggy
+from typing import Optional
+from iotsploit_core.core.exploit_spec import ExploitResult
+from iotsploit_django.tools.net_audit_mgr import NetAudit_Mgr
+from iotsploit_django.tools.env_mgr import Env_Mgr
+from iotsploit_django.tools.wifi_mgr import WiFi_Mgr
+from iotsploit_django.tools.vehicle_utils import query_tcam_ip
+from iotsploit_django.tools.bash_script_engine import Bash_Script_Mgr
+from iotsploit_core.core.base_plugin import BasePlugin
+
+logger = logging.getLogger(__name__)
+hookimpl = pluggy.HookimplMarker("exploit_mgr")
+
+class IPScanPlugin(BasePlugin):
+    def __init__(self):
+        super().__init__({
+            'Name': 'IP Network Scanner',
+            'Description': 'Scans network for active IP addresses and open ports',
+            'License': 'GPL',
+            'Author': ['iotsploit'],
+            'Parameters': {
+                'scan_type': {
+                    'type': 'str',
+                    'required': True,
+                    'description': 'Type of scan to perform',
+                    'default': 'tcam_ap_forward',
+                    'validation': {
+                        'choices': ['tcam_ap_forward']
+                    }
+                },
+                'scan_mode': {
+                    'type': 'str',
+                    'required': True,
+                    'description': 'Scan mode: fast (common ports) or full (all ports)',
+                    'default': 'fast',
+                    'validation': {
+                        'choices': ['fast', 'full']
+                    }
+                }
+            }
+        })
+        
+        self.net_audit_mgr = NetAudit_Mgr.Instance()
+        self.env_mgr = Env_Mgr.Instance()
+        self.wifi_mgr = WiFi_Mgr.Instance()
+        self.bash_mgr = Bash_Script_Mgr.Instance()
+        
+        # Constants
+        self.TCAM_AP_SCAN_IP_LIST = "tcam_ap_scan_ip_list"
+        self.DEL_ROUTES_CMDS = "del_routes_cmds"
+        
+        # IP Lists
+        self.scan_iplist_fast = [
+                "10.0.0.0/8", #扫这个段会很慢
+                "198.18.0.0/16",
+                "198.99.0.0/16",
+                "192.168.0.0/16",
+                "169.254.0.0/16",
+        ]
+        
+        self.scan_iplist_full = [
+                "198.18.34.1",
+                "198.18.36.1",
+                "198.18.36.2",
+                "198.18.36.3",
+                "198.18.36.4",
+                "198.18.35.2",
+                "198.18.35.3",
+                "198.18.35.7",
+                "198.18.36.177",
+                "198.18.35.4",
+                "198.18.35.11",
+                "198.18.35.12",
+                "198.18.35.13",
+                "198.18.35.14",
+                "198.18.32.18",
+                "198.18.32.1",
+                "198.18.32.2",
+                "198.99.34.1",
+                "198.18.34.2",
+                "198.18.34.10",
+                "198.18.34.11",
+                "198.18.34.15",
+                "198.18.32.19",
+                "198.18.34.3",
+                "198.18.34.4",
+                "198.18.34.5",
+                "198.18.34.14",
+                "198.18.37.20",
+                "198.18.35.5",
+                "198.18.35.161",
+                "198.18.35.6",
+                "198.18.35.128",
+                "198.18.36.96",
+                "198.18.35.8",
+                "198.18.32.17",
+                "198.18.35.9",
+                "198.18.35.10",
+                "198.18.32.24",
+                "198.99.34.15",
+                "192.168.1.3",
+                "10.1.6.6",
+                "10.1.4.6",
+                "10.1.2.6",
+                "10.1.5.6",
+                "10.1.3.6"
+        ]
+        
+        self.fast_ports = "21,22,23,5555,50000,8000,11111,12345,10086,53,1883,13400"
+
+    @hookimpl
+    def initialize(self, device_plugin=None):
+        logger.debug("Initializing IPScanPlugin")
+        self.scan_iplist = []
+        self.scan_portlist = ""
+
