souleyez 2.43.29__py3-none-any.whl → 2.43.34__py3-none-any.whl

souleyez/plugins/router_ssh_brute.py

@@ -30,14 +30,95 @@ HELP = {
     "usage": "souleyez jobs enqueue router_ssh_brute <target>",
     "examples": [
         "souleyez jobs enqueue router_ssh_brute 192.168.1.1",
-        "souleyez jobs enqueue router_ssh_brute 192.168.1.1 --args \"--port 2222\"",
+        'souleyez jobs enqueue router_ssh_brute 192.168.1.1 --args "--port 2222"',
     ],
     "flags": [
         ["--port PORT", "SSH port (default: 22)"],
     ],
     "presets": [
         {"name": "Standard SSH", "args": [], "desc": "Port 22 with router credentials"},
-        {"name": "Alternate Port", "args": ["--port", "2222"], "desc": "Non-standard SSH port"},
+        {
+            "name": "Alternate Port",
+            "args": ["--port", "2222"],
+            "desc": "Non-standard SSH port",
+        },
+    ],
+    "help_sections": [
+        {
+            "title": "What is Router SSH Brute Force?",
+            "color": "cyan",
+            "content": [
+                (
+                    "Overview",
+                    [
+                        "Brute forces SSH login on routers and network devices",
+                        "Uses Hydra with router-specific credential lists",
+                        "Targets management interface for full device control",
+                    ],
+                ),
+                (
+                    "Common Targets",
+                    [
+                        "MikroTik, Ubiquiti, Cisco, Juniper devices",
+                        "Consumer routers with SSH (Asus, Netgear with custom FW)",
+                        "DD-WRT, OpenWRT, Tomato firmware",
+                        "Managed switches with SSH enabled",
+                    ],
+                ),
+            ],
+        },
+        {
+            "title": "Usage & Examples",
+            "color": "green",
+            "content": [
+                (
+                    "Basic Usage",
+                    [
+                        "souleyez jobs enqueue router_ssh_brute 192.168.1.1",
+                        "  → Tests default router credentials on port 22",
+                    ],
+                ),
+                (
+                    "Alternate Port",
+                    [
+                        'souleyez jobs enqueue router_ssh_brute 192.168.1.1 --args "--port 2222"',
+                        "  → Tests on custom SSH port",
+                    ],
+                ),
+            ],
+        },
+        {
+            "title": "Tips & Common Defaults",
+            "color": "yellow",
+            "content": [
+                (
+                    "Common Router Credentials",
+                    [
+                        "admin:admin, root:root, ubnt:ubnt",
+                        "admin:password, admin:1234, cisco:cisco",
+                        "admin:<blank>, root:<blank>",
+                    ],
+                ),
+                (
+                    "Before Attacking",
+                    [
+                        "Use low threads (-t 1 or -t 2) to avoid lockouts",
+                        "Many routers block after 3-5 failed attempts",
+                        "Check for key-only auth first (wastes time otherwise)",
+                        "Some routers use non-standard ports (2222, 22222)",
+                    ],
+                ),
+                (
+                    "After Success",
+                    [
+                        "Full command-line access to router",
+                        "Can modify routing, DNS, firewall rules",
+                        "Intercept/redirect traffic, add backdoors",
+                        "Pivot to internal network segments",
+                    ],
+                ),
+            ],
+        },
     ],
 }
 
@@ -50,18 +131,13 @@ class RouterSSHBrutePlugin(PluginBase):
 
     def _get_wordlist_path(self, filename: str) -> str:
         """Get path to wordlist file."""
-        import os
-        locations = [
-            os.path.join(os.path.dirname(__file__), '..', 'data', 'wordlists', filename),
-            os.path.expanduser(f'~/.souleyez/wordlists/{filename}'),
-            f'/usr/share/seclists/Passwords/{filename}',
-        ]
-        for loc in locations:
-            if os.path.exists(loc):
-                return os.path.abspath(loc)
-        return filename
+        from souleyez.wordlists import resolve_wordlist_path
+
+        return resolve_wordlist_path(f"data/wordlists/{filename}")
 
-    def build_command(self, target: str, args: List[str] = None, label: str = "", log_path: str = None):
+    def build_command(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ):
         """Build Hydra command for router SSH brute force."""
         args = args or []
 
@@ -69,71 +145,72 @@ class RouterSSHBrutePlugin(PluginBase):
             target = validate_target(target)
         except ValidationError as e:
             if log_path:
-                with open(log_path, 'w') as f:
+                with open(log_path, "w") as f:
                     f.write(f"ERROR: Invalid target: {e}\n")
             return None
 
-        port = '22'
+        port = "22"
         i = 0
         while i < len(args):
-            if args[i] == '--port' and i + 1 < len(args):
+            if args[i] == "--port" and i + 1 < len(args):
                 port = args[i + 1]
                 i += 2
             else:
                 i += 1
 
