souleyez 2.43.28__py3-none-any.whl → 2.43.32__py3-none-any.whl

souleyez/plugins/afp.py

@@ -44,16 +44,23 @@ HELP = {
             "title": "What is AFP?",
             "color": "cyan",
             "content": [
-                {"title": "Overview", "desc": "AFP (Apple Filing Protocol) is Apple's native file sharing protocol, optimized for macOS features like resource forks and metadata."},
-                {"title": "Security Notes", "desc": "AFP security considerations", "tips": [
-                    "Guest access often enabled by default",
-                    "Credentials transmitted in cleartext (older versions)",
-                    "Time Machine backups may contain full disk images",
-                    "Path traversal vulnerabilities in some versions"
-                ]}
-            ]
+                {
+                    "title": "Overview",
+                    "desc": "AFP (Apple Filing Protocol) is Apple's native file sharing protocol, optimized for macOS features like resource forks and metadata.",
+                },
+                {
+                    "title": "Security Notes",
+                    "desc": "AFP security considerations",
+                    "tips": [
+                        "Guest access often enabled by default",
+                        "Credentials transmitted in cleartext (older versions)",
+                        "Time Machine backups may contain full disk images",
+                        "Path traversal vulnerabilities in some versions",
+                    ],
+                },
+            ],
         }
-    ]
+    ],
 }
 
 
@@ -63,7 +70,9 @@ class AFPPlugin(PluginBase):
     category = "scanning"
     HELP = HELP
 
-    def build_command(self, target: str, args: List[str] = None, label: str = "", log_path: str = None):
+    def build_command(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ):
         """Build nmap command for AFP enumeration."""
         args = args or []
 
@@ -71,63 +80,62 @@ class AFPPlugin(PluginBase):
             target = validate_target(target)
         except ValidationError as e:
             if log_path:
-                with open(log_path, 'w') as f:
+                with open(log_path, "w") as f:
                     f.write(f"ERROR: Invalid target: {e}\n")
             return None
 
         # Determine scripts
-        if '--deep' in args:
-            scripts = 'afp-serverinfo,afp-showmount,afp-brute,afp-path-vuln'
+        if "--deep" in args:
+            scripts = "afp-serverinfo,afp-showmount,afp-brute,afp-path-vuln"
         else:
-            scripts = 'afp-serverinfo,afp-showmount'
+            scripts = "afp-serverinfo,afp-showmount"
 
         cmd = [
-            'nmap',
-            '-sV',
-            '-p', '548',
-            '--script', scripts,
-            '-oN', '-',
-            '--open',
-            '-T4',
-            target
+            "nmap",
+            "-sV",
+            "-p",
+            "548",
+            "--script",
+            scripts,
+            "-oN",
+            "-",
+            "--open",
+            "-T4",
+            target,
         ]
 
-        return {
-            'cmd': cmd,
-            'timeout': 600
-        }
+        return {"cmd": cmd, "timeout": 600}
 
-    def run(self, target: str, args: List[str] = None, label: str = "", log_path: str = None) -> int:
+    def run(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ) -> int:
         """Execute AFP enumeration."""
         cmd_spec = self.build_command(target, args, label, log_path)
         if cmd_spec is None:
             return 1
 
-        cmd = cmd_spec['cmd']
+        cmd = cmd_spec["cmd"]
 
         if log_path:
-            with open(log_path, 'w') as f:
+            with open(log_path, "w") as f:
                 f.write(f"# AFP Enumeration on {target}\n")
                 f.write(f"# Command: {' '.join(cmd)}\n")
                 f.write(f"# Started: {time.strftime('%Y-%m-%d %H:%M:%S')}\n\n")
 