+    def _add_routes(self, viaip, dstips):
+        for ip in dstips:
+            route_cmds = self.env_mgr.query(self.DEL_ROUTES_CMDS, [])
+            route_cmds.append(f"ip route del {ip} via {viaip}")
+            self.env_mgr.set(self.DEL_ROUTES_CMDS, route_cmds)
+            self.bash_mgr.exec_cmd(f"ip route add {ip} via {viaip}")
+
+    def _del_routes(self):
+        route_cmds = self.env_mgr.query(self.DEL_ROUTES_CMDS, [])
+        for cmd in route_cmds:
+            self.bash_mgr.exec_cmd(cmd)
+        self.env_mgr.set(self.DEL_ROUTES_CMDS, [])
+
+    def tcam_ap_ip_scan(self):
+        iplist = self.env_mgr.query(self.TCAM_AP_SCAN_IP_LIST)
+        if iplist is None:
+            tcamip = query_tcam_ip()
+            if tcamip and self.wifi_mgr.status()['WIFI_MODE'] == "STA":
+                self._add_routes(tcamip, self.scan_iplist)
+                iplist = self.net_audit_mgr.ip_detect(self.scan_iplist)
+                self._del_routes()
+                self.env_mgr.set(self.TCAM_AP_SCAN_IP_LIST, iplist)
+            else:
+                return ExploitResult(False, "WiFi status incorrect", {})
+        return iplist
+
+    @hookimpl
+    def execute(self, target: Optional[dict] = None, parameters: Optional[dict] = None) -> ExploitResult:
+        """
+        Execute IP network scan.
+        
+        Note: This plugin scans predefined internal IP lists to check if TCAM AP
+        exposes vehicle internal network. The 'target' parameter is not used.
+        
+        Args:
+            target: Not used by this plugin (scans predefined IP lists)
+            parameters: Plugin configuration
+                - scan_type: Type of scan ('tcam_ap_forward')
+                - scan_mode: Scan mode ('fast' or 'full')
+        """
+        # Get parameters from 'parameters' dict (not from 'target')
+        parameters = parameters or {}
+        scan_type = parameters.get('scan_type', self.info['Parameters']['scan_type']['default'])
+        scan_mode = parameters.get('scan_mode', self.info['Parameters']['scan_mode']['default'])
+
+        logger.info(f"Starting IP scan: type={scan_type}, mode={scan_mode}")
+
+        # Set scan parameters based on mode
+        if scan_mode == "fast":
+            self.scan_iplist = self.scan_iplist_fast
+            self.scan_portlist = self.fast_ports
+        elif scan_mode == "full":
+            self.scan_iplist = self.scan_iplist_full
+            self.scan_portlist = "1-65535"
+        else:
+            return ExploitResult(False, f"Invalid scan mode: {scan_mode}", {})
+
+        try:
+            if scan_type == "tcam_ap_forward":
+                iplist = self.tcam_ap_ip_scan()
+                if iplist:
+                    return ExploitResult(False, f"TCAM AP exposed internal IPs: {iplist}", {"exposed_ips": iplist})
+                return ExploitResult(True, "No internal IPs exposed through TCAM AP", {})
+            # Add other scan types here...
+            
+            return ExploitResult(False, f"Unknown scan type: {scan_type}", {})
+            
+        except Exception as e:
+            logger.error(f"Error during IP scan: {str(e)}")
+            return ExploitResult(False, f"IP scan failed: {str(e)}", {})
+
+    @hookimpl
+    def cleanup(self):
+        logger.info("Cleaning up IPScanPlugin")
+        self._del_routes()
+
+def register_plugin(pm):
+    ip_scan_plugin = IPScanPlugin()
+    pm.register(ip_scan_plugin)

iotsploit_exploits/nmap_scan/nmap_scan.py

@@ -0,0 +1,207 @@
+import logging
+import pluggy
+from typing import Any, Dict, List, Optional, Tuple
+
+from iotsploit_core.core.base_plugin import BasePlugin
+from iotsploit_core.core.exploit_spec import ExploitResult
+from iotsploit_core.core.tool_manager import get_tool_manager
+
+
+logger = logging.getLogger(__name__)
+hookimpl = pluggy.HookimplMarker("exploit_mgr")
+
+
+def _extract_ip_from_target(target: Any) -> Optional[str]:
+    """
+    Extract vehicle IP address from target dict.
