use crate::core::module::{Module, ModuleError, ModuleResult};
use async_trait::async_trait;
use icebox_macro::module;
use std::sync::Arc;
use tokio::sync::Semaphore;
use crate::modules::hex_encode;
#[module(
name = "ping_sweep",
kind = "Scanner",
description = "Discover live hosts on the local network via ICMP ping sweep",
author = "ICEBOX"
)]
pub struct ArpScanner {
#[option(
required = true,
help = "Target range: CIDR (192.168.1.0/24), range (192.168.1.1-100), or list (192.168.1.1,192.168.1.2)"
)]
pub targets: String,
#[option(help = "Timeout per host in seconds (default 2)")]
pub timeout_secs: u64,
#[option(help = "Maximum concurrent probes (default 50)")]
pub concurrency: usize,
}
fn parse_target_list(spec: &str) -> Result<Vec<String>, ModuleError> {
let mut ips = Vec::new();
for part in spec.split(',') {
let part = part.trim();
if part.is_empty() {
continue;
}
if let Some((base, cidr)) = part.split_once('/') {
let prefix: u8 = cidr
.parse()
.map_err(|_| ModuleError::Parse(format!("bad CIDR: {cidr}")))?;
let base_ip: std::net::Ipv4Addr = base
.parse()
.map_err(|_| ModuleError::Parse(format!("bad IP: {base}")))?;
let bits = 32u32 - prefix as u32;
let count = 1u32 << bits;
let start = u32::from(base_ip) & (0xFFFFFFFFu32 << bits);
let network = std::net::Ipv4Addr::from(start);
let broadcast = std::net::Ipv4Addr::from(start | (count - 1));
for i in 1..count - 1 {
let ip = std::net::Ipv4Addr::from(start + i);
if ip != network && ip != broadcast {
ips.push(ip.to_string());
}
}
} else if let Some((lo, hi)) = part.split_once('-') {
let base_parts: Vec<&str> = lo.split('.').collect();
if base_parts.len() != 4 {
return Err(ModuleError::Parse("bad IP range format".into()));
}
let lo_octet: u8 = lo
.rsplit_once('.')
.map(|(_, o)| o)
.unwrap_or("")
.parse()
.map_err(|_| ModuleError::Parse("bad range".into()))?;
let hi_octet: u8 = hi
.trim()
.parse()
.map_err(|_| ModuleError::Parse("bad range".into()))?;
let prefix = lo.rsplit_once('.').map(|(p, _)| p).unwrap_or("");
for i in lo_octet..=hi_octet {
ips.push(format!("{prefix}.{i}"));
}
} else {
ips.push(part.to_string());
}
}
if ips.is_empty() {
return Err(ModuleError::Other("no targets specified".into()));
}
Ok(ips)
}
#[async_trait]
impl Module for ArpScanner {
fn options_json(&self) -> serde_json::Value {
serde_json::to_value(&ArpScannerOptions {
targets: self.targets.clone(),
timeout_secs: self.timeout_secs,
concurrency: self.concurrency,
})
.unwrap_or(serde_json::Value::Null)
}
fn set_option(&mut self, name: &str, value: &str) -> Result<(), ModuleError> {
let mut o = ArpScannerOptions {
targets: self.targets.clone(),
timeout_secs: self.timeout_secs,
concurrency: self.concurrency,
};
o.set(name, value)?;
self.targets = o.targets;
self.timeout_secs = o.timeout_secs;
self.concurrency = o.concurrency;
Ok(())
}
fn validate(&self) -> Result<(), ModuleError> {
ArpScannerOptions {
targets: self.targets.clone(),
timeout_secs: self.timeout_secs,
concurrency: self.concurrency,
}
.validate()?;
parse_target_list(&self.targets).map(|_| ())
}
async fn run(&self) -> Result<ModuleResult, ModuleError> {
let ips = parse_target_list(&self.targets)?;
let timeout = if self.timeout_secs > 0 {
self.timeout_secs
} else {
2
};
let max_concurrency = if self.concurrency > 0 {
self.concurrency
} else {
50
};
let semaphore = Arc::new(Semaphore::new(max_concurrency));
let mut handles = Vec::new();
for ip in ips {
let permit = semaphore
.clone()
.acquire_owned()
.await
.map_err(|e| ModuleError::Other(e.to_string()))?;
handles.push(tokio::spawn(async move {
let _permit = permit;
let result = tokio::process::Command::new("ping")
.arg("-c")
.arg("1")
.arg("-W")
.arg(timeout.to_string())
.arg(&ip)
.output()
.await;
match result {
Ok(out) if out.status.success() => Some(ip),
_ => None,
}
}));
}
let mut live_hosts: Vec<String> = Vec::new();
for h in handles {
if let Ok(Some(ip)) = h.await {
live_hosts.push(ip);
}
}
live_hosts.sort();
live_hosts.dedup();
let finding = if live_hosts.is_empty() {
"No live hosts found".to_string()
} else {
format!(
"Found {} live host(s): {}",
live_hosts.len(),
live_hosts.join(", ")
)
};
Ok(ModuleResult {
success: true,
finding: Some(finding),
evidence: live_hosts.iter().map(|h| format!("host/{h}")).collect(),
data: serde_json::json!({
"targets": self.targets,
"live_hosts": live_hosts,
"count": live_hosts.len(),
}),
..Default::default()
})
}
}
#[module(
name = "smb_scanner",
kind = "Scanner",
description = "SMB service scanner - version detection and null session check",
author = "ICEBOX"
)]
pub struct SmbScanner {
#[option(required = true, help = "Target IP or hostname")]
pub host: String,
#[option(help = "SMB port (default 445)")]
pub port: u16,
#[option(help = "Timeout in milliseconds (default 5000)")]
pub timeout_ms: u64,
#[option(help = "Check null session on IPC$ (default true)")]
pub check_null_session: bool,
}
fn build_smb_negotiate() -> Vec<u8> {
let mut pkt = Vec::new();
pkt.extend_from_slice(b"\xFFSMB");
pkt.push(0x72);
pkt.extend_from_slice(&[0x00; 4]);
pkt.push(0x18);
pkt.extend_from_slice(&[0x01, 0x48]);
pkt.extend_from_slice(&[0x00; 12]);
pkt.extend_from_slice(&[0x00; 2]);
pkt.extend_from_slice(&[0x00; 2]);
pkt.extend_from_slice(&[0x00; 2]);
pkt.extend_from_slice(&[0x00; 2]);
pkt.push(0x00);