-        users = self._get_wordlist_path('router_users.txt')
-        passwords = self._get_wordlist_path('router_passwords.txt')
+        users = self._get_wordlist_path("router_users.txt")
+        passwords = self._get_wordlist_path("router_passwords.txt")
 
         cmd = [
-            'hydra',
-            '-L', users,
-            '-P', passwords,
-            '-s', port,
-            '-t', '1',  # Single thread for SSH
-            '-w', '5',  # 5 second delay
-            '-vV',
-            '-f',
+            "hydra",
+            "-L",
+            users,
+            "-P",
+            passwords,
+            "-s",
+            port,
+            "-t",
+            "1",  # Single thread for SSH
+            "-w",
+            "5",  # 5 second delay
+            "-vV",
+            "-f",
             target,
-            'ssh'
+            "ssh",
         ]
 
-        return {
-            'cmd': cmd,
-            'timeout': 3600
-        }
+        return {"cmd": cmd, "timeout": 3600}
 
-    def run(self, target: str, args: List[str] = None, label: str = "", log_path: str = None) -> int:
+    def run(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ) -> int:
         """Execute router SSH brute force."""
         cmd_spec = self.build_command(target, args, label, log_path)
         if cmd_spec is None:
             return 1
 
-        cmd = cmd_spec['cmd']
+        cmd = cmd_spec["cmd"]
 
         if log_path:
-            with open(log_path, 'w') as f:
+            with open(log_path, "w") as f:
                 f.write(f"# Router SSH Brute Force on {target}\n")
                 f.write(f"# Command: {' '.join(cmd)}\n")
                 f.write(f"# Started: {time.strftime('%Y-%m-%d %H:%M:%S')}\n\n")
 
         try:
-            with open(log_path, 'a') as f:
+            with open(log_path, "a") as f:
                 result = subprocess.run(
-                    cmd,
-                    stdout=f,
-                    stderr=subprocess.STDOUT,
-                    timeout=cmd_spec['timeout']
+                    cmd, stdout=f, stderr=subprocess.STDOUT, timeout=cmd_spec["timeout"]
                 )
             return result.returncode
         except subprocess.TimeoutExpired:
             if log_path:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write("\n\n# ERROR: Brute force timed out\n")
             return 124
         except Exception as e:
             if log_path:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write(f"\n\n# ERROR: {e}\n")
             return 1
 

souleyez/plugins/router_telnet_brute.py

@@ -32,14 +32,100 @@ HELP = {
     "usage": "souleyez jobs enqueue router_telnet_brute <target>",
     "examples": [
         "souleyez jobs enqueue router_telnet_brute 192.168.1.1",
-        "souleyez jobs enqueue router_telnet_brute 192.168.1.1 --args \"--port 2323\"",
+        'souleyez jobs enqueue router_telnet_brute 192.168.1.1 --args "--port 2323"',
     ],
     "flags": [
         ["--port PORT", "Telnet port (default: 23)"],
     ],
     "presets": [
-        {"name": "Standard Telnet", "args": [], "desc": "Port 23 with router credentials"},
-        {"name": "Alt Port 2323", "args": ["--port", "2323"], "desc": "Common alternate Telnet port"},
+        {
+            "name": "Standard Telnet",
+            "args": [],
+            "desc": "Port 23 with router credentials",
+        },
+        {
+            "name": "Alt Port 2323",
+            "args": ["--port", "2323"],
+            "desc": "Common alternate Telnet port",
+        },
+    ],
+    "help_sections": [
+        {
+            "title": "What is Router Telnet Brute Force?",
+            "color": "cyan",
+            "content": [
+                (
+                    "Overview",
+                    [
+                        "Brute forces Telnet login on routers and IoT devices",
+                        "Telnet transmits credentials in PLAINTEXT!",
+                        "Still common on older and budget network devices",
+                    ],
+                ),
+                (
+                    "Common Targets",
+                    [
+                        "Older consumer routers (Linksys, Netgear, D-Link)",
+                        "ISP-provided modems and gateways",
+                        "IP cameras and NVR systems",
+                        "Industrial/SCADA equipment",
+                        "IoT devices (smart home, printers)",
+                    ],
+                ),
+            ],
+        },
+        {
+            "title": "Usage & Examples",
+            "color": "green",
+            "content": [
+                (
+                    "Basic Usage",
+                    [
+                        "souleyez jobs enqueue router_telnet_brute 192.168.1.1",
+                        "  → Tests default router credentials on port 23",
+                    ],
+                ),
+                (
+                    "Alternate Port",
+                    [
+                        'souleyez jobs enqueue router_telnet_brute 192.168.1.1 --args "--port 2323"',
+                        "  → Tests on alternate Telnet port (common for IoT)",
+                    ],
+                ),
+            ],
+        },
+        {
+            "title": "Tips & Security Notes",
+            "color": "yellow",
+            "content": [
+                (
+                    "Telnet Security Issues",
+                    [
+                        "PLAINTEXT protocol - can sniff credentials on network",
+                        "Consider MITM attack instead of brute force",
+                        "Many devices have hardcoded backdoor accounts",
+                        "Mirai botnet exploited default Telnet credentials",
+                    ],
+                ),
+                (
+                    "Common Telnet Defaults",
+                    [
+                        "admin:admin, root:root, admin:password",
+                        "admin:<blank>, root:<blank>",
+                        "user:user, support:support",
+                        "Device-specific defaults (check online)",
+                    ],
+                ),
+                (
+                    "After Success",
+                    [
+                        "Full command-line access to device",
+                        "Often same access level as SSH",
+                        "Can modify configs, add users, pivot",
+                    ],
+                ),
+            ],
+        },
     ],
 }
 