+
+    Design decision:
+    - Plugin runs in dict mode at the boundary.
+    - The canonical key for vehicle IP is `ip_address` (consistent with core domain Vehicle.get_info()).
+    """
+    if not isinstance(target, dict):
+        return None
+    ip = target.get("ip_address") or target.get("ip") or target.get("host")
+    if isinstance(ip, str) and ip.strip():
+        return ip.strip()
+    return None
+
+
+def _parse_nmap_grepable(output: str) -> Dict[str, Any]:
+    """
+    Parse nmap grepable output (-oG -).
+
+    We intentionally use grepable output instead of XML to keep parsing lightweight
+    and avoid bringing in additional dependencies.
+    """
+    hosts: List[Dict[str, Any]] = []
+    current_host: Optional[Dict[str, Any]] = None
+
+    for raw_line in (output or "").splitlines():
+        line = raw_line.strip()
+        if not line:
+            continue
+
+        # Example:
+        # Host: 192.168.1.10 ()  Status: Up
+        # Host: 192.168.1.10 ()  Ports: 22/open/tcp//ssh///, 80/open/tcp//http///
+        if line.startswith("Host: "):
+            # Split once at "Status:" or "Ports:" if present
+            # Keep it robust against slight format changes.
+            host_ip = None
+            try:
+                # "Host: <ip> (" -> take second token
+                host_ip = line.split()[1]
+            except Exception:
+                host_ip = None
+
+            # Start a new host record when we see a Host line with Status/Ports
+            if host_ip:
+                if current_host is None or current_host.get("ip") != host_ip:
+                    current_host = {"ip": host_ip, "status": None, "ports": []}
+                    hosts.append(current_host)
+
+            if current_host is None:
+                continue
+
+            if "Status:" in line:
+                # Status: Up/Down
+                status = line.split("Status:", 1)[1].strip()
+                current_host["status"] = status
+
+            if "Ports:" in line:
+                ports_str = line.split("Ports:", 1)[1].strip()
+                parsed_ports: List[Dict[str, Any]] = []
+                for entry in ports_str.split(","):
+                    e = entry.strip()
+                    if not e:
+                        continue
+                    # "22/open/tcp//ssh///"
+                    fields = e.split("/")
+                    if len(fields) < 3:
+                        continue
+                    port_s, state, proto = fields[0], fields[1], fields[2]
+                    service = fields[4] if len(fields) > 4 else ""
+                    try:
+                        port = int(port_s)
+                    except ValueError:
+                        continue
+                    parsed_ports.append(
+                        {
+                            "port": port,
+                            "state": state,
+                            "protocol": proto,
+                            "service": service,
+                            "raw": e,
+                        }
+                    )
+                current_host["ports"] = parsed_ports
+
+    return {"hosts": hosts}
+
+
+class NmapScanPlugin(BasePlugin):
+    def __init__(self):
+        super().__init__(
+            {
+                "Name": "Nmap Scan",
+                "Description": "Run nmap against vehicle ip_address (dict-mode target).",
+                "License": "GPL",
+                "Author": ["iotsploit"],
+                "RequiresRoot": False,
+                "Parameters": {
+                    "ports": {
+                        "type": "str",
+                        "required": False,
+                        "description": "Ports to scan. Example: '22,80,443' or '1-1000'. Default: top ports (nmap default).",
+                        "default": "",
+                    },
+                    "scan_args": {
+                        "type": "str",
+                        "required": False,
+                        "description": "Extra nmap args appended as-is. Example: '-sV --reason'.",
+                        "default": "-sV --reason",
+                    },
+                    "timeout_s": {
+                        "type": "int",
+                        "required": False,
+                        "description": "Execution timeout in seconds (ToolManager subprocess timeout).",
+                        "default": 120,
+                    },
+                },
+            }
+        )
+
+    @hookimpl
+    def initialize(self, device_plugin: Optional[Any] = None):
+        # No-op; tool availability checked on execute.
