souleyez 2.43.28__py3-none-any.whl → 2.43.32__py3-none-any.whl

souleyez/plugins/macos_ssh.py

@@ -30,7 +30,7 @@ HELP = {
     "usage": "souleyez jobs enqueue macos_ssh <target>",
     "examples": [
         "souleyez jobs enqueue macos_ssh 192.168.1.100",
-        "souleyez jobs enqueue macos_ssh 192.168.1.100 --args \"-l admin\"",
+        'souleyez jobs enqueue macos_ssh 192.168.1.100 --args "-l admin"',
     ],
     "flags": [
         ["-l USER", "Single username to test"],
@@ -39,7 +39,79 @@ HELP = {
     ],
     "presets": [
         {"name": "Common Users", "args": [], "desc": "Test common macOS usernames"},
-        {"name": "Admin Only", "args": ["-l", "admin"], "desc": "Test 'admin' user only"},
+        {
+            "name": "Admin Only",
+            "args": ["-l", "admin"],
+            "desc": "Test 'admin' user only",
+        },
+    ],
+    "help_sections": [
+        {
+            "title": "What is macOS SSH Brute Force?",
+            "color": "cyan",
+            "content": [
+                (
+                    "Overview",
+                    [
+                        "Brute forces SSH (Remote Login) on macOS systems",
+                        "Uses Hydra with macOS-specific username wordlists",
+                        "Targets local user accounts on the Mac",
+                    ],
+                ),
+                (
+                    "Why macOS is Targeted",
+                    [
+                        "Many users use simple, memorable passwords",
+                        "Often same password as their Apple ID/iCloud",
+                        "Short usernames like 'admin', 'user', first names",
+                        "Remote Login often left enabled after initial setup",
+                    ],
+                ),
+            ],
+        },
+        {
+            "title": "Usage & Examples",
+            "color": "green",
+            "content": [
+                (
+                    "Basic Usage",
+                    [
+                        "souleyez jobs enqueue macos_ssh 192.168.1.100",
+                        "  → Tests common macOS users with common passwords",
+                    ],
+                ),
+                (
+                    "Target Specific User",
+                    [
+                        'souleyez jobs enqueue macos_ssh 192.168.1.100 --args "-l john"',
+                        "  → Only tests the 'john' user account",
+                    ],
+                ),
+            ],
+        },
+        {
+            "title": "Tips & Best Practices",
+            "color": "yellow",
+            "content": [
+                (
+                    "Before Attacking",
+                    [
+                        "Verify SSH is enabled (port 22 open in nmap scan)",
+                        "Check for mDNS discovery results for usernames",
+                        "Low thread count (-t 2) to avoid lockouts",
+                    ],
+                ),
+                (
+                    "After Success",
+                    [
+                        "Full shell access to macOS system",
+                        "Can access user files, keychains, browser data",
+                        "May be able to sudo if user is admin",
+                        "Pivot to other systems on the network",
+                    ],
+                ),
+            ],
+        },
     ],
 }
 
@@ -52,18 +124,13 @@ class MacOSSSHPlugin(PluginBase):
 
     def _get_wordlist_path(self, filename: str) -> str:
         """Get path to wordlist file."""
-        import os
-        locations = [
-            os.path.join(os.path.dirname(__file__), '..', 'data', 'wordlists', filename),
-            os.path.expanduser(f'~/.souleyez/wordlists/{filename}'),
-            f'/usr/share/seclists/Passwords/{filename}',
-        ]
-        for loc in locations:
-            if os.path.exists(loc):
-                return os.path.abspath(loc)
-        return filename
-
-    def build_command(self, target: str, args: List[str] = None, label: str = "", log_path: str = None):
+        from souleyez.wordlists import resolve_wordlist_path
+
+        return resolve_wordlist_path(f"data/wordlists/{filename}")
+
+    def build_command(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ):
         """Build Hydra command for macOS SSH brute force."""
         args = args or []
 
@@ -71,80 +138,82 @@ class MacOSSSHPlugin(PluginBase):
             target = validate_target(target)
         except ValidationError as e:
             if log_path:
-                with open(log_path, 'w') as f:
+                with open(log_path, "w") as f:
                     f.write(f"ERROR: Invalid target: {e}\n")
             return None
 
         # Parse args
-        has_user = '-l' in args or '-L' in args
-        port = '22'
+        has_user = "-l" in args or "-L" in args
+        port = "22"
 
         clean_args = []
         i = 0
         while i < len(args):
-            if args[i] == '--port' and i + 1 < len(args):
+            if args[i] == "--port" and i + 1 < len(args):
                 port = args[i + 1]
                 i += 2
             else:
                 clean_args.append(args[i])
                 i += 1
 
-        users = self._get_wordlist_path('macos_users.txt')
-        passwords = self._get_wordlist_path('top100.txt')
+        users = self._get_wordlist_path("macos_users.txt")
+        passwords = self._get_wordlist_path("top100.txt")
 