let dialects = b"\x02\x0BNT LM 0.12\x02\x08SMB 2.002";
let bcc = dialects.len() as u16;
pkt.extend_from_slice(&bcc.to_le_bytes());
pkt.extend_from_slice(dialects);
pkt
}
fn parse_smb_negotiate_response(data: &[u8]) -> (Option<String>, Option<u16>) {
if data.len() < 36 || data[0..4] != [0xFF, b'S', b'M', b'B'] {
return (None, None);
}
let cmd = data[4];
if cmd != 0x72 {
return (None, None);
}
let mut status_bytes = [0u8; 4];
status_bytes.copy_from_slice(&data[5..9]);
let status = u32::from_le_bytes(status_bytes);
if status != 0 {
return (Some("SMB present (non-zero status)".into()), None);
}
let wct = data[32] as usize;
if wct == 0 || data.len() < 33 + wct * 2 + 2 {
return (Some("SMBv1 present".into()), None);
}
if wct >= 1 {
let dialect_idx = u16::from_le_bytes([data[33], data[34]]);
if dialect_idx == 0xFFFF {
return (Some("SMBv1 present (no dialect selected)".into()), None);
}
let bcc_start = 33 + wct * 2;
if data.len() > bcc_start + 1 {
let bcc = u16::from_le_bytes([data[bcc_start], data[bcc_start + 1]]);
let version = if wct == 1 {
if data.len() >= 33 + wct * 2 + 2 + 4 {
let dialect_rev =
u16::from_le_bytes([data[bcc_start + 2 + 32], data[bcc_start + 2 + 33]]);
Some(format!("SMBv2 (dialect 0x{dialect_rev:04x})"))
} else {
Some("SMBv2 present".into())
}
} else {
let sec_mode = data[35];
let caps_start = 33 + 2 + 4 + 2 + 2 + 4 + 4;
if data.len() > caps_start + 3 {
let caps = u32::from_le_bytes([
data[caps_start],
data[caps_start + 1],
data[caps_start + 2],
data[caps_start + 3],
]);
Some(format!(
"SMBv1 (security=0x{sec_mode:02x}, caps=0x{caps:08x})"
))
} else {
Some(format!("SMBv1 (security=0x{sec_mode:02x})"))
}
};
return (version, Some(bcc));
}
}
(Some("SMB present".into()), None)
}
#[async_trait]
impl Module for SmbScanner {
fn options_json(&self) -> serde_json::Value {
serde_json::to_value(&SmbScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
check_null_session: self.check_null_session,
})
.unwrap_or(serde_json::Value::Null)
}
fn set_option(&mut self, name: &str, value: &str) -> Result<(), ModuleError> {
let mut o = SmbScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
check_null_session: self.check_null_session,
};
o.set(name, value)?;
self.host = o.host;
self.port = o.port;
self.timeout_ms = o.timeout_ms;
self.check_null_session = o.check_null_session;
Ok(())
}
fn validate(&self) -> Result<(), ModuleError> {
SmbScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
check_null_session: self.check_null_session,
}
.validate()
}
async fn run(&self) -> Result<ModuleResult, ModuleError> {
let port = if self.port > 0 { self.port } else { 445 };
let timeout = if self.timeout_ms > 0 {
std::time::Duration::from_millis(self.timeout_ms)
} else {
std::time::Duration::from_secs(5)
};
let addr = crate::core::proxy::resolve_dial(&self.host, port);
let stream =
match tokio::time::timeout(timeout, tokio::net::TcpStream::connect(&addr)).await {
Ok(Ok(s)) => s,
Ok(Err(e)) => return Err(ModuleError::Other(format!("connection failed: {e}"))),
Err(_) => return Err(ModuleError::Other("connection timed out".into())),
};
let req = build_smb_negotiate();
if tokio::time::timeout(timeout, stream.writable())
.await
.is_err()
{
return Err(ModuleError::Other("write timeout".into()));
}
let _ = stream.try_write(&req);
let mut buf = vec![0u8; 4096];
let n = match tokio::time::timeout(timeout, stream.readable()).await {
Ok(Ok(_)) => stream.try_read(&mut buf).unwrap_or(0),
_ => 0,
};
if n < 36 {
return Ok(ModuleResult {
success: true,
finding: Some("SMB: no valid response received".into()),
data: serde_json::json!({"host": self.host, "port": port}),
..Default::default()
});
}
let (version, _bcc) = parse_smb_negotiate_response(&buf[..n]);
let mut evidence = Vec::new();
let mut findings = Vec::new();
if let Some(ref ver) = version {
evidence.push(format!("smb/{ver}"));
findings.push(ver.clone());
} else {
evidence.push("smb/unrecognized".into());
findings.push("SMB service detected (unrecognized version)".into());
}
let null_session = if self.check_null_session {
let tcon_req = build_smb_treeconnect(&format!("\\\\{}\\IPC$", self.host), 0);
let _ = stream.try_write(&tcon_req);
let mut buf2 = vec![0u8; 1024];
let n2 = match tokio::time::timeout(timeout, stream.readable()).await {
Ok(Ok(_)) => stream.try_read(&mut buf2).unwrap_or(0),
_ => 0,
};
if n2 >= 36 && buf2[5..9] == [0x00, 0x00, 0x00, 0x00] {
findings.push("NULL session: IPC$ accessible (likely vulnerable)".into());
evidence.push("smb/null_session/ipc".into());
true
} else {
false
}
} else {
false
};
let mut finding_str = findings.join("; ");
if null_session {
finding_str.push_str(" - WARNING: Null session allowed!");
}
Ok(ModuleResult {
success: true,
finding: Some(finding_str),
evidence,
data: serde_json::json!({
"host": self.host,
"port": port,
"version": version,
"null_session": null_session,
}),
..Default::default()
})
}
}
fn build_smb_treeconnect(path: &str, uid: u16) -> Vec<u8> {
let mut pkt = Vec::new();
pkt.extend_from_slice(b"\xFFSMB");
pkt.push(0x75);
pkt.extend_from_slice(&[0x00; 4]);
pkt.push(0x18);
pkt.extend_from_slice(&[0x01, 0x48]);
pkt.extend_from_slice(&[0x00; 12]);
pkt.extend_from_slice(&[0x00; 2]);
pkt.extend_from_slice(&[0x00; 2]);
pkt.extend_from_slice(&uid.to_le_bytes());
pkt.extend_from_slice(&[0x00; 2]);
pkt.push(0x04);
