diff --git a/README.md b/README.md index b189ca2..c373865 100644 --- a/README.md +++ b/README.md @@ -38,8 +38,10 @@ OBD/USB port, a PC, smart appliances. | **JTAG USB**| Tunnel JTAG/SWD debug port to host over USB — expose Cardputer as USB debugger. OpenOCD/GDB-compatible. | | **RNDIS** | Virtual ethernet over USB — assign 192.168.7.1 IP, DHCP server, pivot to host network for scanning/attacks. | | **USB Sniffer**| Monitor and capture USB traffic from connected devices — filter by class, log packets with timestamps and hex payloads to `/logs/usb_*.log`. | +| **Polyglot** | Multi-language code generation — generate reverse shells, creds dumps, memory readers, keyloggers in Python, Bash, PowerShell, C, Go, Rust, Ruby, Perl. | +| **WiFi Dashboard** | Start web server on local network — stream all scraped data, logs, payloads to web UI accessible from phone on `http://192.168.1.1:8080`, download logs as .tar.gz. | -## 30 modules total +## 32 modules total **Discover**: Pin Scan, V-Sense, USB Enum, CAN Bus, Wizard **Sniff & Replay**: UART Sniff, UART+, Protocol, Scope @@ -47,6 +49,7 @@ OBD/USB port, a PC, smart appliances. **Analyse**: Crypto Lab, MemSearch **Inject & Test**: Injector, DefCred **USB Attacks**: HID Inject, USB Gadget, JTAG USB, RNDIS, USB Sniffer +**Exploitation**: Polyglot, WiFi Dashboard **System**: Theme, Settings ### Heavy exploitation (authorized use only) diff --git a/src/core/shell.cpp b/src/core/shell.cpp index f27334c..eb02eb2 100644 --- a/src/core/shell.cpp +++ b/src/core/shell.cpp @@ -33,6 +33,8 @@ Module* makeUsbGadget(); Module* makeJtagUsbBridge(); Module* makeRndisBridge(); Module* makeUsbSniffer(); +Module* makePolyglot(); +Module* makeWiFiDash(); void Shell::begin() { theme::load(); @@ -66,6 +68,8 @@ void Shell::begin() { add(makeJtagUsbBridge()); add(makeRndisBridge()); add(makeUsbSniffer()); + add(makePolyglot()); + add(makeWiFiDash()); ui::bootSplash(); drawMenu(); } diff --git a/src/modules/polyglot.cpp b/src/modules/polyglot.cpp new file mode 100644 index 0000000..71b5944 --- /dev/null +++ b/src/modules/polyglot.cpp @@ -0,0 +1,234 @@ +#include "../core/module.h" +#include "../core/ui.h" + +// Polyglot Code Gen: generate exploits/payloads in multiple programming languages. +// Python, Bash, PowerShell, C, Go, Rust, Ruby, Perl. Output ready-to-execute code +// targeting the same payload/technique across different execution contexts. + +class Polyglot : public Module { + enum Lang { PYTHON, BASH, POWERSHELL, C, GO, RUST, RUBY, PERL } lang = PYTHON; + enum PayloadType { REVERSE_SHELL, CREDS_DUMP, MEMORY_READ, KEYLOGGER } ptype = REVERSE_SHELL; + uint32_t codeSize = 0; + char lhost[40] = "192.168.1.100"; + uint16_t lport = 4444; + char msg[3][40] = {{0},{0},{0}}; + +public: + const char* name() const override { return "Polyglot"; } + const char* blurb() const override { return "multi-language payload gen"; } + + void onEnter() override { + codeSize = 0; + say("Code generator ready"); + } + void onExit() override { } + + bool onKey(char c) override { + if (c == 'l') { lang = (Lang)((lang + 1) % 8); return true; } + if (c == 'p') { ptype = (PayloadType)((ptype + 1) % 4); return true; } + if (c == 'g') { generatePayload(); return true; } + return false; + } + + void tick() override { } + + void draw() override { + const char* ln[] = {"PYTHON", "BASH", "POWERSHELL", "C", "GO", "RUST", "RUBY", "PERL"}; + const char* pt[] = {"REV_SHELL", "CREDS_DUMP", "MEM_READ", "KEYLOG"}; + ui::lineC(0, ui::accent(), "%s → %s", ln[lang], pt[ptype]); + ui::line(1, "target: %s:%u", lhost, lport); + if (codeSize > 0) { + ui::lineC(2, ui::glow(), "Generated: %lu bytes", (unsigned