PLUNGER Framework

Industrial-Grade Exploit Framework for Security Research

WARNING: For EDUCATIONAL AND RESEARCH PURPOSES ONLY. Use only against targets you own or have explicit written authorization to test. Unauthorized access to computer systems is illegal.

Features

• 39 weaponized exploits for high-impact CVEs (2018–2026).
• Automated LAN reconnaissance & exploitation (plunge, pl).
• SSH brute-force with LAN sweep mode (sshbrute).
• Interactive RCE shell for confirmed exploits.
• SSH server payload generation (ssh make) for authorized persistence testing.
• LAN SSH server discovery (ssh start) - scan LAN for deployed SSH servers.
• Interactive SSH client (ssh connect) with root:root defaults.
• Multi-format reports (JSON, HTML) with --report-format.
• Concurrent LAN scanning with --threads.
• Evasion helpers: sandbox detection, payload markers, command verification.
• Strict ethics: explicit confirmation per exploit, local-only guard.

Installation

pip install plungerhacker
# or from source
pip install -e .

Quick Start

plunger scan 192.168.1.10          # Port + tech fingerprint
plunger list                        # Show all 39 CVEs
plunger exploit CVE-2022-1388 http://target  # Single exploit
plunger plunge 192.168.1.10         # Full chain on one host
plunger pl all --network 192.168.1.0/24 --threads 8 --report report.html
plunger sshbrute all --network 192.168.1.0/24 --report ssh.json
plunger ssh make server.py               # Generate SSH server payload
plunger ssh make server.exe --exe         # Compile to windowless EXE
plunger ssh start                         # Scan LAN + connect to servers
plunger ssh connect 192.168.1.50          # Direct SSH connection

Commands

New in 1.1.0

• 10 new CVE modules: CVE-2023-34362 (MOVEit), CVE-2023-4966 (Citrix Bleed), CVE-2021-21972 (vCenter), CVE-2019-0708 (BlueKeep), CVE-2022-1388 (F5 iControl), CVE-2020-5902 (F5 TMUI), CVE-2023-27997 (Fortinet SSL-VPN), CVE-2021-40539 (ManageEngine), CVE-2022-22965 (Spring4Shell), CVE-2024-3094 (xz backdoor).
• Base exploit hardening: severity/cvss/confidence fields, _http(), _make_markers(), _extract_bracketed(), _verify_command(), error-page detection.
• Reporting: HTML reports (--report-format html), JSON sanitization of non-serializable objects.
• Concurrency: --threads for LAN host-level parallelism (single-target stays sequential for stability).
• Fixed: list command shadowing builtin list() causing isinstance(x, list) crashes.
• SSH brute all mode: LAN sweep with CIDR, skip lists, embedded wordlists.

Exploit Confidence Levels

Example: Full LAN Sweep with HTML Report

plunger pl all --network 10.0.0.0/16 \
    --threads 16 \
    --skip-me --skip-router \
    --report lan-report.html \
    --report-format html

Ethics & Legal

This tool is provided solely for authorized security testing, research, and education. The authors assume no liability for misuse. Always obtain written permission before scanning or exploiting any system.

License

MIT — see LICENSE.