pkt.extend_from_slice(&[0x00; 2]);
pkt.extend_from_slice(&[0x00; 2]);
let path_bytes = path.as_bytes();
let bcc = 1 + 4 + path_bytes.len();
pkt.extend_from_slice(&(bcc as u16).to_le_bytes());
pkt.push(0x04);
pkt.extend_from_slice(&(path_bytes.len() as u16).to_le_bytes());
pkt.extend_from_slice(path_bytes);
pkt
}
#[module(
name = "ftp_scanner",
kind = "Scanner",
description = "FTP service scanner - anonymous login check and banner grab",
author = "ICEBOX"
)]
pub struct FtpScanner {
#[option(required = true, help = "Target IP or hostname")]
pub host: String,
#[option(help = "FTP port (default 21)")]
pub port: u16,
#[option(help = "Timeout in milliseconds (default 5000)")]
pub timeout_ms: u64,
#[option(help = "Try anonymous login (default true)")]
pub check_anonymous: bool,
}
#[async_trait]
impl Module for FtpScanner {
fn options_json(&self) -> serde_json::Value {
serde_json::to_value(&FtpScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
check_anonymous: self.check_anonymous,
})
.unwrap_or(serde_json::Value::Null)
}
fn set_option(&mut self, name: &str, value: &str) -> Result<(), ModuleError> {
let mut o = FtpScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
check_anonymous: self.check_anonymous,
};
o.set(name, value)?;
self.host = o.host;
self.port = o.port;
self.timeout_ms = o.timeout_ms;
self.check_anonymous = o.check_anonymous;
Ok(())
}
fn validate(&self) -> Result<(), ModuleError> {
FtpScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
check_anonymous: self.check_anonymous,
}
.validate()
}
async fn run(&self) -> Result<ModuleResult, ModuleError> {
let port = if self.port > 0 { self.port } else { 21 };
let timeout = std::time::Duration::from_millis(if self.timeout_ms > 0 {
self.timeout_ms
} else {
5000
});
let addr = crate::core::proxy::resolve_dial(&self.host, port);
let stream =
match tokio::time::timeout(timeout, tokio::net::TcpStream::connect(&addr)).await {
Ok(Ok(s)) => s,
Ok(Err(e)) => return Err(ModuleError::Other(format!("connection failed: {e}"))),
Err(_) => return Err(ModuleError::Other("connection timed out".into())),
};
async fn read_response(
s: &tokio::net::TcpStream,
t: std::time::Duration,
) -> Result<String, ModuleError> {
let mut buf = vec![0u8; 4096];
let n = match tokio::time::timeout(t, s.readable()).await {
Ok(Ok(_)) => s.try_read(&mut buf).unwrap_or(0),
_ => return Err(ModuleError::Other("read timeout".into())),
};
Ok(String::from_utf8_lossy(&buf[..n.min(4000)]).to_string())
}
async fn send_command(
s: &tokio::net::TcpStream,
cmd: &[u8],
t: std::time::Duration,
) -> Result<(), ModuleError> {
match tokio::time::timeout(t, s.writable()).await {
Ok(Ok(_)) => {
s.try_write(cmd)
.map_err(|e| ModuleError::Other(format!("write: {e}")))?;
Ok(())
}
_ => Err(ModuleError::Other("write timeout".into())),
}
}
let banner = read_response(&stream, timeout).await.unwrap_or_default();
let banner_short = banner.lines().next().unwrap_or(&banner).trim().to_string();
let mut findings = Vec::new();
let mut evidence = Vec::new();
findings.push(format!("banner: {banner_short}"));
let anonymous_success = if self.check_anonymous {
send_command(&stream, b"USER anonymous\r\n", timeout)
.await
.ok();
let user_resp = read_response(&stream, timeout).await.unwrap_or_default();
let is_331 = user_resp.starts_with("331");
if is_331 {
send_command(&stream, b"PASS anonymous@\r\n", timeout)
.await
.ok();
let pass_resp = read_response(&stream, timeout).await.unwrap_or_default();
let logged_in = pass_resp.starts_with("230");
if logged_in {
send_command(&stream, b"SYST\r\n", timeout).await.ok();
let syst = read_response(&stream, timeout).await.unwrap_or_default();
let syst_line = syst.lines().next().unwrap_or("").trim().to_string();
findings.push(format!("anonymous login: SUCCESS (SYST: {syst_line})"));
evidence.push("ftp/anonymous_login".into());
send_command(&stream, b"PWD\r\n", timeout).await.ok();
let pwd = read_response(&stream, timeout).await.unwrap_or_default();
let pwd_line = pwd.lines().next().unwrap_or("").trim().to_string();
if !pwd_line.is_empty() {
evidence.push(format!("ftp/pwd: {pwd_line}"));
}
true
} else {
let err = pass_resp.lines().next().unwrap_or("").trim().to_string();
findings.push(format!("anonymous login: FAILED ({err})"));
false
}
} else {
findings.push("anonymous login: not supported (no 331)".into());
false
}
} else {
false
};
let _ = stream.try_write(b"QUIT\r\n");
let finding = if anonymous_success {
format!(
"FTP on tcp/{port}: {} - anonymous login enabled!",
banner_short
)
} else {
format!("FTP on tcp/{port}: {}", findings.join("; "))
};
Ok(ModuleResult {
success: true,
finding: Some(finding),
evidence,
data: serde_json::json!({
"host": self.host,
"port": port,
"banner": banner_short,
"anonymous_login": anonymous_success,
}),
..Default::default()
})
}
}
#[module(
name = "ssh_scanner",
kind = "Scanner",
description = "SSH service scanner - version detection and auth method enumeration",
author = "ICEBOX"
)]
pub struct SshScanner {
#[option(required = true, help = "Target IP or hostname")]
pub host: String,
#[option(help = "SSH port (default 22)")]
pub port: u16,
#[option(help = "Timeout in milliseconds (default 5000)")]
pub timeout_ms: u64,
}
#[async_trait]
impl Module for SshScanner {
fn options_json(&self) -> serde_json::Value {