         try:
-            with open(log_path, 'a') as f:
+            with open(log_path, "a") as f:
                 result = subprocess.run(
-                    cmd,
-                    stdout=f,
-                    stderr=subprocess.STDOUT,
-                    timeout=cmd_spec['timeout']
+                    cmd, stdout=f, stderr=subprocess.STDOUT, timeout=cmd_spec["timeout"]
                 )
             return result.returncode
         except subprocess.TimeoutExpired:
             if log_path:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write("\n\n# ERROR: Scan timed out\n")
             return 124
         except Exception as e:
             if log_path:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write(f"\n\n# ERROR: {e}\n")
             return 1
 

souleyez/plugins/afp_brute.py

@@ -26,7 +26,7 @@ HELP = {
     "usage": "souleyez jobs enqueue afp_brute <target>",
     "examples": [
         "souleyez jobs enqueue afp_brute 192.168.1.100",
-        "souleyez jobs enqueue afp_brute 192.168.1.100 --args \"-l admin\"",
+        'souleyez jobs enqueue afp_brute 192.168.1.100 --args "-l admin"',
     ],
     "flags": [
         ["-l USER", "Single username to test"],
@@ -34,7 +34,78 @@ HELP = {
     ],
     "presets": [
         {"name": "Common Users", "args": [], "desc": "Test common macOS usernames"},
-        {"name": "Single User", "args": ["-l", "admin"], "desc": "Test single user 'admin'"},
+        {
+            "name": "Single User",
+            "args": ["-l", "admin"],
+            "desc": "Test single user 'admin'",
+        },
+    ],
+    "help_sections": [
+        {
+            "title": "What is AFP Brute Force?",
+            "color": "cyan",
+            "content": [
+                (
+                    "Overview",
+                    [
+                        "AFP (Apple Filing Protocol) brute force uses Hydra to test credentials",
+                        "Targets macOS file sharing on port 548",
+                        "Uses common macOS usernames and passwords by default",
+                    ],
+                ),
+                (
+                    "When to Use",
+                    [
+                        "After discovering AFP service (port 548) with nmap",
+                        "When you need to access shared folders on macOS",
+                        "To test weak password policies on Apple systems",
+                    ],
+                ),
+            ],
+        },
+        {
+            "title": "Usage & Examples",
+            "color": "green",
+            "content": [
+                (
+                    "Basic Usage",
+                    [
+                        "souleyez jobs enqueue afp_brute 192.168.1.100",
+                        "  → Tests common macOS users with common passwords",
+                    ],
+                ),
+                (
+                    "Single User Attack",
+                    [
+                        'souleyez jobs enqueue afp_brute 192.168.1.100 --args "-l admin"',
+                        "  → Tests only the 'admin' user",
+                    ],
+                ),
+            ],
+        },
+        {
+            "title": "Tips & Best Practices",
+            "color": "yellow",
+            "content": [
+                (
+                    "Attack Tips",
+                    [
+                        "Run AFP enumeration first to identify valid usernames",
+                        "Check if guest access is enabled (no brute force needed)",
+                        "Use low thread count (-t 2) to avoid lockouts",
+                        "macOS uses local accounts, not domain accounts",
+                    ],
+                ),
+                (
+                    "After Success",
+                    [
+                        "Use AFP to browse shared folders",
+                        "Look for sensitive documents and backups",
+                        "Time Machine backups may contain full disk images",
+                    ],
+                ),
+            ],
+        },
     ],
 }
 
@@ -47,18 +118,13 @@ class AFPBrutePlugin(PluginBase):
 
     def _get_wordlist_path(self, filename: str) -> str:
         """Get path to wordlist file."""
-        import os
-        locations = [
-            os.path.join(os.path.dirname(__file__), '..', 'data', 'wordlists', filename),
-            os.path.expanduser(f'~/.souleyez/wordlists/{filename}'),
-            f'/usr/share/seclists/Passwords/{filename}',
-        ]
-        for loc in locations:
-            if os.path.exists(loc):
-                return os.path.abspath(loc)
-        return filename
-
-    def build_command(self, target: str, args: List[str] = None, label: str = "", log_path: str = None):
+        from souleyez.wordlists import resolve_wordlist_path
+
+        return resolve_wordlist_path(f"data/wordlists/{filename}")
+
+    def build_command(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ):
         """Build Hydra command for AFP brute force."""
         args = args or []
 
