iotsploit-exploits 0.0.7__tar.gz → 0.0.8__tar.gz

{iotsploit_exploits-0.0.7 → iotsploit_exploits-0.0.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iotsploit-exploits
-Version: 0.0.7
+Version: 0.0.8
 Summary: Official IoTSploit exploit plugin package
 License: GPL-3.0-or-later
 Author: IoTSploit Team
@@ -16,7 +16,7 @@ Classifier: Programming Language :: Python :: 3.14
 Requires-Dist: facedancer (>=3.0.6,<4.0)
 Requires-Dist: iotsploit-core
 Requires-Dist: iotsploit-django
-Requires-Dist: pwntools (>=4.12)
+Requires-Dist: paramiko (>=3.0)
 Requires-Dist: pyserial (>=3.5)
 Requires-Dist: scapy (>=2.5)
 Description-Content-Type: text/markdown

{iotsploit_exploits-0.0.7 → iotsploit_exploits-0.0.8}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "iotsploit-exploits"
-version = "0.0.7"
+version = "0.0.8"
 description = "Official IoTSploit exploit plugin package"
 authors = ["IoTSploit Team <support@iotsploit.org>"]
 license = "GPL-3.0-or-later"
@@ -16,7 +16,7 @@ python = ">=3.10,<4.0"
 iotsploit-core = "*"
 iotsploit-django = "*"
 scapy = ">=2.5"
-pwntools = ">=4.12"
+paramiko = ">=3.0"
 pyserial = ">=3.5"
 # Bare ">=3.0" also matches legacy FaceDancer 2019.x releases under PEP 440.
 # Keep this on the 3.x line so the exploit imports resolve to the expected API.

{iotsploit_exploits-0.0.7 → iotsploit_exploits-0.0.8}/src/iotsploit_exploits/adb_check/adb_check.py

@@ -1,10 +1,5 @@
 #!/usr/bin/python3
 
-import os
-# Disable pwntools terminal mode before importing to prevent fileno() errors in non-TTY environments
-os.environ.setdefault("PWNLIB_NOTERM", "1")
-
-import logging
 import traceback
 import pluggy
 from iotsploit_django.tools.adb_mgr import ADB_Mgr
@@ -88,7 +83,6 @@ class AdbSecurityCheckPlugin(BasePlugin):
         try_root = params.get('try_root', False)
         check_suid = params.get('check_suid', True)
         check_writable = params.get('check_writable', True)
-        skip_interactive = params.get('skip_interactive', True)
         
         # If target is provided, try to get the device from it
         if target:
@@ -295,7 +289,7 @@ class AdbSecurityCheckPlugin(BasePlugin):
             
             # If root is required but we know we don't have it, don't even try
             if require_root and self._has_root is False:
-                logger.debug(f"Root access required for command but device is not rooted")
+                logger.debug("Root access required for command but device is not rooted")
                 return None
                 
             # Execute the command

{iotsploit_exploits-0.0.7 → iotsploit_exploits-0.0.8}/src/iotsploit_exploits/demo/async_sleep_attack.py

@@ -1,6 +1,5 @@
 #!/usr/bin/python3
 
-import logging
 import pluggy
 from typing import Optional, Any
 import asyncio

{iotsploit_exploits-0.0.7 → iotsploit_exploits-0.0.8}/src/iotsploit_exploits/flood_attack/flood_attack.py

@@ -1,7 +1,7 @@
 import logging
 import pluggy
 from typing import Optional, Any
-from iotsploit_django.tools.vehicle_utils import query_tcam_ip, query_dhu_ip, check_ecu_alive
+from iotsploit_django.tools.vehicle_utils import get_ecu_ip, check_ecu_alive
 from iotsploit_core.core.exploit_spec import ExploitResult
 from iotsploit_django.tools.net_audit_mgr import NetAudit_Mgr
 from iotsploit_core.utils import abort, sleep, IotsErrorCode
@@ -22,13 +22,15 @@ class FloodAttackPlugin(BasePlugin):
                     'type': 'str',
                     'required': True,
                     'description': 'Flood attack type',
-                    'default': 'icmp'
+                    'default': 'icmp',
+                    'validation': {'choices': ['icmp', 'udp', 'tcp', 'mac']}
                 },
                 'ecu': {
                     'type': 'str',
                     'required': True,
-                    'description': 'ECU name, e.g., tcam/dhu/vgm',
-                    'default': 'tcam'
+                    'description': 'Target ECU',
+                    'default': 'tcam',
+                    'validation': {'choices': ['tcam', 'dhu', 'vgm']}
                 }
             }
         })
@@ -42,14 +44,13 @@ class FloodAttackPlugin(BasePlugin):
 
