souleyez 2.43.29__py3-none-any.whl → 2.43.34__py3-none-any.whl

souleyez/plugins/responder.py

@@ -27,11 +27,11 @@ HELP = {
         "- WPAD poisoning is aggressive - use with caution\n\n"
         "⚠️  Warning: This is an active network attack. Use only with permission!\n"
     ),
-    "usage": "souleyez jobs enqueue responder <interface> --args \"[options]\"",
+    "usage": 'souleyez jobs enqueue responder <interface> --args "[options]"',
     "examples": [
-        "souleyez jobs enqueue responder eth0 --args \"-v\"",
-        "souleyez jobs enqueue responder tun0 --args \"-w -v\"  # WPAD poisoning",
-        "souleyez jobs enqueue responder wlan0 --args \"-f -v\"  # Fingerprint only",
+        'souleyez jobs enqueue responder eth0 --args "-v"',
+        'souleyez jobs enqueue responder tun0 --args "-w -v"  # WPAD poisoning',
+        'souleyez jobs enqueue responder wlan0 --args "-f -v"  # Fingerprint only',
     ],
     "flags": [
         ["-I <interface>", "Network interface to bind to (required)"],
@@ -56,58 +56,94 @@ HELP = {
         "  - SMB+HTTP Only: Reduced attack surface",
     ],
     "presets": [
-        {"name": "Standard Poisoning", "args": ["-v"], "desc": "LLMNR/NBT-NS poisoning (default)"},
-        {"name": "WPAD Poisoning", "args": ["-w", "-v"], "desc": "Add WPAD rogue proxy (aggressive)"},
-        {"name": "Fingerprint Mode", "args": ["-f", "-v"], "desc": "Passive mode (no poisoning, just fingerprint)"},
-        {"name": "SMB + HTTP Only", "args": ["-v", "--lm", "--disable-ess"], "desc": "Capture SMB and HTTP only"}
+        {
+            "name": "Standard Poisoning",
+            "args": ["-v"],
+            "desc": "LLMNR/NBT-NS poisoning (default)",
+        },
+        {
+            "name": "WPAD Poisoning",
+            "args": ["-w", "-v"],
+            "desc": "Add WPAD rogue proxy (aggressive)",
+        },
+        {
+            "name": "Fingerprint Mode",
+            "args": ["-f", "-v"],
+            "desc": "Passive mode (no poisoning, just fingerprint)",
+        },
+        {
+            "name": "SMB + HTTP Only",
+            "args": ["-v", "--lm", "--disable-ess"],
+            "desc": "Capture SMB and HTTP only",
+        },
     ],
     "help_sections": [
         {
             "title": "What is Responder?",
             "color": "cyan",
             "content": [
-                {"title": "Overview", "desc": "Responder performs LLMNR/NBT-NS/MDNS poisoning to passively capture Windows credentials (NTLMv2 hashes) when clients broadcast authentication requests."},
-                {"title": "Use Cases", "desc": "Passive credential capture on Windows networks", "tips": [
-                    "Capture NetNTLMv2 hashes without touching hosts",
-                    "Intercept Windows authentication attempts",
-                    "Identify active users and services",
-                    "Get initial foothold credentials"
-                ]}
-            ]
+                {
+                    "title": "Overview",
+                    "desc": "Responder performs LLMNR/NBT-NS/MDNS poisoning to passively capture Windows credentials (NTLMv2 hashes) when clients broadcast authentication requests.",
+                },
+                {
+                    "title": "Use Cases",
+                    "desc": "Passive credential capture on Windows networks",
+                    "tips": [
+                        "Capture NetNTLMv2 hashes without touching hosts",
+                        "Intercept Windows authentication attempts",
+                        "Identify active users and services",
+                        "Get initial foothold credentials",
+                    ],
+                },
+            ],
         },
         {
             "title": "How to Use",
             "color": "green",
             "content": [
-                {"title": "Basic Workflow", "desc": "1. Select network interface to monitor\n     2. Choose poisoning mode (standard or WPAD)\n     3. Run for 15-30 minutes to capture hashes\n     4. Crack captured hashes with hashcat mode 5600"},
-                {"title": "Key Modes", "desc": "Different levels of aggressiveness", "tips": [
-                    "Standard: LLMNR/NBT-NS poisoning only (default)",
-                    "WPAD: Add rogue proxy (very aggressive)",
-                    "Fingerprint: Passive mode (no poisoning)",
-                    "SMB+HTTP Only: Reduced attack surface"
-                ]}
-            ]
+                {
+                    "title": "Basic Workflow",
+                    "desc": "1. Select network interface to monitor\n     2. Choose poisoning mode (standard or WPAD)\n     3. Run for 15-30 minutes to capture hashes\n     4. Crack captured hashes with hashcat mode 5600",
+                },
+                {
+                    "title": "Key Modes",
+                    "desc": "Different levels of aggressiveness",
+                    "tips": [
+                        "Standard: LLMNR/NBT-NS poisoning only (default)",
+                        "WPAD: Add rogue proxy (very aggressive)",
+                        "Fingerprint: Passive mode (no poisoning)",
+                        "SMB+HTTP Only: Reduced attack surface",
+                    ],
+                },
+            ],
         },
         {
             "title": "Tips & Best Practices",
             "color": "yellow",
             "content": [
-                ("Best Practices:", [
-                    "Requires root/sudo for port binding",
-                    "Run for 15-30 minutes for best results",
-                    "Works best on switched networks (same subnet)",
-                    "Captured hashes: hashcat -m 5600 hashes.txt wordlist.txt",
-                    "Check ~/.souleyez/responder_logs/ for results"
-                ]),
-                ("Common Issues:", [
-                    "Permission denied: Run with sudo",
-                    "No hashes captured: May need WPAD mode or longer runtime",
-                    "Interface not found: Verify interface name (eth0, wlan0)",
-                    "Too aggressive: Use fingerprint mode (-f) if concerned"
-                ])
-            ]
-        }
-    ]
+                (
+                    "Best Practices:",
+                    [
+                        "Requires root/sudo for port binding",
+                        "Run for 15-30 minutes for best results",
+                        "Works best on switched networks (same subnet)",
+                        "Captured hashes: hashcat -m 5600 hashes.txt wordlist.txt",
+                        "Check ~/.souleyez/responder_logs/ for results",
+                    ],
+                ),
+                (
+                    "Common Issues:",
+                    [
+                        "Permission denied: Run with sudo",
+                        "No hashes captured: May need WPAD mode or longer runtime",
+                        "Interface not found: Verify interface name (eth0, wlan0)",
+                        "Too aggressive: Use fingerprint mode (-f) if concerned",
+                    ],
+                ),
+            ],
+        },
+    ],
 }
 