serde_json::to_value(&SshScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
})
.unwrap_or(serde_json::Value::Null)
}
fn set_option(&mut self, name: &str, value: &str) -> Result<(), ModuleError> {
let mut o = SshScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
};
o.set(name, value)?;
self.host = o.host;
self.port = o.port;
self.timeout_ms = o.timeout_ms;
Ok(())
}
fn validate(&self) -> Result<(), ModuleError> {
SshScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
}
.validate()
}
async fn run(&self) -> Result<ModuleResult, ModuleError> {
let port = if self.port > 0 { self.port } else { 22 };
let timeout = std::time::Duration::from_millis(if self.timeout_ms > 0 {
self.timeout_ms
} else {
5000
});
let addr = crate::core::proxy::resolve_dial(&self.host, port);
let stream =
match tokio::time::timeout(timeout, tokio::net::TcpStream::connect(&addr)).await {
Ok(Ok(s)) => s,
Ok(Err(e)) => return Err(ModuleError::Other(format!("connection failed: {e}"))),
Err(_) => return Err(ModuleError::Other("connection timed out".into())),
};
let mut buf = vec![0u8; 4096];
let n = match tokio::time::timeout(timeout, stream.readable()).await {
Ok(Ok(_)) => stream.try_read(&mut buf).unwrap_or(0),
_ => 0,
};
if n == 0 {
return Ok(ModuleResult {
success: true,
finding: Some(format!("SSH on tcp/{port}: no banner received")),
data: serde_json::json!({"host": self.host, "port": port}),
..Default::default()
});
}
let raw = &buf[..n.min(1024)];
let resp = String::from_utf8_lossy(raw).to_string();
let banner = resp.lines().next().unwrap_or("").trim().to_string();
let has_kex = n > banner.len() + 1;
let mut evidence = Vec::new();
evidence.push(format!("ssh/banner: {banner}"));
let finding = if banner.starts_with("SSH-") {
format!("SSH on tcp/{port}: {banner}")
} else {
format!("SSH on tcp/{port}: unrecognized banner: {banner}")
};
Ok(ModuleResult {
success: true,
finding: Some(finding),
evidence,
data: serde_json::json!({
"host": self.host,
"port": port,
"banner": banner,
"has_kex_init": has_kex,
"raw_hex": hex_encode(&buf[..n.min(128)]),
}),
..Default::default()
})
}
}
const SSH_COMMON_CREDS: &[(&str, &str)] = &[
("root", "root"),
("root", "admin"),
("root", "toor"),
("root", "password"),
("root", "1234"),
("root", "1"),
("root", "!"),
("root", "changeme"),
("admin", "admin"),
("admin", "password"),
("admin", "1234"),
("admin", "admin123"),
("administrator", "administrator"),
("administrator", "password"),
("user", "user"),
("user", "password"),
("user", "1234"),
("test", "test"),
("guest", "guest"),
("pi", "raspberry"),
("ubuntu", "ubuntu"),
("debian", "debian"),
("oracle", "oracle"),
("postgres", "postgres"),
("nagios", "nagios"),
("jenkins", "jenkins"),
];
#[module(
name = "ssh_bruteforce",
kind = "Scanner",
capabilities = "CredentialAccess",
intent = "Dump",
impact = "Critical",
description = "SSH credential bruteforcer - test username/password pairs via sshpass",
author = "ICEBOX"
)]
pub struct SshBruteforce {
#[option(required = true, help = "Target IP or hostname")]
pub host: String,
#[option(help = "SSH port (default 22)")]
pub port: u16,
#[option(
help = "Credentials in user:pass format, comma-separated (default: built-in wordlist)"
)]
pub wordlist: String,
#[option(help = "Timeout per attempt in seconds (default 5)")]
pub timeout_secs: u64,
#[option(help = "Maximum concurrent attempts (default 10)")]
pub concurrency: usize,
}
fn parse_creds(wordlist: &str) -> Vec<(String, String)> {
if wordlist.is_empty() {
return SSH_COMMON_CREDS
.iter()
.map(|(u, p)| (u.to_string(), p.to_string()))
.collect();
}
wordlist
.split(',')
.filter_map(|pair| {
let pair = pair.trim();
if let Some((u, p)) = pair.split_once(':') {
let u = u.trim();
let p = p.trim();
if !u.is_empty() {
Some((u.to_string(), p.to_string()))
} else {
None
}
} else {
None
}
})
.collect()
}
#[async_trait]
impl Module for SshBruteforce {
fn options_json(&self) -> serde_json::Value {
serde_json::to_value(&SshBruteforceOptions {
host: self.host.clone(),
port: self.port,
wordlist: self.wordlist.clone(),
timeout_secs: self.timeout_secs,
concurrency: self.concurrency,
})
.unwrap_or(serde_json::Value::Null)
}
fn set_option(&mut self, name: &str, value: &str) -> Result<(), ModuleError> {
let mut o = SshBruteforceOptions {
host: self.host.clone(),
port: self.port,
wordlist: self.wordlist.clone(),
timeout_secs: self.timeout_secs,
concurrency: self.concurrency,
};
o.set(name, value)?;
self.host = o.host;
self.port = o.port;
self.wordlist = o.wordlist;
self.timeout_secs = o.timeout_secs;
self.concurrency = o.concurrency;
Ok(())
}
fn validate(&self) -> Result<(), ModuleError> {
SshBruteforceOptions {
host: self.host.clone(),
port: self.port,
wordlist: self.wordlist.clone(),
timeout_secs: self.timeout_secs,
concurrency: self.concurrency,
}
.validate()
}
async fn run(&self) -> Result<ModuleResult, ModuleError> {
let port = if self.port > 0 { self.port } else { 22 };
let timeout_secs = if self.timeout_secs > 0 {
self.timeout_secs
} else {
5
};
let max_concurrency = if self.concurrency > 0 {
self.concurrency
} else {
10
};
let creds = parse_creds(&self.wordlist);
let host = self.host.clone();
let has_sshpass = tokio::process::Command::new("which")
.arg("sshpass")
.output()
.await
.ok()
.is_some_and(|o| o.status.success());
if !has_sshpass {
