Skip to content

RustSploit v0.4.3 - Major Release 20+ modules

Choose a tag to compare

View all tags
@s-b-repo s-b-repo released this 16 Jan 23:11
· 1 commit to main since this release
v0.4.3
9beb949

RustSploit v0.4.3 - Major Release

Overview

This major release introduces significant improvements to RustSploit's exploit framework, including 20+ new exploit modules, complete dependency upgrades, architectural refactoring, and internet-scale scanning capabilities.

Breaking Changes

  • Dependency Upgrades: All crates updated to latest versions (rustls 0.23+, reqwest 0.13+, suppaftp 7.x, hickory-client 0.25+)
  • Build System: Module discovery moved to compile-time for improved reliability

New Exploit Modules

Database Vulnerabilities

  • MongoBleed (CVE-2025-14847): MongoDB zlib decompression memory leak exploitation
    • Memory leak analysis and credential extraction
    • Automated compressed response parsing

Web Application Exploits

Nginx

  • NginxPwner: Comprehensive Nginx vulnerability scanner
    • Version disclosure detection
    • CRLF injection testing
    • Variable leakage checks
    • Alias traversal detection
    • Header bypass/IP spoofing
    • Integer overflow (CVE-2017-7529)
    • PHP detection and X-Accel-Redirect bypass

n8n Workflow Automation

  • n8n RCE (CVE-2025-68613): Expression injection vulnerability
    • 6 payload types: Info, Command, Environment, Read File, Write File, Reverse Shell
    • Full authentication workflow support
    • Automatic cleanup

FortiSIEM

  • FortiSIEM RCE (CVE-2025-64155): Unauthenticated argument injection
    • Port 7900 binary protocol exploitation
    • Script overwrite capability (DESTRUCTIVE)

FortiWeb

  • FortiWeb SQLi RCE (CVE-2025-25257): SQL injection to RCE chain
    • Payload chunking via UPDATE/CONCAT
    • Webshell deployment
    • Interactive command mode

Fortinet (Consolidated)

Ivanti

  • Ivanti EPMM (CVE-2023-35082/35078): Authentication bypass
    • User enumeration
    • Email and role disclosure

IoT & Camera Exploits

Hikvision

  • Hikvision RCE (CVE-2021-36260): Complete exploitation suite
    • Safe vulnerability check
    • Command execution with output
    • Blind command execution
    • Interactive shell mode
    • SSH dropbear deployment

TP-Link Cameras

TP-Link Routers

  • Archer C2/C20i RCE (CVE-2017-8220): Command injection
  • WDR740N Backdoor: Debug page exploitation
  • WDR740N Path Traversal: Arbitrary file read
  • WDR842N Config Disclosure: Configuration decryption
  • Archer C9/C60 Password Reset (CVE-2017-11519): PRNG prediction

D-Link

  • DCS-930L Auth Bypass: Camera authentication bypass

Mail Server

  • Exim ETRN SQLi (CVE-2025-26794): Time-based blind SQL injection
    • Automated timing analysis
    • Vulnerability verification

Internet-Scale Scanning

Mass Scan Support (0.0.0.0/0)

Six exploit modules now support internet-wide scanning:

Features:

  • Random public IPv4 generation
  • Automatic bogon/private range exclusion
  • Cloudflare, Google DNS, and critical infrastructure filtering
  • High concurrency (100+ threads)
  • Result logging
  • Quick check modes for speed optimization

Telnet Mass Scanner

  • telnet_hose: High-velocity internet-scale credential discovery
    • Random internet scanning
    • List-based scanning
    • Disk-based state management
    • Auto-exclusion of sensitive ranges
    • Smart Cartesian product credential testing
    • 500 concurrent workers by default

Framework Improvements

Security Enhancements

  • Input Validation: Payload-safe input handling
    • Null byte sanitization only
    • Pattern detection (shell keywords, path traversal)
    • Warning system for suspicious input
    • Preserves exploit payloads and ANSI sequences

Performance Optimizations

  • Telnet Bruteforce: Major performance improvements
    • Single DNS resolution per scan
    • State machine architecture
    • Strict timeout handling
    • Password-only server support
    • Concurrent worker model

Build System

  • Compile-time Module Discovery:
    • walkdir-based scanning in build.rs
    • Generated AVAILABLE_MODULES constants
    • Instant module listing (no runtime scanning)
    • Improved reliability

Code Quality

  • Standardized Utilities: Centralized input/validation functions
  • Module Refactoring: Consistent use of crate::utils
  • Error Handling: Improved timeout and error management
  • Dead Code Elimination: All utility functions actively used

Dependency Updates

Major Upgrades

  • rustls → 0.23+ (pki_types migration)
  • reqwest → 0.13+ (form/query API changes)
  • suppaftp → 7.x (tokio async streams)
  • hickory-client → 0.25+ (AsyncClient → Client)

Compatibility Fixes

  • ServerName import updates
  • Manual form/query construction
  • Async FTP stream refactoring
  • DNS client builder pattern

Usage Examples

Internet-Wide Scanning

# Random internet scan
./rustsploit exploit --module exploits/hikvision/hikvision_rce --target 0.0.0.0/0

# Telnet credential discovery
./rustsploit --module creds/generic/telnet_hose --target 0.0.0.0/0

Targeted Exploitation

# MongoBleed
./rustsploit exploit --module exploits/mongo/mongobleed --target 10.0.0.5

# Nginx vulnerability scan
./rustsploit exploit --module exploits/nginx/nginx_pwner --target http://example.com

# FortiSIEM RCE
./rustsploit exploit --module exploits/fortinet/fortisiem_rce --target 10.0.40.83

Interactive Mode

rustsploit > use exploits/tplink/tapo_c200_vulns
rustsploit (tapo_c200) > set target 192.168.1.100
rustsploit (tapo_c200) > run

Important Notes

Destructive Modules

The following modules perform destructive operations:

  • FortiSIEM RCE (overwrites system scripts)
  • Tapo C200 WiFi Hijacking
  • All DoS modules

Always obtain proper authorization before use.

Disabled Features

  • DNS Recursion Scanner (pending hickory-client 0.25 rewrite)

Statistics

  • 20+ new exploit modules
  • 3 new credential modules
  • 6 modules with mass scan support
  • 100% dependency upgrade completion
  • 0 compilation warnings

🔒 Security & Legal

RustSploit is designed for:

  • Authorized penetration testing
  • Security research
  • Vulnerability assessment

Unauthorized access to computer systems is illegal. Users are responsible for ensuring they have proper authorization before using any module.

Credits

Exploit implementations ported from:

  • Routersploit
  • Metasploit Framework
  • Public PoC repositories
  • Security researcher disclosures

Upgrade Guide

For Existing Users

  1. Backup your custom modules
  2. Update dependencies: cargo update
  3. Review breaking changes in dependency APIs
  4. Test modules before production use

Future Roadmap

  • Additional IoT device support
  • Enhanced reporting capabilities
  • Module result standardization
  • API server mode

Full Changelog: See CHANGELOG.md for detailed commit history

Download: See [Releases](https://github.com/yourusername/rustsploit/releases) for binaries

Assets 2
Loading