@@ -66,69 +132,71 @@ class AFPBrutePlugin(PluginBase):
             target = validate_target(target)
         except ValidationError as e:
             if log_path:
-                with open(log_path, 'w') as f:
+                with open(log_path, "w") as f:
                     f.write(f"ERROR: Invalid target: {e}\n")
             return None
 
         # Check for user specification in args
-        has_user = '-l' in args or '-L' in args
+        has_user = "-l" in args or "-L" in args
 
-        users = self._get_wordlist_path('macos_users.txt')
-        passwords = self._get_wordlist_path('top100.txt')
+        users = self._get_wordlist_path("macos_users.txt")
+        passwords = self._get_wordlist_path("top100.txt")
 
-        cmd = ['hydra']
+        cmd = ["hydra"]
 
         if not has_user:
-            cmd.extend(['-L', users])
+            cmd.extend(["-L", users])
 
         cmd.extend(args)  # Add any user-specified args
-        cmd.extend([
-            '-P', passwords,
-            '-s', '548',
-            '-t', '2',
-            '-w', '3',
-            '-vV',
-            '-f',
-            target,
-            'afp'
-        ])
-
-        return {
-            'cmd': cmd,
-            'timeout': 1800
-        }
-
-    def run(self, target: str, args: List[str] = None, label: str = "", log_path: str = None) -> int:
+        cmd.extend(
+            [
+                "-P",
+                passwords,
+                "-s",
+                "548",
+                "-t",
+                "2",
+                "-w",
+                "3",
+                "-vV",
+                "-f",
+                target,
+                "afp",
+            ]
+        )
+
+        return {"cmd": cmd, "timeout": 1800}
+
+    def run(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ) -> int:
         """Execute AFP brute force."""
         cmd_spec = self.build_command(target, args, label, log_path)
         if cmd_spec is None:
             return 1
 
-        cmd = cmd_spec['cmd']
+        cmd = cmd_spec["cmd"]
 
         if log_path:
-            with open(log_path, 'w') as f:
+            with open(log_path, "w") as f:
                 f.write(f"# AFP Brute Force on {target}\n")
                 f.write(f"# Command: {' '.join(cmd)}\n")
                 f.write(f"# Started: {time.strftime('%Y-%m-%d %H:%M:%S')}\n\n")
 
         try:
-            with open(log_path, 'a') as f:
+            with open(log_path, "a") as f:
                 result = subprocess.run(
-                    cmd,
-                    stdout=f,
-                    stderr=subprocess.STDOUT,
-                    timeout=cmd_spec['timeout']
+                    cmd, stdout=f, stderr=subprocess.STDOUT, timeout=cmd_spec["timeout"]
                 )
             return result.returncode
         except subprocess.TimeoutExpired:
             if log_path:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write("\n\n# ERROR: Brute force timed out\n")
             return 124
         except Exception as e:
             if log_path:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write(f"\n\n# ERROR: {e}\n")
             return 1
 