return Err(ModuleError::Other(
"sshpass not found. Install with: brew install sshpass (macOS) or apt install sshpass (Linux)".into()
));
}
let semaphore = Arc::new(Semaphore::new(max_concurrency));
let mut handles = Vec::new();
for (user, pass) in &creds {
let permit = match semaphore.clone().acquire_owned().await {
Ok(p) => p,
Err(_) => continue,
};
let user = user.clone();
let pass = pass.clone();
let host = host.clone();
handles.push(tokio::spawn(async move {
let _permit = permit;
let result = tokio::process::Command::new("sshpass")
.arg("-p")
.arg(&pass)
.arg("ssh")
.arg("-o")
.arg("StrictHostKeyChecking=no")
.arg("-o")
.arg("UserKnownHostsFile=/dev/null")
.arg("-o")
.arg(format!("ConnectTimeout={timeout_secs}"))
.arg("-p")
.arg(port.to_string())
.arg(format!("{user}@{host}"))
.arg("id")
.output()
.await;
match result {
Ok(out) if out.status.success() => {
let id_str = String::from_utf8_lossy(&out.stdout).trim().to_string();
Some((user, pass, id_str))
}
_ => None,
}
}));
}
let mut found: Vec<serde_json::Value> = Vec::new();
for h in handles {
if let Ok(Some((user, pass, id_str))) = h.await {
found.push(serde_json::json!({
"username": user,
"password": pass,
"id": id_str,
}));
}
}
let evidence: Vec<String> = found
.iter()
.map(|c| {
let u = c["username"].as_str().unwrap_or("");
let p = c["password"].as_str().unwrap_or("");
format!("ssh/cred:{u}:{p}")
})
.collect();
let finding = if found.is_empty() {
format!(
"SSH bruteforce on tcp/{port}: no valid credentials found (tried {} pairs)",
creds.len()
)
} else {
let details: Vec<String> = found
.iter()
.map(|c| {
let u = c["username"].as_str().unwrap_or("");
let p = c["password"].as_str().unwrap_or("");
format!("{u}:{p}")
})
.collect();
format!(
"SSH bruteforce on tcp/{port}: FOUND {} valid credential(s): {}",
found.len(),
details.join(", ")
)
};
Ok(ModuleResult {
success: !found.is_empty(),
finding: Some(finding),
evidence,
data: serde_json::json!({
"host": self.host,
"port": port,
"found_credentials": found,
"tried_count": creds.len(),
}),
..Default::default()
})
}
}
#[module(
name = "ftp_bruteforce",
kind = "Scanner",
capabilities = "CredentialAccess",
intent = "Dump",
impact = "Critical",
description = "FTP credential bruteforcer - test username/password pairs via FTP protocol",
author = "ICEBOX"
)]
pub struct FtpBruteforce {
#[option(required = true, help = "Target IP or hostname")]
pub host: String,
#[option(help = "FTP port (default 21)")]
pub port: u16,
#[option(
help = "Credentials in user:pass format, comma-separated (default: built-in wordlist)"
)]
pub wordlist: String,
#[option(help = "Timeout per attempt in milliseconds (default 5000)")]
pub timeout_ms: u64,
#[option(help = "Maximum concurrent attempts (default 10)")]
pub concurrency: usize,
}
#[async_trait]
impl Module for FtpBruteforce {
fn options_json(&self) -> serde_json::Value {
serde_json::to_value(&FtpBruteforceOptions {
host: self.host.clone(),
port: self.port,
wordlist: self.wordlist.clone(),
timeout_ms: self.timeout_ms,
concurrency: self.concurrency,
})
.unwrap_or(serde_json::Value::Null)
}
fn set_option(&mut self, name: &str, value: &str) -> Result<(), ModuleError> {
let mut o = FtpBruteforceOptions {
host: self.host.clone(),
port: self.port,
wordlist: self.wordlist.clone(),
timeout_ms: self.timeout_ms,
concurrency: self.concurrency,
};
o.set(name, value)?;
self.host = o.host;
self.port = o.port;
self.wordlist = o.wordlist;
self.timeout_ms = o.timeout_ms;
self.concurrency = o.concurrency;
Ok(())
}
fn validate(&self) -> Result<(), ModuleError> {
FtpBruteforceOptions {
host: self.host.clone(),
port: self.port,
wordlist: self.wordlist.clone(),
timeout_ms: self.timeout_ms,
concurrency: self.concurrency,
}
.validate()
}
async fn run(&self) -> Result<ModuleResult, ModuleError> {
let port = if self.port > 0 { self.port } else { 21 };
let timeout = std::time::Duration::from_millis(if self.timeout_ms > 0 {
self.timeout_ms
} else {
5000
});
let max_concurrency = if self.concurrency > 0 {
self.concurrency
} else {
10
};
let creds = parse_creds(&self.wordlist);
let host = self.host.clone();
async fn try_ftp_login(
host: &str,
port: u16,
user: &str,
pass: &str,
timeout: std::time::Duration,
) -> Option<(String, String)> {
let addr = crate::core::proxy::resolve_dial(host, port);
let stream = tokio::time::timeout(timeout, tokio::net::TcpStream::connect(&addr))
.await
.ok()?
.ok()?;
let mut buf = vec![0u8; 4096];
let n = tokio::time::timeout(timeout, stream.readable())
.await
.ok()?
.map(|_| stream.try_read(&mut buf).unwrap_or(0))
.unwrap_or(0);
if n == 0 {
return None;
}
let _ = stream
.try_write(format!("USER {user}\r\n").as_bytes())
.ok()?;
tokio::time::sleep(std::time::Duration::from_millis(200)).await;
let mut buf2 = vec![0u8; 4096];
let n2 = tokio::time::timeout(timeout, stream.readable())
.await
.ok()?
.map(|_| stream.try_read(&mut buf2).unwrap_or(0))
.unwrap_or(0);
let user_resp = String::from_utf8_lossy(&buf2[..n2.min(4000)]);
if !user_resp.starts_with("331") && !user_resp.starts_with("230") {
return None;
}
let _ = stream
.try_write(format!("PASS {pass}\r\n").as_bytes())
.ok()?;
tokio::time::sleep(std::time::Duration::from_millis(200)).await;
let mut buf3 = vec![0u8; 4096];
let n3 = tokio::time::timeout(timeout, stream.readable())
.await
.ok()?