 
@@ -130,7 +166,7 @@ class ResponderPlugin:
         paths = [
             "/usr/share/responder/Responder.py",
             "/opt/Responder/Responder.py",
-            Path.home() / "tools/Responder/Responder.py"
+            Path.home() / "tools/Responder/Responder.py",
         ]
 
         for path in paths:
@@ -159,14 +195,15 @@ class ResponderPlugin:
                 ["ip", "route", "get", target_ip],
                 capture_output=True,
                 text=True,
-                timeout=5
+                timeout=5,
             )
 
             if result.returncode == 0:
                 # Parse output: "10.0.0.73 dev eth0 src 10.0.0.1 uid 1000"
                 # Look for "dev <interface>"
                 import re
-                match = re.search(r'dev\s+(\S+)', result.stdout)
+
+                match = re.search(r"dev\s+(\S+)", result.stdout)
                 if match:
                     return match.group(1)
 
@@ -175,12 +212,13 @@ class ResponderPlugin:
                 ["ip", "route", "show", "default"],
                 capture_output=True,
                 text=True,
-                timeout=5
+                timeout=5,
             )
 
             if result.returncode == 0:
                 import re
-                match = re.search(r'dev\s+(\S+)', result.stdout)
+
+                match = re.search(r"dev\s+(\S+)", result.stdout)
                 if match:
                     return match.group(1)
 
