Metadata-Version: 2.4
Name: plungerhacker
Version: 1.2.0
Summary: Industrial-Grade Exploit Framework for Security Research
Home-page: https://github.com/securityresearch/plunger
Author: 48 Labs
Author-email: aarush123.oggicial@gmail.com
Classifier: Development Status :: 5 - Production/Stable
Classifier: Intended Audience :: Education
Classifier: Intended Audience :: Information Technology
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Topic :: Security
Requires-Python: >=3.8
Description-Content-Type: text/markdown
Requires-Dist: requests
Requires-Dist: paramiko
Requires-Dist: scapy
Requires-Dist: cryptography
Requires-Dist: click
Requires-Dist: colorama
Dynamic: author
Dynamic: author-email
Dynamic: classifier
Dynamic: description
Dynamic: description-content-type
Dynamic: home-page
Dynamic: requires-dist
Dynamic: requires-python
Dynamic: summary

ï»¿# PLUNGER Framework

**Industrial-Grade Exploit Framework for Security Research**

> **WARNING: For EDUCATIONAL AND RESEARCH PURPOSES ONLY. Use only against targets you own or have explicit written authorization to test. Unauthorized access to computer systems is illegal.**

## Features
- **39 weaponized exploits** for high-impact CVEs (2018â€“2026).
- **Automated LAN reconnaissance & exploitation** (`plunge`, `pl`).
- **SSH brute-force** with LAN sweep mode (`sshbrute`).
- **Interactive RCE shell** for confirmed exploits.
- **SSH server payload generation** (`ssh make`) for authorized persistence testing.
- **LAN SSH server discovery** (`ssh start`) - scan LAN for deployed SSH servers.
- **Interactive SSH client** (`ssh connect`) with root:root defaults.
- **Multi-format reports** (JSON, HTML) with `--report-format`.
- **Concurrent LAN scanning** with `--threads`.
- **Evasion helpers**: sandbox detection, payload markers, command verification.
- **Strict ethics**: explicit confirmation per exploit, local-only guard.

## Installation
```bash
pip install plungerhacker
# or from source
pip install -e .
```

## Quick Start
```bash
plunger scan 192.168.1.10          # Port + tech fingerprint
plunger list                        # Show all 39 CVEs
plunger exploit CVE-2022-1388 http://target  # Single exploit
plunger plunge 192.168.1.10         # Full chain on one host
plunger pl all --network 192.168.1.0/24 --threads 8 --report report.html
plunger sshbrute all --network 192.168.1.0/24 --report ssh.json
plunger ssh make server.py               # Generate SSH server payload
plunger ssh make server.exe --exe         # Compile to windowless EXE
plunger ssh start                         # Scan LAN + connect to servers
plunger ssh connect 192.168.1.50          # Direct SSH connection
```

## Commands
| Command | Description |
|---------|-------------|
| `scan <target>` | Fast port scan + web tech detection. |
| `list` | List all available exploits with metadata. |
| `exploit <CVE> <target> [--force] [--cmd CMD] [--shell] [--report FILE] [--report-format json\|html]` | Run single exploit; `--shell` drops into interactive RCE shell when confidence=confirmed. |
| `plunge <target> [--force] [--first] [--fast] [--report FILE] [--report-format json\|html] [--shell] [--threads N]` | Run ALL applicable exploits against one host (sequential). |
| `pl <target> [--network CIDR] [--skip HOSTS] [--skip-me] [--skip-router] [--first] [--fast] [--force] [--report FILE] [--report-format json\|html] [--threads N]` | LAN sweep: discover hosts, run all exploits per host (host-level parallelism via `--threads`). |
| `sshbrute <target> [--user USER] [--wordlist FILE] [--threads N] [--timeout N] [--report FILE] [--report-format json\|html]` | Single-target SSH credential brute. |
| `sshbrute all --network CIDR [--skip HOSTS] [--skip-me] [--skip-router] [--threads N] [--timeout N] [--report FILE]` | LAN-wide SSH brute: discover hosts then brute each in parallel. |
| `ssh make <file> [--port N] [--user USER] [--password PASS] [--exe] [--arch x64\|x86]` | Generate a standalone SSH server payload (root:root). Use `--exe` for windowless EXE. |
| `ssh start [--network CIDR] [--port N] [--user USER] [--password PASS]` | Scan LAN, find hosts running the SSH server, and connect (root:root). |
| `ssh connect <target> [--user USER] [--password PASS] [--port N] [--command CMD]` | Interactive SSH client (root:root defaults). |

## New in 1.1.0
- **10 new CVE modules**: CVE-2023-34362 (MOVEit), CVE-2023-4966 (Citrix Bleed), CVE-2021-21972 (vCenter), CVE-2019-0708 (BlueKeep), CVE-2022-1388 (F5 iControl), CVE-2020-5902 (F5 TMUI), CVE-2023-27997 (Fortinet SSL-VPN), CVE-2021-40539 (ManageEngine), CVE-2022-22965 (Spring4Shell), CVE-2024-3094 (xz backdoor).
- **Base exploit hardening**: `severity`/`cvss`/`confidence` fields, `_http()`, `_make_markers()`, `_extract_bracketed()`, `_verify_command()`, error-page detection.
- **Reporting**: HTML reports (`--report-format html`), JSON sanitization of non-serializable objects.
- **Concurrency**: `--threads` for LAN host-level parallelism (single-target stays sequential for stability).
- **Fixed**: `list` command shadowing builtin `list()` causing `isinstance(x, list)` crashes.
- **SSH brute `all` mode**: LAN sweep with CIDR, skip lists, embedded wordlists.

## Exploit Confidence Levels
| Level | Meaning |
|-------|---------|
| `confirmed` | Marker-based proof of code execution (e.g., F5 iControl, ManageEngine). |
| `likely` | Strong fingerprint match (e.g., version banner, endpoint reachable). |
| `unknown` | Heuristic only (e.g., xz backdoor via SSH banner). |

## Example: Full LAN Sweep with HTML Report
```bash
plunger pl all --network 10.0.0.0/16 \
    --threads 16 \
    --skip-me --skip-router \
    --report lan-report.html \
    --report-format html
```

## Ethics & Legal
This tool is provided **solely for authorized security testing, research, and education**. The authors assume **no liability** for misuse. Always obtain written permission before scanning or exploiting any system.

## License
MIT â€” see `LICENSE`.