.map(|_| stream.try_read(&mut buf3).unwrap_or(0))
.unwrap_or(0);
let pass_resp = String::from_utf8_lossy(&buf3[..n3.min(4000)]);
if pass_resp.starts_with("230") {
Some((user.to_string(), pass.to_string()))
} else {
None
}
}
let semaphore = Arc::new(Semaphore::new(max_concurrency));
let mut handles = Vec::new();
for (user, pass) in &creds {
let permit = semaphore
.clone()
.acquire_owned()
.await
.map_err(|e| ModuleError::Other(e.to_string()))?;
let host = host.clone();
let user = user.clone();
let pass = pass.clone();
handles.push(tokio::spawn(async move {
let _permit = permit;
try_ftp_login(&host, port, &user, &pass, timeout).await
}));
}
let mut found: Vec<(String, String)> = Vec::new();
for h in handles {
if let Ok(Some((u, p))) = h.await {
found.push((u, p));
}
}
let evidence: Vec<String> = found
.iter()
.map(|(u, p)| format!("ftp/cred:{u}:{p}"))
.collect();
let finding = if found.is_empty() {
format!(
"FTP bruteforce on tcp/{port}: no valid credentials found (tried {} pairs)",
creds.len()
)
} else {
let details: Vec<String> = found.iter().map(|(u, p)| format!("{u}:{p}")).collect();
format!(
"FTP bruteforce on tcp/{port}: FOUND {} valid credential(s): {}",
found.len(),
details.join(", ")
)
};
Ok(ModuleResult {
success: !found.is_empty(),
finding: Some(finding),
evidence,
data: serde_json::json!({
"host": self.host,
"port": port,
"found_credentials": found,
"tried_count": creds.len(),
}),
..Default::default()
})
}
}
fn rdp_build_neg_req(requested: u32) -> Vec<u8> {
let mut pkt = Vec::with_capacity(8);
pkt.push(0x01);
pkt.push(0x00);
pkt.extend_from_slice(&[0x08, 0x00]);
pkt.extend_from_slice(&requested.to_le_bytes());
pkt
}
fn rdp_parse_neg_rsp(data: &[u8]) -> Option<(u8, u32)> {
if data.len() < 8 {
return None;
}
if data[0] != 0x02 && data[0] != 0x03 {
return None;
}
let r#type = data[0];
let _flags = data[1];
let len = u16::from_le_bytes([data[2], data[3]]);
if len < 8 {
return None;
}
let selected = u32::from_le_bytes([data[4], data[5], data[6], data[7]]);
Some((r#type, selected))
}
const PROTOCOL_RDP: u32 = 0x01;
const PROTOCOL_SSL: u32 = 0x02;
const PROTOCOL_NLA: u32 = 0x08;
#[module(
name = "rdp_scanner",
kind = "Scanner",
description = "RDP service scanner - version detection and NLA/SSL mode check",
author = "ICEBOX"
)]
pub struct RdpScanner {
#[option(required = true, help = "Target IP or hostname")]
pub host: String,
#[option(help = "RDP port (default 3389)")]
pub port: u16,
#[option(help = "Timeout in milliseconds (default 5000)")]
pub timeout_ms: u64,
}
#[async_trait]
impl Module for RdpScanner {
fn options_json(&self) -> serde_json::Value {
serde_json::to_value(&RdpScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
})
.unwrap_or(serde_json::Value::Null)
}
fn set_option(&mut self, name: &str, value: &str) -> Result<(), ModuleError> {
let mut o = RdpScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
};
o.set(name, value)?;
self.host = o.host;
self.port = o.port;
self.timeout_ms = o.timeout_ms;
Ok(())
}
fn validate(&self) -> Result<(), ModuleError> {
RdpScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
}
.validate()
}
async fn run(&self) -> Result<ModuleResult, ModuleError> {
let port = if self.port > 0 { self.port } else { 3389 };
let timeout_ms = if self.timeout_ms > 0 {
self.timeout_ms
} else {
5000
};
let timeout = std::time::Duration::from_millis(timeout_ms);
let addr = crate::core::proxy::resolve_dial(&self.host, port);
let stream =
match tokio::time::timeout(timeout, tokio::net::TcpStream::connect(&addr)).await {
Ok(Ok(s)) => s,
Ok(Err(e)) => return Err(ModuleError::Other(format!("connection failed: {e}"))),
Err(_) => return Err(ModuleError::Other("connection timed out".into())),
};
let req = rdp_build_neg_req(PROTOCOL_RDP | PROTOCOL_SSL | PROTOCOL_NLA);
if tokio::time::timeout(timeout, stream.writable())
.await
.is_err()
{
return Err(ModuleError::Other("write timeout".into()));
}
let _ = stream.try_write(&req);
let mut buf = vec![0u8; 1024];
let n = match tokio::time::timeout(timeout, stream.readable()).await {
Ok(Ok(_)) => stream.try_read(&mut buf).unwrap_or(0),
_ => 0,
};
if n < 8 {
return Ok(ModuleResult {
success: true,
finding: Some(format!("RDP on tcp/{port}: no response")),
data: serde_json::json!({"host": self.host, "port": port}),
..Default::default()
});
}
let (rsp_type, selected) = rdp_parse_neg_rsp(&buf[..n]).unwrap_or((0, 0));
let proto_name = match selected {
1 => "RDP (standard)",
2 => "SSL/TLS",
8 => "NLA (CredSSP)",
0 => "FAILED",
_ => "unknown",
};
let finding = format!(
"RDP on tcp/{port}: selected={proto_name} (0x{selected:x}), type=0x{rsp_type:x}"
);
Ok(ModuleResult {
success: true,
finding: Some(finding),
evidence: vec![format!("rdp/protocol:{proto_name}")],
data: serde_json::json!({
"host": self.host, "port": port,
"selected_protocol": selected,
"protocol_name": proto_name,
"response_type": rsp_type,
}),
..Default::default()
})
}
}
#[module(
name = "vnc_scanner",
kind = "Scanner",
description = "VNC service scanner - protocol version and authentication type detection",
author = "ICEBOX"
)]
pub struct VncScanner {
#[option(required = true, help = "Target IP or hostname")]
pub host: String,
#[option(help = "VNC port (default 5900)")]
pub port: u16,
#[option(help = "Timeout in milliseconds (default 5000)")]
pub timeout_ms: u64,
#[option(help = "Check VNC authentication support (default true)")]
pub check_vnc_auth: bool,
}
#[async_trait]
impl Module for VncScanner {
fn options_json(&self) -> serde_json::Value {
serde_json::to_value(&VncScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
check_vnc_auth: self.check_vnc_auth,
})
.unwrap_or(serde_json::Value::Null)
}
fn set_option(&mut self, name: &str, value: &str) -> Result<(), ModuleError> {
let mut o = VncScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
check_vnc_auth: self.check_vnc_auth,
};
o.set(name, value)?;
self.host = o.host;
self.port = o.port;
self.timeout_ms = o.timeout_ms;
self.check_vnc_auth = o.check_vnc_auth;
Ok(())
}
fn validate(&self) -> Result<(), ModuleError> {
VncScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