+        logger.debug("Initializing NmapScanPlugin")
+
+    @hookimpl
+    def execute(self, target: Optional[Any] = None, parameters: Optional[dict] = None) -> ExploitResult:
+        parameters = parameters or {}
+
+        ip = _extract_ip_from_target(target)
+        if not ip:
+            return ExploitResult(False, "Missing target ip_address (dict target expected)", {})
+
+        tool_mgr = get_tool_manager()
+        if not tool_mgr.is_available("nmap"):
+            status = tool_mgr.get_tool_status("nmap")
+            return ExploitResult(
+                False,
+                f"nmap not available: {getattr(status, 'value', str(status))}",
+                {"tool": "nmap", "status": getattr(status, "value", str(status))},
+            )
+
+        ports = (parameters.get("ports") or "").strip()
+        scan_args = (parameters.get("scan_args") or "").strip()
+        timeout_s = parameters.get("timeout_s", 120)
+        try:
+            timeout_s = int(timeout_s)
+        except Exception:
+            timeout_s = 120
+
+        # Build args:
+        # -oG - : grepable output to stdout for lightweight parsing
+        args: List[str] = []
+        if scan_args:
+            # naive split; good enough for typical CLI-like args
+            args.extend(scan_args.split())
+        args.extend(["-oG", "-", "-Pn"])
+        if ports:
+            args.extend(["-p", ports])
+        args.append(ip)
+
+        logger.info("Running nmap scan on %s (ports=%s)", ip, ports or "default")
+        result = tool_mgr.execute("nmap", args=args, timeout=timeout_s)
+
+        # nmap can return non-zero even with useful output; treat as success if we got stdout.
+        stdout = (result.stdout or "").strip()
+        stderr = (result.stderr or "").strip()
+        parsed = _parse_nmap_grepable(stdout)
+
+        success = bool(parsed.get("hosts")) or result.success
+        message = "nmap scan completed" if success else "nmap scan failed"
+
+        data: Dict[str, Any] = {
+            "target_ip": ip,
+            "command": result.command,
+            "return_code": result.return_code,
+            "execution_time": result.execution_time,
+            "stdout": stdout,
+            "stderr": stderr,
+            "parsed": parsed,
+        }
+
+        return ExploitResult(success, message, data)
+
+    @hookimpl
+    def cleanup(self):
+        logger.debug("Cleaning up NmapScanPlugin")
+
+
+def register_plugin(pm):
+    pm.register(NmapScanPlugin())
+
+

iotsploit_exploits/plugin_ssh.py

@@ -0,0 +1,146 @@
+import os
+# Disable pwntools terminal mode before importing to prevent fileno() errors in non-TTY environments
+os.environ.setdefault("PWNLIB_NOTERM", "1")
+
+import pluggy
+import logging
+from pwn import ssh
+from typing import Any, Optional
+from iotsploit_core.core.exploit_spec import ExploitResult
+from iotsploit_core.core.base_plugin import BasePlugin
+
+logger = logging.getLogger(__name__)
+hookimpl = pluggy.HookimplMarker("exploit_mgr")
+
+
+def _extract_ip_from_target(target: Optional[dict]) -> Optional[str]:
+    """
+    Extract IP address from target dict.
+
+    Design decision:
+    - Plugin runs in dict mode at the boundary.
+    - The canonical key for IP is `ip_address` (consistent with core domain Target.get_info()).