-        cmd = ['hydra']
+        cmd = ["hydra"]
 
         if not has_user:
-            cmd.extend(['-L', users])
+            cmd.extend(["-L", users])
 
         cmd.extend(clean_args)
-        cmd.extend([
-            '-P', passwords,
-            '-s', port,
-            '-t', '1',  # Single thread for SSH
-            '-w', '5',  # 5 second delay
-            '-vV',
-            '-f',
-            target,
-            'ssh'
-        ])
-
-        return {
-            'cmd': cmd,
-            'timeout': 3600
-        }
-
-    def run(self, target: str, args: List[str] = None, label: str = "", log_path: str = None) -> int:
+        cmd.extend(
+            [
+                "-P",
+                passwords,
+                "-s",
+                port,
+                "-t",
+                "1",  # Single thread for SSH
+                "-w",
+                "5",  # 5 second delay
+                "-vV",
+                "-f",
+                target,
+                "ssh",
+            ]
+        )
+
+        return {"cmd": cmd, "timeout": 3600}
+
+    def run(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ) -> int:
         """Execute macOS SSH brute force."""
         cmd_spec = self.build_command(target, args, label, log_path)
         if cmd_spec is None:
             return 1
 
-        cmd = cmd_spec['cmd']
+        cmd = cmd_spec["cmd"]
 
         if log_path:
-            with open(log_path, 'w') as f:
+            with open(log_path, "w") as f:
                 f.write(f"# macOS SSH Brute Force on {target}\n")
                 f.write(f"# Command: {' '.join(cmd)}\n")
                 f.write(f"# Started: {time.strftime('%Y-%m-%d %H:%M:%S')}\n\n")
 
         try:
-            with open(log_path, 'a') as f:
+            with open(log_path, "a") as f:
                 result = subprocess.run(
-                    cmd,
-                    stdout=f,
-                    stderr=subprocess.STDOUT,
-                    timeout=cmd_spec['timeout']
+                    cmd, stdout=f, stderr=subprocess.STDOUT, timeout=cmd_spec["timeout"]
                 )
             return result.returncode
         except subprocess.TimeoutExpired:
             if log_path:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write("\n\n# ERROR: Brute force timed out\n")
             return 124
         except Exception as e:
             if log_path:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write(f"\n\n# ERROR: {e}\n")
             return 1
 

souleyez/plugins/mdns.py

@@ -40,7 +40,11 @@ HELP = {
     ],
     "presets": [
         {"name": "Quick Discovery", "args": [], "desc": "Basic mDNS discovery"},
-        {"name": "Service Query", "args": ["--services"], "desc": "Query specific services"},
+        {
+            "name": "Service Query",
+            "args": ["--services"],
+            "desc": "Query specific services",
+        },
     ],
     "help_sections": [
         {
@@ -53,9 +57,9 @@ HELP = {
                 {"title": "_smb._tcp", "desc": "SMB file sharing"},
                 {"title": "_ssh._tcp", "desc": "SSH remote access"},
                 {"title": "_printer._tcp", "desc": "Network printers"},
-            ]
+            ],
         }
-    ]
+    ],
 }
 
 
@@ -65,7 +69,9 @@ class MDNSPlugin(PluginBase):
     category = "scanning"
     HELP = HELP
 
-    def build_command(self, target: str, args: List[str] = None, label: str = "", log_path: str = None):
+    def build_command(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ):
         """Build nmap command for mDNS discovery."""
         args = args or []
 
@@ -73,63 +79,62 @@ class MDNSPlugin(PluginBase):
             target = validate_target(target)
         except ValidationError as e:
             if log_path:
-                with open(log_path, 'w') as f:
+                with open(log_path, "w") as f:
                     f.write(f"ERROR: Invalid target: {e}\n")
             return None
 
         # Use broadcast-dns-service-discovery for mDNS
-        if '--services' in args:
-            scripts = 'dns-service-discovery,broadcast-dns-service-discovery'
+        if "--services" in args:
+            scripts = "dns-service-discovery,broadcast-dns-service-discovery"
         else:
-            scripts = 'dns-service-discovery'
+            scripts = "dns-service-discovery"
 
         cmd = [
-            'nmap',
-            '-sU',
-            '-p', '5353',
-            '--script', scripts,
-            '-oN', '-',
-            '--open',
-            '-T4',
-            target
+            "nmap",
+            "-sU",
+            "-p",
+            "5353",
+            "--script",
+            scripts,
+            "-oN",
+            "-",
+            "--open",
+            "-T4",
+            target,
         ]
 
-        return {
-            'cmd': cmd,
-            'timeout': 300
-        }
+        return {"cmd": cmd, "timeout": 300}
 
-    def run(self, target: str, args: List[str] = None, label: str = "", log_path: str = None) -> int:
+    def run(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ) -> int:
         """Execute mDNS discovery."""
         cmd_spec = self.build_command(target, args, label, log_path)
         if cmd_spec is None:
             return 1
 
-        cmd = cmd_spec['cmd']
+        cmd = cmd_spec["cmd"]
 
         if log_path:
-            with open(log_path, 'w') as f:
+            with open(log_path, "w") as f:
                 f.write(f"# mDNS/Bonjour Discovery on {target}\n")
                 f.write(f"# Command: {' '.join(cmd)}\n")
                 f.write(f"# Started: {time.strftime('%Y-%m-%d %H:%M:%S')}\n\n")
 
         try:
-            with open(log_path, 'a') as f:
+            with open(log_path, "a") as f:
                 result = subprocess.run(
-                    cmd,
-                    stdout=f,
-                    stderr=subprocess.STDOUT,
-                    timeout=cmd_spec['timeout']
+                    cmd, stdout=f, stderr=subprocess.STDOUT, timeout=cmd_spec["timeout"]
                 )
             return result.returncode
         except subprocess.TimeoutExpired:
             if log_path:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write("\n\n# ERROR: Scan timed out\n")
             return 124
         except Exception as e:
             if log_path:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write(f"\n\n# ERROR: {e}\n")
             return 1