check_vnc_auth: self.check_vnc_auth,
}
.validate()
}
async fn run(&self) -> Result<ModuleResult, ModuleError> {
let port = if self.port > 0 { self.port } else { 5900 };
let timeout_ms = if self.timeout_ms > 0 {
self.timeout_ms
} else {
5000
};
let timeout = std::time::Duration::from_millis(timeout_ms);
let addr = crate::core::proxy::resolve_dial(&self.host, port);
let stream =
match tokio::time::timeout(timeout, tokio::net::TcpStream::connect(&addr)).await {
Ok(Ok(s)) => s,
Ok(Err(e)) => return Err(ModuleError::Other(format!("connection failed: {e}"))),
Err(_) => return Err(ModuleError::Other("connection timed out".into())),
};
let mut buf = vec![0u8; 4096];
let n = match tokio::time::timeout(timeout, stream.readable()).await {
Ok(Ok(_)) => stream.try_read(&mut buf).unwrap_or(0),
_ => 0,
};
if n == 0 {
return Ok(ModuleResult {
success: true,
finding: Some(format!("VNC on tcp/{port}: no protocol version received")),
data: serde_json::json!({"host": self.host, "port": port}),
..Default::default()
});
}
let raw = String::from_utf8_lossy(&buf[..n.min(256)]);
let banner = raw.lines().next().unwrap_or("").trim().to_string();
let mut findings = Vec::new();
let mut evidence = Vec::new();
if banner.starts_with("RFB") {
findings.push(format!("version: {banner}"));
evidence.push(format!("vnc/version:{banner}"));
let ver_str = if banner == "RFB 003.008\n" || banner == "RFB 003.008" {
"RFB 003.008\n"
} else {
"RFB 003.003\n"
};
if tokio::time::timeout(timeout, stream.writable())
.await
.is_ok()
{
let _ = stream.try_write(ver_str.as_bytes());
}
let n2 = match tokio::time::timeout(timeout, stream.readable()).await {
Ok(Ok(_)) => stream.try_read(&mut buf).unwrap_or(0),
_ => 0,
};
if n2 >= 1 {
let sec_count = buf[0] as usize;
if sec_count > 0 && n2 > sec_count {
let types: Vec<u8> = buf[1..1 + sec_count].to_vec();
let type_names: Vec<String> = types
.iter()
.map(|&t| match t {
1 => "None".into(),
2 => "VNC Auth".into(),
5 => "RA2".into(),
6 => "RA2ne".into(),
16 => "Tight".into(),
17 => "Ultra".into(),
18 => "TLS".into(),
19 => "VeNCrypt".into(),
20 => "GTK-VNC SASL".into(),
21 => "MD5".into(),
22 => "Colin 64".into(),
_ => format!("Unknown(0x{t:x})"),
})
.collect();
findings.push(format!("auth types: {}", type_names.join(", ")));
evidence.extend(types.iter().map(|&t| format!("vnc/auth:0x{t:x}")));
if types.contains(&1) {
findings.push("No authentication required!".into());
evidence.push("vnc/no_auth".into());
}
} else if sec_count == 0 && n2 >= 4 {
let auth_type = u32::from_le_bytes([buf[1], buf[2], buf[3], buf[4]]);
let name = match auth_type {
1 => "None",
2 => "VNC Auth",
_ => "unknown",
};
findings.push(format!("auth: {name} (0x{auth_type:x})"));
evidence.push(format!("vnc/auth:0x{auth_type:x}"));
}
}
} else {
findings.push(format!("unrecognized banner: {banner}"));
evidence.push(format!("vnc/banner:{}", hex_encode(&buf[..n.min(64)])));
}
Ok(ModuleResult {
success: true,
finding: Some(format!("VNC on tcp/{port}: {}", findings.join("; "))),
evidence,
data: serde_json::json!({
"host": self.host, "port": port,
"banner": banner,
"findings": findings,
}),
..Default::default()
})
}
}
const IAC: u8 = 0xFF;
const TN_SB: u8 = 0xFA;
const TN_SE: u8 = 0xF0;
fn strip_telnet_negotiation(data: &[u8]) -> Vec<u8> {
let mut out = Vec::new();
let mut i = 0;
while i < data.len() {
if data[i] == IAC && i + 2 < data.len() {
match data[i + 1] {
TN_SB => {
let mut j = i + 2;
while j + 1 < data.len() {
if data[j] == IAC && data[j + 1] == TN_SE {
i = j + 2;
break;
}
j += 1;
}
if j + 1 >= data.len() {
i = data.len();
}
}
_ => {
i += 3;
}
}
} else if data[i] >= 32 || data[i] == b'\n' || data[i] == b'\r' || data[i] == b'\t' {
out.push(data[i]);
i += 1;
} else {
i += 1;
}
}
out
}
#[module(
name = "telnet_scanner",
kind = "Scanner",
description = "Telnet service scanner - banner grabbing and option negotiation detection",
author = "ICEBOX"
)]
pub struct TelnetScanner {
#[option(required = true, help = "Target IP or hostname")]
pub host: String,
#[option(help = "Telnet port (default 23)")]
pub port: u16,
#[option(help = "Timeout in milliseconds (default 5000)")]
pub timeout_ms: u64,
}
#[async_trait]
impl Module for TelnetScanner {
fn options_json(&self) -> serde_json::Value {
serde_json::to_value(&TelnetScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
})
.unwrap_or(serde_json::Value::Null)
}
fn set_option(&mut self, name: &str, value: &str) -> Result<(), ModuleError> {
let mut o = TelnetScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
};
o.set(name, value)?;
self.host = o.host;
self.port = o.port;
self.timeout_ms = o.timeout_ms;
Ok(())
}
fn validate(&self) -> Result<(), ModuleError> {
TelnetScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
}
.validate()
}
async fn run(&self) -> Result<ModuleResult, ModuleError> {
let port = if self.port > 0 { self.port } else { 23 };
let timeout_ms = if self.timeout_ms > 0 {
self.timeout_ms
} else {
5000
};
let timeout = std::time::Duration::from_millis(timeout_ms);
let addr = crate::core::proxy::resolve_dial(&self.host, port);
let stream =
match tokio::time::timeout(timeout, tokio::net::TcpStream::connect(&addr)).await {
Ok(Ok(s)) => s,
Ok(Err(e)) => return Err(ModuleError::Other(format!("connection failed: {e}"))),
Err(_) => return Err(ModuleError::Other("connection timed out".into())),
};
let mut all_data = Vec::new();
let mut buf = vec![0u8; 8192];
loop {
let n = match tokio::time::timeout(timeout, stream.readable()).await {
Ok(Ok(_)) => match stream.try_read(&mut buf) {
Ok(n) => n,
Err(ref e) if e.kind() == std::io::ErrorKind::WouldBlock => 0,
Err(_) => break,
},
_ => break,
};
if n == 0 {
break;
}
all_data.extend_from_slice(&buf[..n]);
if all_data.len() > 65536 {
break;
}
}
if all_data.is_empty() {
return Ok(ModuleResult {
success: true,
finding: Some(format!("Telnet on tcp/{port}: no banner received")),
data: serde_json::json!({"host": self.host, "port": port}),
..Default::default()
});
}
let text = strip_telnet_negotiation(&all_data);
let clean_text = String::from_utf8_lossy(&text).to_string();
let banner = clean_text
.lines()
.find(|l| !l.trim().is_empty())