souleyez/plugins/ard.py

@@ -44,17 +44,27 @@ HELP = {
             "title": "macOS Remote Access",
             "color": "cyan",
             "content": [
-                {"title": "Screen Sharing", "desc": "Built-in VNC server (port 5900). Uses macOS user credentials or VNC password."},
-                {"title": "Apple Remote Desktop", "desc": "Enterprise management tool (port 3283). Used by IT admins for fleet management."},
-                {"title": "Security Notes", "desc": "VNC vulnerabilities", "tips": [
-                    "Some Macs have VNC with no auth",
-                    "ARD auth bypass (CVE-2017-13872)",
-                    "Weak VNC passwords common",
-                    "Traffic often unencrypted"
-                ]}
-            ]
+                {
+                    "title": "Screen Sharing",
+                    "desc": "Built-in VNC server (port 5900). Uses macOS user credentials or VNC password.",
+                },
+                {
+                    "title": "Apple Remote Desktop",
+                    "desc": "Enterprise management tool (port 3283). Used by IT admins for fleet management.",
+                },
+                {
+                    "title": "Security Notes",
+                    "desc": "VNC vulnerabilities",
+                    "tips": [
+                        "Some Macs have VNC with no auth",
+                        "ARD auth bypass (CVE-2017-13872)",
+                        "Weak VNC passwords common",
+                        "Traffic often unencrypted",
+                    ],
+                },
+            ],
         }
-    ]
+    ],
 }
 
 
@@ -64,7 +74,9 @@ class ARDPlugin(PluginBase):
     category = "scanning"
     HELP = HELP
 
-    def build_command(self, target: str, args: List[str] = None, label: str = "", log_path: str = None):
+    def build_command(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ):
         """Build nmap command for VNC/ARD enumeration."""
         args = args or []
 
@@ -72,65 +84,64 @@ class ARDPlugin(PluginBase):
             target = validate_target(target)
         except ValidationError as e:
             if log_path:
-                with open(log_path, 'w') as f:
+                with open(log_path, "w") as f:
                     f.write(f"ERROR: Invalid target: {e}\n")
             return None
 
         # Determine scripts
-        if '--deep' in args:
-            scripts = 'vnc-info,vnc-title,realvnc-auth-bypass'
+        if "--deep" in args:
+            scripts = "vnc-info,vnc-title,realvnc-auth-bypass"
         else:
-            scripts = 'vnc-info'
+            scripts = "vnc-info"
 
         # VNC = 5900, ARD = 3283
         cmd = [
-            'nmap',
-            '-sV',
-            '-p', '5900,3283,5901,5902,5903',
-            '--script', scripts,
-            '-oN', '-',
-            '--open',
-            '-T4',
-            target
+            "nmap",
+            "-sV",
+            "-p",
+            "5900,3283,5901,5902,5903",
+            "--script",
+            scripts,
+            "-oN",
+            "-",
+            "--open",
+            "-T4",
+            target,
         ]
 
-        return {
-            'cmd': cmd,
-            'timeout': 600
-        }
+        return {"cmd": cmd, "timeout": 600}
 
-    def run(self, target: str, args: List[str] = None, label: str = "", log_path: str = None) -> int:
+    def run(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ) -> int:
         """Execute VNC/ARD enumeration."""
         cmd_spec = self.build_command(target, args, label, log_path)
         if cmd_spec is None:
             return 1
 
-        cmd = cmd_spec['cmd']
+        cmd = cmd_spec["cmd"]
 
         if log_path:
-            with open(log_path, 'w') as f:
+            with open(log_path, "w") as f:
                 f.write(f"# VNC/ARD Enumeration on {target}\n")
                 f.write(f"# Ports: 5900 (VNC), 3283 (ARD)\n")
                 f.write(f"# Command: {' '.join(cmd)}\n")
                 f.write(f"# Started: {time.strftime('%Y-%m-%d %H:%M:%S')}\n\n")
 
         try:
-            with open(log_path, 'a') as f:
+            with open(log_path, "a") as f:
                 result = subprocess.run(
-                    cmd,
-                    stdout=f,
-                    stderr=subprocess.STDOUT,
-                    timeout=cmd_spec['timeout']
+                    cmd, stdout=f, stderr=subprocess.STDOUT, timeout=cmd_spec["timeout"]
                 )
             return result.returncode
         except subprocess.TimeoutExpired:
             if log_path:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write("\n\n# ERROR: Scan timed out\n")
             return 124
         except Exception as e:
             if log_path:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write(f"\n\n# ERROR: {e}\n")
             return 1