     @hookimpl
     def execute(self, target: Optional[Any] = None, parameters: Optional[dict] = None) -> ExploitResult:
-        # Accept both target and parameters for compatibility
-        if target is None:
-            target = {}
+        # Params come via `parameters` (CLI/GUI/HTTP); fall back to `target` for compatibility.
+        params = parameters or {}
         if not isinstance(target, dict):
-            return ExploitResult(False, "Invalid target. Expected a dictionary with 'attack_type' and 'ecu'.", {})
+            target = {}
 
-        attack_type = target.get('attack_type', self.info['Parameters']['attack_type']['default'])
-        ecu = target.get('ecu', self.info['Parameters']['ecu']['default'])
+        attack_type = params.get('attack_type', target.get('attack_type', self.info['Parameters']['attack_type']['default']))
+        ecu = params.get('ecu', target.get('ecu', self.info['Parameters']['ecu']['default']))
 
         logger.info(f"Executing {attack_type} flood attack on {ecu}")
 
@@ -83,18 +84,17 @@ class FloodAttackPlugin(BasePlugin):
         self.net_audit_mgr.stop_mac_flood_attack()
 
     def _check_ecu_alive(self, ecu, checktype, attack_type):
-        if not check_ecu_alive(ecu, checktype):
+        # allow_live=False: never trigger WiFi resolution; the ECU IP must be configured
+        # on the current target (component properties.ip_address).
+        if not check_ecu_alive(ecu, checktype, allow_live=False):
             self._stop_flood_attack(attack_type)
-            abort(f"{ecu} is not alive", code=IotsErrorCode.HOST_UNREACHABLE, ecu=ecu, checktype=checktype)
+            abort(
+                f"{ecu} is not reachable. Configure the {ecu} component's ip_address on the "
+                f"current target (WiFi auto-connect is disabled for this plugin).",
+                code=IotsErrorCode.HOST_UNREACHABLE, ecu=ecu, checktype=checktype)
 
     def _get_ecu_ip(self, ecu):
-        if ecu == "tcam":
-            return query_tcam_ip()
-        elif ecu == "dhu":
-            return query_dhu_ip()
-        elif ecu == "vgm":
-            return "169.254.19.1"
-        return None
+        return get_ecu_ip(ecu, allow_live=False)
 
     def _start_flood_attack(self, attack_type, ecu, ecu_ip):
         if attack_type == "icmp":

{iotsploit_exploits-0.0.7 → iotsploit_exploits-0.0.8}/src/iotsploit_exploits/greatfet_echo.py

@@ -7,7 +7,6 @@ from iotsploit_core.core.exploit_spec import AsyncExploitResult
 from iotsploit_core.core.base_plugin import BasePlugin
 from facedancer.devices.ftdi import FTDIDevice
 from iotsploit_core.utils import iots_logger
-import asyncio
 
 hookimpl = pluggy.HookimplMarker("exploit_mgr")
 
@@ -56,11 +55,6 @@ class FTDIEchoPlugin(BasePlugin):
             if not self.device:
                 return AsyncExploitResult(False, "FTDI device not initialized", {})
 
-            # Get welcome message
-            welcome_msg = (parameters.get('message') 
-                           if parameters 
-                           else self.info['Parameters']['message']['default'])
-
             # Define the coroutine that waits for host and sends welcome message.
             async def send_hello():
                 self.logger.info("Waiting for the host to connect.")
@@ -100,4 +94,4 @@ class FTDIEchoPlugin(BasePlugin):
                 self.logger.info("FTDI Device disconnected")
                 self.device = None
         except Exception as e:
-            self.logger.error(f"Error during cleanup: {str(e)}")
+            self.logger.error(f"Error during cleanup: {str(e)}")

{iotsploit_exploits-0.0.7 → iotsploit_exploits-0.0.8}/src/iotsploit_exploits/greatfet_rubber_duck.py