.unwrap_or("")
.trim()
.to_string();
let os_hint = if banner.contains("Linux")
|| banner.contains("ubuntu")
|| banner.contains("debian")
|| banner.contains("centos")
{
Some("Linux")
} else if banner.contains("FreeBSD")
|| banner.contains("NetBSD")
|| banner.contains("OpenBSD")
{
Some("BSD")
} else if banner.contains("SunOS") || banner.contains("Solaris") {
Some("Solaris")
} else if banner.contains("AIX") {
Some("AIX")
} else if banner.contains("HP-UX") {
Some("HP-UX")
} else if banner.to_lowercase().contains("cisco") || banner.to_lowercase().contains("ios") {
Some("Cisco IOS")
} else {
None
};
let mut evidence = vec![format!("telnet/banner:{banner}")];
if let Some(os) = os_hint {
evidence.push(format!("telnet/os:{os}"));
}
Ok(ModuleResult {
success: true,
finding: Some(format!(
"Telnet on tcp/{port}: {banner}{}",
os_hint.map(|o| format!(" [{o}]")).unwrap_or_default()
)),
evidence,
data: serde_json::json!({
"host": self.host, "port": port,
"banner": banner,
"os_hint": os_hint,
"raw_length": all_data.len(),
"negotiation_count": all_data.iter().filter(|&&b| b == IAC).count(),
}),
..Default::default()
})
}
}
const REDIS_DEFAULT_PASSWORDS: &[&str] =
&["", "redis", "default", "redislabs", "admin", "password"];
#[module(
name = "redis_scanner",
kind = "Scanner",
description = "Redis service scanner - version detection and unprotected instance check",
author = "ICEBOX"
)]
pub struct RedisScanner {
#[option(required = true, help = "Target IP or hostname")]
pub host: String,
#[option(help = "Redis port (default 6379)")]
pub port: u16,
#[option(help = "Timeout in milliseconds (default 5000)")]
pub timeout_ms: u64,
#[option(help = "Check default passwords when auth is required (default true)")]
pub check_defaults: bool,
}
async fn redis_read_line(
stream: &tokio::net::TcpStream,
timeout: std::time::Duration,
) -> Result<String, ModuleError> {
let mut buf = vec![0u8; 4096];
let n = match tokio::time::timeout(timeout, stream.readable()).await {
Ok(Ok(_)) => stream.try_read(&mut buf).unwrap_or(0),
_ => return Err(ModuleError::Other("read timeout".into())),
};
let text = String::from_utf8_lossy(&buf[..n.min(4092)]);
let line = text.lines().next().unwrap_or("").trim().to_string();
Ok(line)
}
async fn redis_send(
stream: &tokio::net::TcpStream,
cmd: &[u8],
timeout: std::time::Duration,
) -> Result<(), ModuleError> {
match tokio::time::timeout(timeout, stream.writable()).await {
Ok(Ok(_)) => stream
.try_write(cmd)
.map_err(|e| ModuleError::Other(format!("write: {e}")))
.map(|_| ()),
_ => Err(ModuleError::Other("write timeout".into())),
}
}
#[async_trait]
impl Module for RedisScanner {
fn options_json(&self) -> serde_json::Value {
serde_json::to_value(&RedisScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
check_defaults: self.check_defaults,
})
.unwrap_or(serde_json::Value::Null)
}
fn set_option(&mut self, name: &str, value: &str) -> Result<(), ModuleError> {
let mut o = RedisScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
check_defaults: self.check_defaults,
};
o.set(name, value)?;
self.host = o.host;
self.port = o.port;
self.timeout_ms = o.timeout_ms;
self.check_defaults = o.check_defaults;
Ok(())
}
fn validate(&self) -> Result<(), ModuleError> {
RedisScannerOptions {
host: self.host.clone(),
port: self.port,
timeout_ms: self.timeout_ms,
check_defaults: self.check_defaults,
}
.validate()
}
async fn run(&self) -> Result<ModuleResult, ModuleError> {
let port = if self.port > 0 { self.port } else { 6379 };
let timeout_ms = if self.timeout_ms > 0 {
self.timeout_ms
} else {
5000
};
let timeout = std::time::Duration::from_millis(timeout_ms);
let addr = crate::core::proxy::resolve_dial(&self.host, port);
let stream =
match tokio::time::timeout(timeout, tokio::net::TcpStream::connect(&addr)).await {
Ok(Ok(s)) => s,
Ok(Err(e)) => return Err(ModuleError::Other(format!("connection failed: {e}"))),
Err(_) => return Err(ModuleError::Other("connection timed out".into())),
};
redis_send(&stream, b"PING\r\n", timeout).await?;
let pong = redis_read_line(&stream, timeout).await.unwrap_or_default();
let mut findings = Vec::new();
let mut evidence = Vec::new();
let mut authed = false;
let mut used_password = String::new();
if pong == "+PONG" {
findings.push("no authentication required".into());
evidence.push("redis/no_auth".into());
authed = true;
} else if pong.starts_with("-NOAUTH") {
findings.push("authentication required".into());
if self.check_defaults {
for pass in REDIS_DEFAULT_PASSWORDS {
let auth_cmd = format!("AUTH {pass}\r\n");
redis_send(&stream, auth_cmd.as_bytes(), timeout).await.ok();
let resp = redis_read_line(&stream, timeout).await.unwrap_or_default();
if resp == "+OK" {
findings.push(format!("AUTH success with password: {:?}", pass));
evidence.push(format!("redis/cred::{:?}", pass));
authed = true;
used_password = pass.to_string();
break;
}
}
if !authed {
findings.push("default passwords failed".into());
}
}
} else {
findings.push(format!("unexpected response: {pong}"));
}
if authed {
redis_send(&stream, b"INFO\r\n", timeout).await.ok();
let mut all_data = Vec::new();
let mut buf = vec![0u8; 16384];
let n = match tokio::time::timeout(timeout, stream.readable()).await {
Ok(Ok(_)) => stream.try_read(&mut buf).unwrap_or(0),
_ => 0,
};
if n > 0 {
all_data.extend_from_slice(&buf[..n]);
let info_text = String::from_utf8_lossy(&all_data);
let mut version = String::new();
let mut os = String::new();
for line in info_text.lines() {
if let Some(v) = line.strip_prefix("redis_version:") {
version = v.trim().to_string();
}
if let Some(o) = line.strip_prefix("os:") {
os = o.trim().to_string();
}
}
if !version.is_empty() {
findings.push(format!("version: {version}"));
evidence.push(format!("redis/version:{version}"));
}
if !os.is_empty() {
evidence.push(format!("redis/os:{os}"));
}
}
}
Ok(ModuleResult {
success: true,
finding: Some(format!("Redis on tcp/{port}: {}", findings.join("; "))),
evidence,
data: serde_json::json!({
"host": self.host, "port": port,
"authenticated": authed,
"used_password": used_password,
"findings": findings,
}),
..Default::default()
})
}
}