plungerhacker 1.2.6

Industrial-Grade Exploit Framework for Security Research

PLUNGER Framework

Industrial-Grade Exploit Framework for Security Research

WARNING: For EDUCATIONAL AND RESEARCH PURPOSES ONLY. Use only against targets you own or have explicit written authorization to test. Unauthorized access to computer systems is illegal.

Features

• 39 weaponized exploits for high-impact CVEs (2018–2026).
• Automated LAN reconnaissance & exploitation (plunge, pl).
• SSH brute-force with LAN sweep mode (sshbrute).
• Interactive RCE shell for confirmed exploits.
• SSH server payload generation (ssh make) for authorized persistence testing.
• LAN SSH server discovery (ssh start) - scan LAN for deployed SSH servers.
• Interactive SSH client (ssh connect) with root:root defaults.
• Multi-format reports (JSON, HTML) with --report-format.
• Concurrent LAN scanning with --threads.
• Evasion helpers: sandbox detection, payload markers, command verification.
• Strict ethics: explicit confirmation per exploit, local-only guard.

Installation

pip install plungerhacker
# or from source
pip install -e .

Quick Start

plunger scan 192.168.1.10          # Port + tech fingerprint
plunger list                        # Show all 39 CVEs
plunger exploit CVE-2022-1388 http://target  # Single exploit
plunger plunge 192.168.1.10         # Full chain on one host
plunger pl all --network 192.168.1.0/24 --threads 8 --report report.html
plunger sshbrute all --network 192.168.1.0/24 --report ssh.json
plunger ssh make server.py               # Generate SSH server payload
plunger ssh make server.exe --exe         # Compile to windowless EXE
plunger ssh start                         # Scan LAN + connect to servers
plunger ssh connect 192.168.1.50          # Direct SSH connection

Commands

Command	Description
scan <target>	Fast port scan + web tech detection.
list	List all available exploits with metadata.
exploit <CVE> <target> [--force] [--cmd CMD] [--shell] [--report FILE] [--report-format json|html]	Run single exploit; --shell drops into interactive RCE shell when confidence=confirmed.
plunge <target> [--force] [--first] [--fast] [--report FILE] [--report-format json|html] [--shell] [--threads N]	Run ALL applicable exploits against one host (sequential).
pl <target> [--network CIDR] [--skip HOSTS] [--skip-me] [--skip-router] [--first] [--fast] [--force] [--report FILE] [--report-format json|html] [--threads N]	LAN sweep: discover hosts, run all exploits per host (host-level parallelism via --threads).
sshbrute <target> [--user USER] [--wordlist FILE] [--threads N] [--timeout N] [--report FILE] [--report-format json|html]	Single-target SSH credential brute.
sshbrute all --network CIDR [--skip HOSTS] [--skip-me] [--skip-router] [--threads N] [--timeout N] [--report FILE]	LAN-wide SSH brute: discover hosts then brute each in parallel.
ssh make <file> [--port N] [--user USER] [--password PASS] [--exe] [--arch x64|x86]	Generate a standalone SSH server payload (root:root). Use --exe for windowless EXE.
ssh start [--network CIDR] [--port N] [--user USER] [--password PASS]	Scan LAN, find hosts running the SSH server, and connect (root:root).
ssh connect <target> [--user USER] [--password PASS] [--port N] [--command CMD]	Interactive SSH client (root:root defaults).

New in 1.1.0

• 10 new CVE modules: CVE-2023-34362 (MOVEit), CVE-2023-4966 (Citrix Bleed), CVE-2021-21972 (vCenter), CVE-2019-0708 (BlueKeep), CVE-2022-1388 (F5 iControl), CVE-2020-5902 (F5 TMUI), CVE-2023-27997 (Fortinet SSL-VPN), CVE-2021-40539 (ManageEngine), CVE-2022-22965 (Spring4Shell), CVE-2024-3094 (xz backdoor).
• Base exploit hardening: severity/cvss/confidence fields, _http(), _make_markers(), _extract_bracketed(), _verify_command(), error-page detection.
• Reporting: HTML reports (--report-format html), JSON sanitization of non-serializable objects.
• Concurrency: --threads for LAN host-level parallelism (single-target stays sequential for stability).
• Fixed: list command shadowing builtin list() causing isinstance(x, list) crashes.
• SSH brute all mode: LAN sweep with CIDR, skip lists, embedded wordlists.

Exploit Confidence Levels

Level	Meaning
confirmed	Marker-based proof of code execution (e.g., F5 iControl, ManageEngine).
likely	Strong fingerprint match (e.g., version banner, endpoint reachable).
unknown	Heuristic only (e.g., xz backdoor via SSH banner).

Example: Full LAN Sweep with HTML Report

plunger pl all --network 10.0.0.0/16 \
    --threads 16 \
    --skip-me --skip-router \
    --report lan-report.html \
    --report-format html

Ethics & Legal

This tool is provided solely for authorized security testing, research, and education. The authors assume no liability for misuse. Always obtain written permission before scanning or exploiting any system.

License

MIT — see LICENSE.