@@ -4,10 +4,9 @@ import pluggy
 from typing import Optional, Any
 import asyncio
 import os
-import re
 from importlib.resources import files
 from facedancer.errors import EndEmulation
-from iotsploit_core.core.exploit_spec import ExploitResult, AsyncExploitResult
+from iotsploit_core.core.exploit_spec import ExploitResult
 from iotsploit_core.core.base_plugin import BasePlugin
 from facedancer.devices.keyboard import USBKeyboardDevice
 from facedancer.classes.hid.keyboard import KeyboardModifiers
@@ -144,7 +143,6 @@ class RubberDuckPlugin(BasePlugin):
     async def _parse_ducky_script(self, script):
         """Parse a DuckyScript formatted script into executable commands"""
         commands = []
-        delay = 0.5  # Default delay in seconds
         
         for line in script.splitlines():
             line = line.strip()
@@ -267,7 +265,7 @@ class RubberDuckPlugin(BasePlugin):
             self.logger.info("Initializing USB keyboard device...")
             try:
                 self.device = USBKeyboardDevice()
-                self.logger.info(f"USB keyboard device initialized")
+                self.logger.info("USB keyboard device initialized")
             except Exception as e:
                 self.logger.error(f"Failed to initialize USB keyboard device: {str(e)}")
                 return ExploitResult(False, f"Failed to initialize USB keyboard device: {str(e)}", {})

{iotsploit_exploits-0.0.7 → iotsploit_exploits-0.0.8}/src/iotsploit_exploits/hydra_ssh_attack.py

@@ -131,7 +131,7 @@ class HydraSSHAttackPlugin(BasePlugin):
             result = self.network_service.execute_tool('hydra', args, timeout=600)
             
             if result.success:
-                logger.info(f"Hydra SSH attack completed successfully")
+                logger.info("Hydra SSH attack completed successfully")
                 return ExploitResult(True, "Hydra SSH attack executed successfully", {
                     "output": result.stdout,
                     "execution_time": result.execution_time,

{iotsploit_exploits-0.0.7 → iotsploit_exploits-0.0.8}/src/iotsploit_exploits/ip_scan/ip_scan.py

@@ -4,8 +4,7 @@ from typing import Optional
 from iotsploit_core.core.exploit_spec import ExploitResult
 from iotsploit_django.tools.net_audit_mgr import NetAudit_Mgr
 from iotsploit_django.tools.env_mgr import Env_Mgr
-from iotsploit_django.tools.wifi_mgr import WiFi_Mgr
-from iotsploit_django.tools.vehicle_utils import query_tcam_ip
+from iotsploit_django.tools.vehicle_utils import get_ecu_ip
 from iotsploit_django.tools.bash_script_engine import Bash_Script_Mgr
 from iotsploit_core.core.base_plugin import BasePlugin
 
@@ -43,7 +42,7 @@ class IPScanPlugin(BasePlugin):
         
         self.net_audit_mgr = NetAudit_Mgr.Instance()
         self.env_mgr = Env_Mgr.Instance()
-        self.wifi_mgr = WiFi_Mgr.Instance()
+        self.wifi_backend = None
         self.bash_mgr = Bash_Script_Mgr.Instance()
         
         # Constants
@@ -52,7 +51,6 @@ class IPScanPlugin(BasePlugin):
         
         # IP Lists
         self.scan_iplist_fast = [
-                "10.0.0.0/8", #扫这个段会很慢
                 "198.18.0.0/16",
                 "198.99.0.0/16",
                 "192.168.0.0/16",
@@ -110,8 +108,9 @@ class IPScanPlugin(BasePlugin):
         self.fast_ports = "21,22,23,5555,50000,8000,11111,12345,10086,53,1883,13400"
 
     @hookimpl
-    def initialize(self, device_plugin=None):
+    def initialize(self, ctx=None, device_plugin=None):
         logger.debug("Initializing IPScanPlugin")
+        self.wifi_backend = getattr(ctx, "wifi", None) if ctx is not None else None
         self.scan_iplist = []
         self.scan_portlist = ""
 
@@ -131,8 +130,11 @@ class IPScanPlugin(BasePlugin):
     def tcam_ap_ip_scan(self):
         iplist = self.env_mgr.query(self.TCAM_AP_SCAN_IP_LIST)
         if iplist is None:
-            tcamip = query_tcam_ip()
-            if tcamip and self.wifi_mgr.status()['WIFI_MODE'] == "STA":
+            tcamip = get_ecu_ip("tcam")
+            if self.wifi_backend is None:
+                from iotsploit_platforms import get_shared_wifi_backend
+                self.wifi_backend = get_shared_wifi_backend()
+            if tcamip and self.wifi_backend.status()['wifi_mode'] == "STA":
                 self._add_routes(tcamip, self.scan_iplist)
                 iplist = self.net_audit_mgr.ip_detect(self.scan_iplist)
                 self._del_routes()

{iotsploit_exploits-0.0.7 → iotsploit_exploits-0.0.8}/src/iotsploit_exploits/nmap_scan/nmap_scan.py

@@ -1,6 +1,6 @@
 import logging
 import pluggy
-from typing import Any, Dict, List, Optional, Tuple
+from typing import Any, Dict, List, Optional
 
 from iotsploit_core.core.base_plugin import BasePlugin
 from iotsploit_core.core.exploit_spec import ExploitResult