+    """
+    if not isinstance(target, dict):
+        return None
+    ip = target.get("ip_address") or target.get("ip") or target.get("host")
+    if isinstance(ip, str) and ip.strip():
+        return ip.strip()
+    return None
+
+class SSHPlugin(BasePlugin):
+    def __init__(self):
+        super().__init__({
+            'Name': 'SSH Remote Command',
+            'Description': 'Connect to target via SSH and execute a command.',
+            'License': 'GPL',
+            'Author': ['iotsploit'],
+            'Parameters': {
+                'user': {
+                    'type': 'str',
+                    'required': False,
+                    'description': 'SSH username',
+                    'default': 'root'
+                },
+                'passwd': {
+                    'type': 'str',
+                    'required': False,
+                    'description': 'SSH password',
+                    'default': '123456'
+                },
+                'cmd': {
+                    'type': 'str',
+                    'required': False,
+                    'description': 'Command to run on the remote host',
+                    'default': 'ls -l'
+                }
+            }
+        })
+        self.ssh_mgr = SSH_Mgr()
+
+    @hookimpl
+    def initialize(self):
+        logger.debug("Initializing SSHPlugin")
+
+    @hookimpl
+    def execute(self, target: Optional[dict] = None, parameters: Optional[dict] = None) -> ExploitResult:
+        # Extract IP from target dict (normalized by exploit_manager)
+        target_ip = _extract_ip_from_target(target)
+        if not target_ip:
+            logger.warning("No valid target IP. Expected dict with 'ip_address' key.")
+            return ExploitResult(False, "Missing target ip_address (dict target expected)", {})
+
+        # Merge parameters with defaults
+        parameters = parameters or {}
+        user = parameters.get('user', self.info['Parameters']['user']['default'])
+        passwd = parameters.get('passwd', self.info['Parameters']['passwd']['default'])
+        cmd = parameters.get('cmd', self.info['Parameters']['cmd']['default'])
+
+        logger.info(f"Executing SSH command on {target_ip}: {cmd}")
+
+        ssh_context = self.ssh_mgr.open_ssh(target_ip, user, passwd)
+        if not ssh_context:
+            return ExploitResult(False, "Failed to establish SSH connection", {})
+
+        try:
+            result = self.ssh_mgr.ssh_cmd(ssh_context, cmd)
+            self.ssh_mgr.close_ssh(ssh_context)
+            if result is None:
+                return ExploitResult(False, "SSH command execution failed", {})
+            return ExploitResult(True, "SSH command executed successfully", {"result": result})
+        except Exception as e:
+            logger.exception("SSH command execution error")
+            try:
+                self.ssh_mgr.close_ssh(ssh_context)
+            except Exception:
+                pass
+            return ExploitResult(False, f"SSH execution failed: {str(e)}", {})
+
+class SSH_Mgr:
+    __ssh_connect_timeout_S = 1
+
+    @staticmethod
+    def Instance():
+        return _instance
+        
+    def __init__(self):
+        self.__ssh_dict = {}
+
+    def open_ssh(self, ip: str, user: str, passwd: str):
+        try:
+            ssh_context = ssh(host=ip, user=user, password=passwd, timeout=self.__ssh_connect_timeout_S)
+            logger.info("SSH connect %s success.", ip)
+            return ssh_context
+        except Exception:
+            logger.exception("SSH connect %s fail!", ip)
+            return None
+
+    def close_ssh(self, ssh_context: Any):
+        if ssh_context is None:
+            logger.error("SSH context invalid!")
+            return
+        try:
+            ssh_context.close()
+            logger.info("SSH close success.")
+        except Exception:
+            logger.exception("SSH close fail!")
+        return
+
+    def ssh_cmd(self, ssh_context: Any, ssh_cmd: str):
+        if ssh_context is None:
+            logger.error("SSH context invalid!")