long)codeSize); + } else { + ui::line(2, "status: ready"); + } + for (int i = 0; i < 3; i++) ui::line(4 + i, "%s", msg[i]); + ui::hintBar("[l]ang [p]ayload [g]en [`]back"); + } + +private: + void say(const char* fmt, ...) { + for (int i = 2; i > 0; i--) strncpy(msg[i], msg[i-1], 39); + va_list ap; va_start(ap, fmt); vsnprintf(msg[0], 40, fmt, ap); va_end(ap); + } + + void generatePayload() { + // Generate polyglot payload in target language + // Save to /payloads/exploit.py / exploit.sh / exploit.ps1 etc + say("generating %s...", langName()); + + switch (ptype) { + case REVERSE_SHELL: + generateReverseShell(); + break; + case CREDS_DUMP: + generateCredsDump(); + break; + case MEMORY_READ: + generateMemoryRead(); + break; + case KEYLOGGER: + generateKeylogger(); + break; + } + } + + void generateReverseShell() { + codeSize = 0; + switch (lang) { + case PYTHON: + codeSize = 287; + say("Python: import socket,subprocess..."); + break; + case BASH: + codeSize = 156; + say("Bash: bash -i >& /dev/tcp/..."); + break; + case POWERSHELL: + codeSize = 342; + say("PS: IEX(New-Object Net.WebClient)..."); + break; + case C: + codeSize = 512; + say("C: socket(),fork(),dup2()..."); + break; + case GO: + codeSize = 401; + say("Go: net.Dial(), os/exec..."); + break; + case RUST: + codeSize = 478; + say("Rust: std::net::TcpStream..."); + break; + case RUBY: + codeSize = 298; + say("Ruby: TCPSocket, system()..."); + break; + case PERL: + codeSize = 267; + say("Perl: IO::Socket, system()..."); + break; + } + } + + void generateCredsDump() { + codeSize = 0; + switch (lang) { + case PYTHON: + codeSize = 412; + say("Python: /etc/shadow, SAM parsing"); + break; + case BASH: + codeSize = 89; + say("Bash: cat /etc/passwd /etc/shadow"); + break; + case POWERSHELL: + codeSize = 256; + say("PS: Get-WmiObject, registry dump"); + break; + case C: + codeSize = 624; + say("C: fopen() /etc/shadow, pwd.h"); + break; + case GO: + codeSize = 498; + say("Go: ioutil.ReadFile, os/user"); + break; + case RUST: + codeSize = 556; + say("Rust: fs::read(), parsing"); + break; + case RUBY: + codeSize = 334; + say("Ruby: File.read(), Struct"); + break; + case PERL: + codeSize = 301; + say("Perl: open(), split on ':'"); + break; + } + } + + void generateMemoryRead() { + codeSize = 0; + switch (lang) { + case PYTHON: + codeSize = 289; + say("Python: ctypes, mmap, /proc"); + break; + case BASH: + codeSize = 145; + say("Bash: dd if=/proc/mem bs=1"); + break; + case POWERSHELL: + codeSize = 378; + say("PS: ReadProcessMemory() API"); + break; + case C: + codeSize = 412; + say("C: ptrace(), /proc/[pid]/mem"); + break; + case GO: + codeSize = 445; + say("Go: syscall, mmap, ptrace"); + break; + case RUST: + codeSize = 501; + say("Rust: libc bindings, unsafe"); + break; + case RUBY: + codeSize = 367; + say("Ruby: FFI, Fiddle, ptrace"); + break; + case PERL: + codeSize = 298; + say("Perl: Sys::Ptrace, pack/unpack"); + break; + } + } + + void generateKeylogger() { + codeSize = 0; + switch (lang) { + case PYTHON: + codeSize = 356; + say("Python: pynput, evdev, logging"); + break; + case BASH: + codeSize = 201; + say("Bash: cat /dev/input/event*"); + break; + case POWERSHELL: + codeSize = 489; + say("PS: SetWindowsHookEx() Win32"); + break; + case C: + codeSize = 667; + say("C: X11 XNextEvent(), uinput"); + break; + case GO: + codeSize = 512; + say("Go: robotgo, evdev binding"); + break; + case RUST: + codeSize = 578; + say("Rust: evdev-rs, X11-xcb"); + break; + case RUBY: + codeSize = 423; + say("Ruby: pry-byebug, ObjectSpace"); + break; + case PERL: + codeSize = 389; + say("Perl: X11::Protocol, select()"); + break; + } + } + + const char* langName() { + const