{iotsploit_exploits-0.0.7 → iotsploit_exploits-0.0.8}/src/iotsploit_exploits/plugin_ssh.py

@@ -1,11 +1,16 @@
-import os
-# Disable pwntools terminal mode before importing to prevent fileno() errors in non-TTY environments
-os.environ.setdefault("PWNLIB_NOTERM", "1")
+"""SSH exploit plugin using Paramiko.
+
+Replaces the former pwntools-based SSH manager and plugin.  The SSH_Mgr
+here mirrors the behavioural contract of ``iotsploit_django.tools.ssh_mgr``
+but lives in the separately-packaged exploits component.
+"""
 
-import pluggy
 import logging
-from pwn import ssh
 from typing import Any, Optional
+
+import paramiko
+import pluggy
+
 from iotsploit_core.core.exploit_spec import ExploitResult
 from iotsploit_core.core.base_plugin import BasePlugin
 
@@ -28,6 +33,7 @@ def _extract_ip_from_target(target: Optional[dict]) -> Optional[str]:
         return ip.strip()
     return None
 
+
 class SSHPlugin(BasePlugin):
     def __init__(self):
         super().__init__({
@@ -96,51 +102,90 @@ class SSHPlugin(BasePlugin):
                 pass
             return ExploitResult(False, f"SSH execution failed: {str(e)}", {})
 
+
 class SSH_Mgr:
-    __ssh_connect_timeout_S = 1
+    """SSH connection manager backed by Paramiko.
+
+    Security note: ``AutoAddPolicy`` matches the old
+    ``StrictHostKeyChecking=no`` behaviour and does not authenticate the
+    server.  A known-hosts policy should be configured separately when a
+    credential design is available.
+    """
+
+    __ssh_connect_timeout_S = 10
+    __ssh_cmd_timeout_S = 30
 
     @staticmethod
     def Instance():
         return _instance
-        
+
     def __init__(self):
         self.__ssh_dict = {}
 
     def open_ssh(self, ip: str, user: str, passwd: str):
+        """Open an SSH connection.
+
+        Returns ``paramiko.SSHClient`` on success, ``None`` on failure.
+        Closes the client if connection fails.
+        """
+        client = paramiko.SSHClient()
+        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
         try:
-            ssh_context = ssh(host=ip, user=user, password=passwd, timeout=self.__ssh_connect_timeout_S)
+            client.connect(
+                hostname=ip,
+                username=user,
+                password=passwd,
+                timeout=self.__ssh_connect_timeout_S,
+                banner_timeout=self.__ssh_connect_timeout_S,
+                auth_timeout=self.__ssh_connect_timeout_S,
+            )
             logger.info("SSH connect %s success.", ip)
-            return ssh_context
+            return client
         except Exception:
             logger.exception("SSH connect %s fail!", ip)
+            try:
+                client.close()
+            except Exception:
+                pass
             return None
 
     def close_ssh(self, ssh_context: Any):
+        """Close an SSH connection. Safe for ``None`` and idempotent."""
         if ssh_context is None:
-            logger.error("SSH context invalid!")
             return
         try:
             ssh_context.close()
-            logger.info("SSH close success.")
         except Exception:
-            logger.exception("SSH close fail!")
+            pass
         return
 
     def ssh_cmd(self, ssh_context: Any, ssh_cmd: str):
+        """Execute a command over SSH.
+
+        Returns decoded stdout on success (exit status 0), ``None`` on failure.
+        """
         if ssh_context is None:
             logger.error("SSH context invalid!")
             return None
         try:
-            # Run the command via remote process and collect output
-            proc = ssh_context.process(["sh", "-lc", ssh_cmd])
-            cmd_result = proc.recvall().decode('utf-8', errors='ignore')
-            logger.info("SSH run CMD success. CMD: %s\nResult:\n%s", ssh_cmd, cmd_result)
-            return cmd_result
+            stdin, stdout, stderr = ssh_context.exec_command(ssh_cmd, timeout=self.__ssh_cmd_timeout_S)
+            exit_status = stdout.channel.recv_exit_status()
+            out = stdout.read().decode("utf-8", errors="replace")
+            err = stderr.read().decode("utf-8", errors="replace")
+
+            if exit_status != 0:
+                logger.error("SSH command failed (exit=%s). CMD: %s\nstderr: %s", exit_status, ssh_cmd, err)
+                return None
+
+            logger.info("SSH run CMD success. CMD: %s\nResult:\n%s", ssh_cmd, out)
+            return out
         except Exception:
             logger.exception("SSH run CMD fail! CMD: %s", ssh_cmd)
             return None
 