@@ -188,13 +226,13 @@ class ResponderPlugin:
             pass
 
         # Last resort: return common default interfaces
-        for iface in ['eth0', 'ens33', 'enp0s3', 'wlan0']:
+        for iface in ["eth0", "ens33", "enp0s3", "wlan0"]:
             try:
                 result = subprocess.run(
                     ["ip", "link", "show", iface],
                     capture_output=True,
                     text=True,
-                    timeout=2
+                    timeout=2,
                 )
                 if result.returncode == 0:
                     return iface
@@ -207,10 +245,7 @@ class ResponderPlugin:
         """Check if the given name is a valid network interface."""
         try:
             result = subprocess.run(
-                ["ip", "link", "show", name],
-                capture_output=True,
-                text=True,
-                timeout=2
+                ["ip", "link", "show", name], capture_output=True, text=True, timeout=2
             )
             return result.returncode == 0
         except Exception:
@@ -235,7 +270,7 @@ class ResponderPlugin:
             Command spec dict or None if validation fails
         """
         if not self.responder_path:
-            with open(log_path, 'w') as f:
+            with open(log_path, "w") as f:
                 f.write("ERROR: Responder not found. Install with:\n")
                 f.write("git clone https://github.com/lgandx/Responder\n")
                 f.write("cd Responder\n")
@@ -252,14 +287,20 @@ class ResponderPlugin:
             # Target is likely an IP address - auto-detect interface
             interface = self._get_interface_for_target(target)
             if not interface:
-                with open(log_path, 'w') as f:
-                    f.write(f"ERROR: Could not determine network interface for target {target}\n")
-                    f.write("Please specify a valid network interface (e.g., eth0, wlan0, tun0)\n")
+                with open(log_path, "w") as f:
+                    f.write(
+                        f"ERROR: Could not determine network interface for target {target}\n"
+                    )
+                    f.write(
+                        "Please specify a valid network interface (e.g., eth0, wlan0, tun0)\n"
+                    )
                     f.write("\nAvailable interfaces:\n")
                     try:
-                        result = subprocess.run(["ip", "-o", "link", "show"], capture_output=True, text=True)
-                        for line in result.stdout.strip().split('\n'):
-                            parts = line.split(':')
+                        result = subprocess.run(
+                            ["ip", "-o", "link", "show"], capture_output=True, text=True
+                        )
+                        for line in result.stdout.strip().split("\n"):
+                            parts = line.split(":")
                             if len(parts) >= 2:
                                 iface = parts[1].strip()
                                 f.write(f"  - {iface}\n")
@@ -282,7 +323,7 @@ class ResponderPlugin:
         env = {"RESPONDER_LOG_DIR": str(self.log_dir)}
 
         # Write initial log content
-        with open(log_path, 'w') as f:
+        with open(log_path, "w") as f:
             f.write(f"Starting Responder...\n")
             f.write(f"Target: {target}\n")
             f.write(f"Interface: {interface}\n")
@@ -291,34 +332,34 @@ class ResponderPlugin:
             f.write("NOTE: Responder requires root/sudo. If this fails, either:\n")
             f.write("  - Run souleyez as root, or\n")
             f.write("  - Configure passwordless sudo for responder\n\n")
-            f.write("NOTE: Responder runs indefinitely. Kill job when done capturing.\n")
-            f.write("Captured hashes are automatically stored in credentials database.\n\n")
+            f.write(
+                "NOTE: Responder runs indefinitely. Kill job when done capturing.\n"
+            )
+            f.write(
+                "Captured hashes are automatically stored in credentials database.\n\n"
+            )
 
-        return {
-            'cmd': cmd,
-            'timeout': 3600,  # 1 hour
-            'env': env
-        }
+        return {"cmd": cmd, "timeout": 3600, "env": env}  # 1 hour
 
     def get_presets(self):
         """Return Responder presets."""
         return {
             "Standard Poisoning": {
                 "description": "LLMNR/NBT-NS poisoning (default)",
-                "args": "-v"
+                "args": "-v",
             },
             "WPAD Poisoning": {
                 "description": "Add WPAD rogue proxy (aggressive)",
-                "args": "-w -v"
+                "args": "-w -v",
             },
             "Fingerprint Mode": {
                 "description": "Passive mode (no poisoning, just fingerprint)",
-                "args": "-f -v"
+                "args": "-f -v",
             },
             "SMB + HTTP Only": {
                 "description": "Capture SMB and HTTP only",
-                "args": "-v --lm --disable-ess"
-            }
+                "args": "-v --lm --disable-ess",
+            },
         }
 
