Metadata-Version: 2.4
Name: plungerhacker
Version: 1.1.0
Summary: Industrial-Grade Exploit Framework for Security Research
Home-page: https://github.com/securityresearch/plunger
Author: Security Researcher
Author-email: researcher@example.com
Classifier: Development Status :: 5 - Production/Stable
Classifier: Intended Audience :: Education
Classifier: Intended Audience :: Information Technology
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Topic :: Security
Requires-Python: >=3.8
Description-Content-Type: text/markdown
Requires-Dist: requests
Requires-Dist: paramiko
Requires-Dist: scapy
Requires-Dist: cryptography
Requires-Dist: click
Requires-Dist: colorama
Dynamic: author
Dynamic: author-email
Dynamic: classifier
Dynamic: description
Dynamic: description-content-type
Dynamic: home-page
Dynamic: requires-dist
Dynamic: requires-python
Dynamic: summary

ï»¿# PLUNGER Framework

**Industrial-Grade Exploit Framework for Security Research**

> **WARNING: For EDUCATIONAL AND RESEARCH PURPOSES ONLY. Use only against targets you own or have explicit written authorization to test. Unauthorized access to computer systems is illegal.**

## Features
- **39 weaponized exploits** for high-impact CVEs (2018â€“2026).
- **Automated LAN reconnaissance & exploitation** (`plunge`, `pl`).
- **SSH brute-force** with LAN sweep mode (`sshbrute`).
- **Interactive RCE shell** for confirmed exploits.
- **Malicious file generation** (`malfile`) for client-side testing.
- **Multi-format reports** (JSON, HTML) with `--report-format`.
- **Concurrent LAN scanning** with `--threads`.
- **Evasion helpers**: sandbox detection, payload markers, command verification.
- **Strict ethics**: explicit confirmation per exploit, local-only guard.

## Installation
```bash
pip install plungerhacker
# or from source
pip install -e .
```

## Quick Start
```bash
plunger scan 192.168.1.10          # Port + tech fingerprint
plunger list                        # Show all 39 CVEs
plunger exploit CVE-2022-1388 http://target  # Single exploit
plunger plunge 192.168.1.10         # Full chain on one host
plunger pl all --network 192.168.1.0/24 --threads 8 --report report.html
plunger sshbrute all --network 192.168.1.0/24 --report ssh.json
plunger malfile CVE-2024-38063 --output shell.docx
```

## Commands
| Command | Description |
|---------|-------------|
| `scan <target>` | Fast port scan + web tech detection. |
| `list` | List all available exploits with metadata. |
| `exploit <CVE> <target> [--force] [--cmd CMD] [--shell] [--report FILE] [--report-format json\|html]` | Run single exploit; `--shell` drops into interactive RCE shell when confidence=confirmed. |
| `plunge <target> [--force] [--first] [--fast] [--report FILE] [--report-format json\|html] [--shell] [--threads N]` | Run ALL applicable exploits against one host (sequential). |
| `pl <target> [--network CIDR] [--skip HOSTS] [--skip-me] [--skip-router] [--first] [--fast] [--force] [--report FILE] [--report-format json\|html] [--threads N]` | LAN sweep: discover hosts, run all exploits per host (host-level parallelism via `--threads`). |
| `sshbrute <target> [--user USER] [--wordlist FILE] [--threads N] [--timeout N] [--report FILE] [--report-format json\|html]` | Single-target SSH credential brute. |
| `sshbrute all --network CIDR [--skip HOSTS] [--skip-me] [--skip-router] [--threads N] [--timeout N] [--report FILE]` | LAN-wide SSH brute: discover hosts then brute each in parallel. |
| `malfile <CVE> --output FILE` | Generate malicious document payloads (e.g., CVE-2024-38063 `.docx`). |

## New in 1.1.0
- **10 new CVE modules**: CVE-2023-34362 (MOVEit), CVE-2023-4966 (Citrix Bleed), CVE-2021-21972 (vCenter), CVE-2019-0708 (BlueKeep), CVE-2022-1388 (F5 iControl), CVE-2020-5902 (F5 TMUI), CVE-2023-27997 (Fortinet SSL-VPN), CVE-2021-40539 (ManageEngine), CVE-2022-22965 (Spring4Shell), CVE-2024-3094 (xz backdoor).
- **Base exploit hardening**: `severity`/`cvss`/`confidence` fields, `_http()`, `_make_markers()`, `_extract_bracketed()`, `_verify_command()`, error-page detection.
- **Reporting**: HTML reports (`--report-format html`), JSON sanitization of non-serializable objects.
- **Concurrency**: `--threads` for LAN host-level parallelism (single-target stays sequential for stability).
- **Fixed**: `list` command shadowing builtin `list()` causing `isinstance(x, list)` crashes.
- **SSH brute `all` mode**: LAN sweep with CIDR, skip lists, embedded wordlists.

## Exploit Confidence Levels
| Level | Meaning |
|-------|---------|
| `confirmed` | Marker-based proof of code execution (e.g., F5 iControl, ManageEngine). |
| `likely` | Strong fingerprint match (e.g., version banner, endpoint reachable). |
| `unknown` | Heuristic only (e.g., xz backdoor via SSH banner). |

## Example: Full LAN Sweep with HTML Report
```bash
plunger pl all --network 10.0.0.0/16 \
    --threads 16 \
    --skip-me --skip-router \
    --report lan-report.html \
    --report-format html
```

## Ethics & Legal
This tool is provided **solely for authorized security testing, research, and education**. The authors assume **no liability** for misuse. Always obtain written permission before scanning or exploiting any system.

## License
MIT â€” see `LICENSE`.