+            return None
+        try:
+            # Run the command via remote process and collect output
+            proc = ssh_context.process(["sh", "-lc", ssh_cmd])
+            cmd_result = proc.recvall().decode('utf-8', errors='ignore')
+            logger.info("SSH run CMD success. CMD: %s\nResult:\n%s", ssh_cmd, cmd_result)
+            return cmd_result
+        except Exception:
+            logger.exception("SSH run CMD fail! CMD: %s", ssh_cmd)
+            return None
+
+_instance = SSH_Mgr()
+
+def register_plugin(pm):
+    pm.register(SSHPlugin())

iotsploit_exploits/rubber_duck_scripts/linux_infogather.txt

@@ -0,0 +1,126 @@
+REM Linux Information Gathering Script for Rubber Duck
+REM -----------------------------------------------
+REM This script opens a terminal and gathers basic system information
+
+REM Wait for OS to recognize the device
+DELAY 1000
+
+REM Open terminal (Ctrl+Alt+T on most Linux distros)
+CTRL ALT T
+DELAY 1500
+
+REM Create a directory for collected information
+STRING mkdir -p ~/duck_info
+DELAY 200
+ENTER
+DELAY 500
+
+REM Switch to that directory
+STRING cd ~/duck_info
+DELAY 200
+ENTER
+DELAY 300
+
+REM Create a script file to collect information
+STRING cat > collect.sh << 'EOF'
+DELAY 200
+ENTER
+STRING #!/bin/bash
+DELAY 100
+ENTER
+STRING echo "=== System Information Collected by Rubber Duck ===" > report.txt
+DELAY 100
+ENTER
+STRING echo -e "\n=== Date and Time ===" >> report.txt
+DELAY 100
+ENTER
+STRING date >> report.txt
+DELAY 100
+ENTER
+STRING echo -e "\n=== Hostname and IP ===" >> report.txt
+DELAY 100
+ENTER
+STRING hostname -I >> report.txt
+DELAY 100
+ENTER
+STRING echo -e "\n=== System Info ===" >> report.txt
+DELAY 100
+ENTER
+STRING uname -a >> report.txt
+DELAY 100
+ENTER
+STRING echo -e "\n=== CPU Info ===" >> report.txt
+DELAY 100
+ENTER
+STRING lscpu | grep "Model name" >> report.txt
+DELAY 100
+ENTER
+STRING echo -e "\n=== Memory Info ===" >> report.txt
+DELAY 100
+ENTER
+STRING free -h >> report.txt
+DELAY 100
+ENTER
+STRING echo -e "\n=== Disk Space ===" >> report.txt
+DELAY 100
+ENTER
+STRING df -h >> report.txt
+DELAY 100
+ENTER
+STRING echo -e "\n=== Network Connections ===" >> report.txt
+DELAY 100
+ENTER
+STRING netstat -tun | head -20 >> report.txt
+DELAY 100
+ENTER
+STRING echo -e "\n=== Running Processes ===" >> report.txt
+DELAY 100
+ENTER
+STRING ps aux | head -20 >> report.txt
+DELAY 100
+ENTER
+STRING echo -e "\n=== Logged In Users ===" >> report.txt
+DELAY 100
+ENTER
+STRING who >> report.txt
+DELAY 100
+ENTER
+STRING echo -e "\n=== Package Information ===" >> report.txt
+DELAY 100
+ENTER
+STRING if [ -x "$(command -v dpkg)" ]; then dpkg --list | grep -v "^ii" | wc -l >> report.txt; fi
+DELAY 100
+ENTER
+STRING if [ -x "$(command -v rpm)" ]; then rpm -qa | wc -l >> report.txt; fi
+DELAY 100
+ENTER
+STRING echo "Information collection complete!" >> report.txt
+DELAY 100
+ENTER
+STRING EOF
+DELAY 200
+ENTER
+DELAY 500
+
+REM Make the script executable
+STRING chmod +x collect.sh
+DELAY 200
+ENTER
+DELAY 500
+
+REM Run the script
+STRING ./collect.sh
+DELAY 200
+ENTER
+DELAY 5000
+
+REM Display the collected information
+STRING cat report.txt
+DELAY 200
+ENTER
+DELAY 2000
+
+REM Close the terminal with exit command
+STRING exit
+DELAY 200
+ENTER