 

souleyez/plugins/router_http_brute.py

@@ -30,8 +30,8 @@ HELP = {
     "usage": "souleyez jobs enqueue router_http_brute <target>",
     "examples": [
         "souleyez jobs enqueue router_http_brute 192.168.1.1",
-        "souleyez jobs enqueue router_http_brute 192.168.1.1 --args \"--port 8080\"",
-        "souleyez jobs enqueue router_http_brute 192.168.1.1 --args \"--basic\"",
+        'souleyez jobs enqueue router_http_brute 192.168.1.1 --args "--port 8080"',
+        'souleyez jobs enqueue router_http_brute 192.168.1.1 --args "--basic"',
     ],
     "flags": [
         ["--port PORT", "Target port (default: 80)"],
@@ -40,9 +40,21 @@ HELP = {
         ["--ssl", "Use HTTPS"],
     ],
     "presets": [
-        {"name": "Basic Auth", "args": ["--basic"], "desc": "HTTP Basic Authentication"},
-        {"name": "HTTPS Basic", "args": ["--basic", "--ssl"], "desc": "HTTPS Basic Auth"},
-        {"name": "Port 8080", "args": ["--port", "8080"], "desc": "Alternate port 8080"},
+        {
+            "name": "Basic Auth",
+            "args": ["--basic"],
+            "desc": "HTTP Basic Authentication",
+        },
+        {
+            "name": "HTTPS Basic",
+            "args": ["--basic", "--ssl"],
+            "desc": "HTTPS Basic Auth",
+        },
+        {
+            "name": "Port 8080",
+            "args": ["--port", "8080"],
+            "desc": "Alternate port 8080",
+        },
     ],
     "help_sections": [
         {
@@ -54,9 +66,9 @@ HELP = {
                 {"title": "D-Link", "desc": "admin / (blank) or admin"},
                 {"title": "TP-Link", "desc": "admin / admin"},
                 {"title": "ASUS", "desc": "admin / admin"},
-            ]
+            ],
         }
-    ]
+    ],
 }
 
 
@@ -68,20 +80,13 @@ class RouterHTTPBrutePlugin(PluginBase):
 
     def _get_wordlist_path(self, filename: str) -> str:
         """Get path to wordlist file."""
-        import os
-        # Check multiple locations
-        locations = [
-            os.path.join(os.path.dirname(__file__), '..', 'data', 'wordlists', filename),
-            os.path.expanduser(f'~/.souleyez/wordlists/{filename}'),
-            f'/usr/share/seclists/Passwords/{filename}',
-            f'/usr/share/wordlists/{filename}',
-        ]
-        for loc in locations:
-            if os.path.exists(loc):
-                return os.path.abspath(loc)
-        return filename  # Return as-is, let hydra fail if not found
-
-    def build_command(self, target: str, args: List[str] = None, label: str = "", log_path: str = None):
+        from souleyez.wordlists import resolve_wordlist_path
+
+        return resolve_wordlist_path(f"data/wordlists/{filename}")
+
+    def build_command(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ):
         """Build Hydra command for router HTTP brute force."""
         args = args or []
 
@@ -90,114 +95,120 @@ class RouterHTTPBrutePlugin(PluginBase):
             target = validate_target(target)
         except ValidationError as e:
             if log_path:
-                with open(log_path, 'w') as f:
+                with open(log_path, "w") as f:
                     f.write(f"ERROR: Invalid target: {e}\n")
             return None
 