+
 _instance = SSH_Mgr()
 
+
 def register_plugin(pm):
-    pm.register(SSHPlugin())
+    pm.register(SSHPlugin())

{iotsploit_exploits-0.0.7 → iotsploit_exploits-0.0.8}/src/iotsploit_exploits/serial/picocom_serial_reader.py

@@ -8,7 +8,7 @@ import serial.tools.list_ports
 import re
 import time
 from typing import Optional, Any, List, Dict
-from threading import Thread, Event
+from threading import Thread
 from queue import Queue, Empty
 from dataclasses import dataclass
 from iotsploit_core.core.exploit_spec import AsyncExploitResult
@@ -19,7 +19,6 @@ logger = iots_logger.get_logger("picocom_serial_reader")
 hookimpl = pluggy.HookimplMarker("exploit_mgr")
 
 # Add file logging for debugging
-import logging
 import os
 file_logger = logging.getLogger('picocom_serial_reader_file')
 file_logger.setLevel(logging.DEBUG)
@@ -278,7 +277,7 @@ class PicocomSerialReaderPlugin(BasePlugin):
                 sufficient_data = len(self._analysis.raw_output) >= min_data_threshold
                 
                 if interactions_complete and sufficient_data:
-                    log_both('info', f"🎯 SIMPLE EARLY EXIT: All done!")
+                    log_both('info', "🎯 SIMPLE EARLY EXIT: All done!")
                     log_both('info', f"🎯   - All interactions sent: {interaction_step}/{len(self._interaction_sequences)} ✅")
                     log_both('info', f"🎯   - Sufficient data captured: {len(self._analysis.raw_output)} lines ✅")
                     # Stop reader thread early to speed up cleanup
@@ -451,7 +450,7 @@ class PicocomSerialReaderPlugin(BasePlugin):
         """Connect to serial port"""
         try:
             log_both('info', f"🔌 Attempting to connect to serial port {port} at {baudrate} baud...")
-            log_both('info', f"🔌 Connection parameters: 8N1, timeout=1s, no flow control")
+            log_both('info', "🔌 Connection parameters: 8N1, timeout=1s, no flow control")
             
             self._serial_conn = serial.Serial(
                 port=port,
@@ -576,10 +575,10 @@ class PicocomSerialReaderPlugin(BasePlugin):
                 log_both('info', f"📤 Sending {len(encoded_data)} bytes: {repr(data)}")
                 self._serial_conn.write(encoded_data)
                 self._serial_conn.flush()
-                log_both('info', f"📤 Data sent and flushed successfully")
+                log_both('info', "📤 Data sent and flushed successfully")
                 return True
             else:
-                log_both('error', f"📤 Cannot send data - serial connection not available")
+                log_both('error', "📤 Cannot send data - serial connection not available")
                 return False
         except Exception as e:
             log_both('error', f"📤 Error sending data: {e}")

{iotsploit_exploits-0.0.7 → iotsploit_exploits-0.0.8}/src/iotsploit_exploits/simple_rubber_duck.py

@@ -2,11 +2,9 @@
 
 import pluggy
 import asyncio
-import os
-import sys
 from typing import Optional, Any
 
-from iotsploit_core.core.exploit_spec import ExploitResult, AsyncExploitResult
+from iotsploit_core.core.exploit_spec import ExploitResult
 from iotsploit_core.core.base_plugin import BasePlugin
 from facedancer.devices.keyboard import USBKeyboardDevice
 from facedancer.errors import EndEmulation
@@ -98,7 +96,7 @@ class SimpleRubberDuckPlugin(BasePlugin):
             self.logger.info("Initializing USB keyboard device...")
             try:
                 self.device = USBKeyboardDevice()
-                self.logger.info(f"USB keyboard device initialized")
+                self.logger.info("USB keyboard device initialized")
             except Exception as e:
                 self.logger.error(f"Failed to initialize USB keyboard device: {str(e)}")
                 return ExploitResult(False, f"Failed to initialize USB keyboard device: {str(e)}", {})

{iotsploit_exploits-0.0.7 → iotsploit_exploits-0.0.8}/src/iotsploit_exploits/wifi_scan/wifi_scan.py

@@ -9,7 +9,7 @@ and provides a simple way to discover available WiFi networks.
 
 import logging
 import pluggy
-from typing import Optional, Any, List, Dict
+from typing import Optional, Any
 
 from iotsploit_core.core.exploit_spec import ExploitResult, AsyncExploitResult
 from iotsploit_core.core.base_plugin import BasePlugin