Skip to content

lambda 67

Choose a tag to compare

View all tags
@s-b-repo s-b-repo released this 28 Jan 06:38
· 1 commit to main since this release
v0.4.6
b132de7

RustSploit Framework - Major Update Release

Release Highlights

This release represents a comprehensive overhaul of the RustSploit penetration testing framework, focusing on stability, performance, and expanded scanning capabilities.

New Features

#Mass Scanning Capabilities

  • TP-Link Tapo C200 Exploit: Now supports mass scanning with CIDR ranges and random IP generation
  • RTSP Bruteforce: Complete rewrite with intelligent authentication detection (Basic, Digest, No Auth)
  • Proxy Scanner: New module with automatic protocol detection (HTTP CONNECT, SOCKS4, SOCKS5) and credential brute forcing
  • Honeypot Checker: New comprehensive module scoring targets (0-100) based on port behavior and government/military detection

#Enhanced Modules

  • Sequential Fuzzer: Added pattern generation mode and overlong UTF-8 encoding for WAF bypass testing
  • Port Scanner: Multi-method support (SYN, CONNECT, ACK) with simplified output for faster scanning
  • Null SYN Exhaustion (DoS): Completely optimized with shared socket architecture and zero-allocation loops for maximum packet rates
  • Telnet Auth Bypass (CVE-2026-24061): Proactive negotiation and improved exploit reliability

#Authentication Improvements

  • RTSP Bruteforce: Smart probing system that detects authentication requirements before credential testing
    • Automatic Digest authentication support with MD5 hashing
    • Reports unauthenticated access immediately
    • Adaptive authentication method selection

Critical Bug Fixes

#Stability & Robustness

  • EOF Handling: Fixed infinite loop DoS vulnerability when stdin is closed
  • Index Out of Bounds: Resolved panic in Telnet module caused by integer underflow
  • Mass Scan State Files: Fixed grep: No such file or directory errors across all mass scan modules
  • Honeypot Detection: Disabled for mass scan targets (0.0.0.0/0, CIDR ranges, random mode)
  • Panic on Large Payloads: Fixed crash in DoS module when using payloads exceeding IPv4 packet size limits
  • API Server Crash: Corrected route syntax for axum framework compatibility

#Code Quality

  • Removed Unsafe Unwraps: Replaced all .unwrap() calls with proper error handling across:
    • rtsp_bruteforce.rs
    • tapo_c200_vulns.rs
    • qnap_qts.rs
    • port_scanner.rs
  • Memory Safety: Implemented lazy iteration for large subnet scanning to prevent OOM crashes

Performance Optimizations

#DoS Module (Null SYN Exhaustion)

  • Shared Socket Architecture: Reduced from 1500+ file descriptors to configurable socket pool (default: 8)
  • Zero-Allocation Loop: Pre-allocated buffers with header-only updates for maximum throughput
  • Configurable Socket Sharding: User-definable pool size for CPU core optimization
  • Worker Thread Pooling: Decoupled load from OS resources

#Port Scanner

  • Parallel Execution: Removed serial banner grabbing (1-2s timeout eliminated)
  • Simplified Output: Removed service names and banners for faster scanning
  • Concurrent Operation: Maintained bounded parallelism with improved speed

#Honeypot Checking

  • Parallelized Scanning: ~200 port checks now complete in <1s (previously ~50s on blackhole targets)
  • Concurrent Port Probes: Using tokio::spawn for non-blocking checks

Security & Validation

#Comprehensive Stress Testing
All modules passed extensive black-box stress testing including:

Input Validation

  • Large input handling (50,000+ character strings)
  • Command injection prevention
  • Invalid UTF-8 handling
  • Malformed JSON configuration rejection

Concurrency & Stability

  • 100 concurrent API requests without deadlocks
  • 20 simultaneous CLI instances without contention
  • Rapid-fire command execution (50 commands/sec)
  • High-concurrency port scanning (500 threads)

Edge Cases

  • Subnet size validation (supports /0 to /32)
  • IP limit enforcement
  • Privilege fallback (SYN → Connect scan)
  • Broken pipe handling

#CVE Updates

Module Updates

#Scanners

  • scanners/honeypot_checker - NEW: Comprehensive honeypot detection with scoring
  • scanners/proxy_scanner - NEW: Multi-protocol proxy detection with auth brute force
  • scanners/port_scanner - ENHANCED: Multi-method scanning, optimized performance
  • scanners/sequential_fuzzer - ENHANCED: Pattern generation, malformed Unicode

#Credentials

  • creds/generic/rtsp_bruteforce - REFACTORED: Intelligent auth detection, native mass scanning
  • creds/generic/ftp_anonymous - FIXED: State file handling
  • creds/generic/ftp_bruteforce - FIXED: State file handling
  • creds/generic/pop3_bruteforce - FIXED: State file handling

#Exploits

  • exploits/tplink/tplink_tapo_c200 - ENHANCED: Mass scanning support, CIDR ranges
  • exploits/tplink/tapo_c200_vulns - UPDATED: Real CVE numbers, logic fixes
  • exploits/telnet/telnet_auth_bypass_cve_2026_24061 - ENHANCED: Proactive negotiation
  • exploits/dos/null_syn_exhaustion - OPTIMIZED: Shared sockets, zero-allocation

Breaking Changes

#Configuration

  • Removed hardcoded 65,536 IP limit for subnet scanning
  • Subnet validation now supports any valid CIDR (/0 to /32)
  • Mass scan state files now enforce initialization before scan loops

#Module Naming

  • Renamed rtsp_bruteforce_advanced → rtsp_bruteforce
  • Standardized module banners and output formats

#API Routes

  • Updated URL parameter syntax from :param to {param} (axum compatibility)

#Requirements

  • Rust 1.70+ (recommended: latest stable)
  • Linux-based OS (Ubuntu 24 recommended)
  • Root privileges for raw socket operations (SYN scans, DoS modules)

Documentation

#New Module Usage Examples

Honeypot Checker:

rsf> use scanners/honeypot_checker
rsf> run <IP or FILE>

Proxy Scanner (Mass Scan):

rsf> use scanners/proxy_scanner
rsf> set target 0.0.0.0/0
rsf> run

RTSP Bruteforce (Smart Auth):

rsf> use creds/generic/rtsp_bruteforce
rsf> set target random
rsf> run

Full Changelog: See commit history for detailed changes

What's Changed

Full Changelog: v0.4.5...v0.4.6

Contributors

s-b-repo
Assets 2
Loading