         # Parse arguments
-        port = '80'
+        port = "80"
         use_ssl = False
         use_form = False
-        form_path = '/login'
+        form_path = "/login"
 
         i = 0
         while i < len(args):
-            if args[i] == '--port' and i + 1 < len(args):
+            if args[i] == "--port" and i + 1 < len(args):
                 port = args[i + 1]
                 i += 2
-            elif args[i] == '--ssl':
+            elif args[i] == "--ssl":
                 use_ssl = True
-                port = '443' if port == '80' else port
+                port = "443" if port == "80" else port
                 i += 1
-            elif args[i] == '--form' and i + 1 < len(args):
+            elif args[i] == "--form" and i + 1 < len(args):
                 use_form = True
                 form_path = args[i + 1]
                 i += 2
-            elif args[i] == '--basic':
+            elif args[i] == "--basic":
                 use_form = False
                 i += 1
             else:
                 i += 1
 
         # Common router credentials
-        users = self._get_wordlist_path('router_users.txt')
-        passwords = self._get_wordlist_path('router_passwords.txt')
+        users = self._get_wordlist_path("router_users.txt")
+        passwords = self._get_wordlist_path("router_passwords.txt")
 
         # Build Hydra command
         if use_form:
-            service = 'https-post-form' if use_ssl else 'http-post-form'
+            service = "https-post-form" if use_ssl else "http-post-form"
             # Generic form attack - adjust for specific routers
             form_string = f"{form_path}:username=^USER^&password=^PASS^:F=incorrect"
             cmd = [
-                'hydra',
-                '-L', users,
-                '-P', passwords,
-                '-s', port,
-                '-t', '2',  # Low threads
-                '-w', '3',  # Wait 3 seconds between attempts
-                '-vV',
+                "hydra",
+                "-L",
+                users,
+                "-P",
+                passwords,
+                "-s",
+                port,
+                "-t",
+                "2",  # Low threads
+                "-w",
+                "3",  # Wait 3 seconds between attempts
+                "-vV",
                 target,
                 service,
-                form_string
+                form_string,
             ]
         else:
-            service = 'https-get' if use_ssl else 'http-get'
+            service = "https-get" if use_ssl else "http-get"
             cmd = [
-                'hydra',
-                '-L', users,
-                '-P', passwords,
-                '-s', port,
-                '-t', '2',
-                '-w', '3',
-                '-vV',
-                '-f',  # Stop on first success
+                "hydra",
+                "-L",
+                users,
+                "-P",
+                passwords,
+                "-s",
+                port,
+                "-t",
+                "2",
+                "-w",
+                "3",
+                "-vV",
+                "-f",  # Stop on first success
                 target,
                 service,
-                '/'
+                "/",
             ]
 
-        return {
-            'cmd': cmd,
-            'timeout': 1800  # 30 minute timeout
-        }
+        return {"cmd": cmd, "timeout": 1800}  # 30 minute timeout
 
-    def run(self, target: str, args: List[str] = None, label: str = "", log_path: str = None) -> int:
+    def run(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ) -> int:
         """Execute router HTTP brute force."""
         cmd_spec = self.build_command(target, args, label, log_path)
         if cmd_spec is None:
             return 1
 
-        cmd = cmd_spec['cmd']
+        cmd = cmd_spec["cmd"]
 
         if log_path:
-            with open(log_path, 'w') as f:
+            with open(log_path, "w") as f:
                 f.write(f"# Router HTTP Brute Force on {target}\n")
                 f.write(f"# Command: {' '.join(cmd)}\n")
                 f.write(f"# Started: {time.strftime('%Y-%m-%d %H:%M:%S')}\n\n")
 
         try:
-            with open(log_path, 'a') as f:
+            with open(log_path, "a") as f:
                 result = subprocess.run(
-                    cmd,
-                    stdout=f,
-                    stderr=subprocess.STDOUT,
-                    timeout=cmd_spec['timeout']
+                    cmd, stdout=f, stderr=subprocess.STDOUT, timeout=cmd_spec["timeout"]
                 )
             return result.returncode
 
         except subprocess.TimeoutExpired:
             if log_path:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write("\n\n# ERROR: Brute force timed out\n")
             return 124
         except FileNotFoundError:
             if log_path:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write("\n\n# ERROR: Hydra not found\n")
             return 127
         except Exception as e:
             if log_path:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write(f"\n\n# ERROR: {e}\n")
             return 1