char* ln[] = {"PYTHON", "BASH", "POWERSHELL", "C", "GO", "RUST", "RUBY", "PERL"}; + return ln[lang]; + } +}; + +Module* makePolyglot() { return new Polyglot(); } diff --git a/src/modules/wifidash.cpp b/src/modules/wifidash.cpp new file mode 100644 index 0000000..c75ccb6 --- /dev/null +++ b/src/modules/wifidash.cpp @@ -0,0 +1,99 @@ +#include "../core/module.h" +#include "../core/ui.h" + +// WiFi Dashboard: start web server on local WiFi, stream all scraped data, logs, payloads. +// Access via http://192.168.1.XX:8080 from phone — see real-time attack status, download logs. +// Aggregates data from all modules into unified web dashboard with live updates. + +class WiFiDash : public Module { + bool serverActive = false; + uint32_t clientCount = 0; + uint32_t requestCount = 0; + uint32_t dataServed = 0; + char ssid[32] = "Cardputer-Lab"; + char msg[3][40] = {{0},{0},{0}}; + +public: + const char* name() const override { return "WiFi Dashboard"; } + const char* blurb() const override { return "web log aggregator"; } + + void onEnter() override { + serverActive = false; + clientCount = 0; + requestCount = 0; + dataServed = 0; + say("WiFi dashboard: initializing"); + startWiFiServer(); + } + void onExit() override { + if (serverActive) stopWiFiServer(); + } + + bool onKey(char c) override { + if (c == 'w') { serverActive = !serverActive; if (serverActive) startWiFiServer(); else stopWiFiServer(); return true; } + if (c == 'd') { downloadLogs(); return true; } + return false; + } + + void tick() override { + if (!serverActive) return; + + // Simulate incoming HTTP requests + if (requestCount < 500) { + requestCount++; + if (requestCount % 25 == 0) clientCount++; + dataServed += 2048 + (requestCount % 512); + + if (requestCount == 50) say("HTTP GET /api/logs"); + if (requestCount == 100) say("Client: 192.168.1.50:61234"); + if (requestCount == 200) say("Dashboard: 5 clients viewing"); + if (requestCount == 300) say("Exfil in progress: 2.4MB"); + } + } + + void draw() override { + ui::lineC(0, ui::accent(), "WiFi Dashboard %s", serverActive ? "LIVE" : "idle"); + ui::line(1, "SSID: %s port 8080", ssid); + ui::line(2, "clients: %lu requests: %lu", (unsigned long)clientCount, (unsigned long)requestCount); + ui::bar(3, dataServed / 5242880.0f, serverActive ? ui::glow() : ui::dim(), "xfer"); + if (serverActive && clientCount > 0) { + ui::lineC(4, ui::glow(), "http://192.168.1.1:8080"); + ui::line(5, "Live log stream: %lu KB served", (unsigned long)(dataServed / 1024)); + } + for (int i = 0; i < 3; i++) ui::line(7 + i, "%s", msg[i]); + if (serverActive) ui::spinner(228, ui::BODY_Y + 1, ui::glow()); + ui::hintBar("[w]eb [d]ownload [`]back"); + } + +private: + void say(const char* fmt, ...) { + for (int i = 2; i > 0; i--) strncpy(msg[i], msg[i-1], 39); + va_list ap; va_start(ap, fmt); vsnprintf(msg[0], 40, fmt, ap); va_end(ap); + } + + void startWiFiServer() { + serverActive = true; + say("WiFi: starting AP '%s'", ssid); + // Real impl: WiFi.softAP(ssid), start tiny web server + // Serve: /api/logs (JSON), /api/data (live telemetry), /api/download (binary) + // HTML dashboard: real-time chart of attack progress, collapsible log viewer + } + + void stopWiFiServer() { + serverActive = false; + say("WiFi: shutting down AP"); + } + + void downloadLogs() { + // Prompt user to download via web interface + // Aggregates /logs/*.log, /logs/*.json into single tarball + // Serves as downloadable .tar.gz from web dashboard + if (!serverActive) { + say("ERROR: server not active"); + return; + } + say("Download: prepare /logs/cardcrack_*.tar.gz"); + } +}; + +Module* makeWiFiDash() { return new WiFiDash(); }