@@ -52,18 +138,13 @@ class RouterTelnetBrutePlugin(PluginBase):
 
     def _get_wordlist_path(self, filename: str) -> str:
         """Get path to wordlist file."""
-        import os
-        locations = [
-            os.path.join(os.path.dirname(__file__), '..', 'data', 'wordlists', filename),
-            os.path.expanduser(f'~/.souleyez/wordlists/{filename}'),
-            f'/usr/share/seclists/Passwords/{filename}',
-        ]
-        for loc in locations:
-            if os.path.exists(loc):
-                return os.path.abspath(loc)
-        return filename
+        from souleyez.wordlists import resolve_wordlist_path
+
+        return resolve_wordlist_path(f"data/wordlists/{filename}")
 
-    def build_command(self, target: str, args: List[str] = None, label: str = "", log_path: str = None):
+    def build_command(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ):
         """Build Hydra command for router Telnet brute force."""
         args = args or []
 
@@ -71,71 +152,72 @@ class RouterTelnetBrutePlugin(PluginBase):
             target = validate_target(target)
         except ValidationError as e:
             if log_path:
-                with open(log_path, 'w') as f:
+                with open(log_path, "w") as f:
                     f.write(f"ERROR: Invalid target: {e}\n")
             return None
 
-        port = '23'
+        port = "23"
         i = 0
         while i < len(args):
-            if args[i] == '--port' and i + 1 < len(args):
+            if args[i] == "--port" and i + 1 < len(args):
                 port = args[i + 1]
                 i += 2
             else:
                 i += 1
 
-        users = self._get_wordlist_path('router_users.txt')
-        passwords = self._get_wordlist_path('router_passwords.txt')
+        users = self._get_wordlist_path("router_users.txt")
+        passwords = self._get_wordlist_path("router_passwords.txt")
 
         cmd = [
-            'hydra',
-            '-L', users,
-            '-P', passwords,
-            '-s', port,
-            '-t', '2',
-            '-w', '3',
-            '-vV',
-            '-f',
+            "hydra",
+            "-L",
+            users,
+            "-P",
+            passwords,
+            "-s",
+            port,
+            "-t",
+            "2",
+            "-w",
+            "3",
+            "-vV",
+            "-f",
             target,
-            'telnet'
+            "telnet",
         ]
 
-        return {
-            'cmd': cmd,
-            'timeout': 1800
-        }
+        return {"cmd": cmd, "timeout": 1800}
 
-    def run(self, target: str, args: List[str] = None, label: str = "", log_path: str = None) -> int:
+    def run(
+        self, target: str, args: List[str] = None, label: str = "", log_path: str = None
+    ) -> int:
         """Execute router Telnet brute force."""
         cmd_spec = self.build_command(target, args, label, log_path)
         if cmd_spec is None:
             return 1
 
-        cmd = cmd_spec['cmd']
+        cmd = cmd_spec["cmd"]
 
         if log_path:
-            with open(log_path, 'w') as f:
+            with open(log_path, "w") as f:
                 f.write(f"# Router Telnet Brute Force on {target}\n")
                 f.write(f"# Command: {' '.join(cmd)}\n")
                 f.write(f"# Started: {time.strftime('%Y-%m-%d %H:%M:%S')}\n\n")
 
         try:
-            with open(log_path, 'a') as f:
+            with open(log_path, "a") as f:
                 result = subprocess.run(
-                    cmd,
-                    stdout=f,
-                    stderr=subprocess.STDOUT,
-                    timeout=cmd_spec['timeout']
+                    cmd, stdout=f, stderr=subprocess.STDOUT, timeout=cmd_spec["timeout"]
                 )
             return result.returncode
         except subprocess.TimeoutExpired:
             if log_path:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write("\n\n# ERROR: Brute force timed out\n")
             return 124
         except Exception as e:
             if log_path:
-                with open(log_path, 'a') as f:
+                with open(log_path, "a") as f:
                     f.write(f"\n\n# ERROR: {e}\n")
             return 1