Upload files to "/"

2026-07-18 21:39:48 +00:00
parent 021af540b6
commit 0115df928d
5 changed files with 1363 additions and 2 deletions
@@ -1,3 +1,163 @@
-# Flock_SCAN
+<p align="center">
+  <img src="https://img.shields.io/badge/Flock_Scan-v2.0-red?style=flat-square&logo=appveyor" />
+  <img src="https://img.shields.io/badge/CVEs-4-brightgreen?style=flat-square" />
+  <img src="https://img.shields.io/badge/license-MIT-blue?style=flat-square" />
+</p>

-scan and exploit
+```
+███████╗██╗     ██████╗  ██████╗██╗  ██╗     ███████╗ ██████╗ █████╗ ███╗   ██╗
+██╔════╝██║    ██╔═══██╗██╔════╝██║ ██╔╝     ██╔════╝██╔════╝██╔══██╗████╗  ██║
+█████╗  ██║    ██║   ██║██║     █████╔╝      ███████╗██║     ███████║██╔██╗ ██║
+██╔══╝  ██║    ██║   ██║██║     ██╔═██╗      ╚════██║██║     ██╔══██║██║╚██╗██║
+██║     ███████╗╚██████╔╝██████╗██║  ██╗     ███████║╚██████╗██║  ██║██║ ╚████║
+╚═╝     ╚══════╝ ╚═════╝ ╚═════╝╚═╝  ╚═╝     ╚══════╝ ╚═════╝╚═╝  ╚═╝╚═╝  ╚═══╝
+```
+
+Multi-mode Flock Safety security assessment tool.
+
+---
+
+## Capabilities
+
+### CVE Scanning (v1)
+| CVE | Score | Description |
+|-----|-------|-------------|
+| **CVE-2025-59403** | 9.8   | Unauthenticated admin API / ADB RCE |
+| **CVE-2025-59407** | CRIT  | Hardcoded keystore crypto key |
+| **CVE-2025-47818** | HIGH  | Hardcoded fallback hotspot credentials |
+| **CVE-2025-47823** | HIGH  | Hardcoded system password on ALPR firmware |
+
+### Flock Instance Discovery (v2 — NEW)
+Scans any subnet for all known Flock camera fingerprints.
+
+| Fingerprint | Port | Detection |
+|-------------|------|-----------|
+| **ADB shell** | 5555 | `getprop ro.product.model` → Flock/Falcon/Sparrow |
+| **Admin web UI** | 80/443 | GainSec's `admin_page_template.html` in HTTP body |
+| **ONVIF device** | 80/443/8899 | SOAP `GetDeviceInformation` → manufacturer string |
+| **SpeedPourer** | 21 | FTP banner / admin page references |
+| **FRP tunnel** | 7000-7500 | Fast Reverse Proxy banner grab |
+| **Cloud DNS** | — | Admin UI contains `*.flocksafety.com` URLs |
+| **All 4 CVEs** | — | Per-host exploit checks run automatically |
+
+### Traffic Analysis (v2 — NEW)
+Determines if a Flock camera sends data to **the cloud** or a **local station**.
+
+```
+CLOUD            →  Sends data to api.flocksafety.com / Flock infrastructure
+LOCAL_STATION    →  Data stays on-prem (no cloud contact detected)
+INDETERMINATE   →  Unable to determine (camera may be offline)
+```
+
+Detection methods:
+- **DNS resolution** of `api.flocksafety.com` and other Flock domains
+- **Admin UI inspection** — `/metadata`, `/config` endpoints checked for cloud URLs vs internal IPs
+- **FRP tunnel detection** — Reverse Proxy tunnel on ports 7000/7500
+- **ADB network config** — reads gateway and DNS from camera shell
+
+---
+
+##  Quick Start
+
+```bash
+pip install requests
+python3 scanner.py
+```
+
+### CVE Scanning
+```bash
+# Single target
+python3 scanner.py -t 192.168.1.100
+
+# From file
+python3 scanner.py -f targets.txt --exploit
+
+# Save results
+python3 scanner.py --output results.json -v
+```
+
+### Instance Discovery
+```bash
+# Scan a /24 subnet
+python3 scanner.py --discover 192.168.1.0/24
+
+# Scan a /16, save findings
+python3 scanner.py --discover 10.0.0.0/16 --output found.json
+```
+
+### Traffic Analysis
+```bash
+# Check if a camera phones home
+python3 scanner.py --analyze-traffic 192.168.1.100
+
+# Save flow analysis
+python3 scanner.py --analyze-traffic 10.0.0.50 --output flow.json
+```
+
+---
+
+##  Interactive Menu
+
+```bash
+python3 scanner.py
+```
+
+```
+┌─────────────────────────────────────────┐
+│           SELECT INPUT METHOD           │
+├─────────────────────────────────────────┤
+│  1.  Single IP                          │
+│  2.  IP Range (CIDR)                    │
+│  3.  From File                          │
+│  4.  Shodan Query                       │
+│  5.  Falcon/Sparrow Signatures          │
+│                                         │
+│  ═══ NEW ═══                            │
+│  6.  Flock Instance Discovery           │
+│  7.  Traffic Analysis                   │
+│                                         │
+│  8.  Return                             │
+└─────────────────────────────────────────┘
+```
+
+---
+
+##  Shodan Queries
+
+```bash
+python3 shodan_queries.py
+```
+
+Includes dedicated `FLOCK_DISCOVERY` queries:
+
+| Query | Finds |
+|-------|-------|
+| `title:"admin_page_template"` | Flock admin portals |
+| `"/onvif/device_service" Flock` | ONVIF-capable Flock devices |
+| `"SpeedPourer" port:21` | Speed test FTP servers |
+| `"FRP" "flock" port:7000` | Reverse proxy tunnels |
+| `ssl.cert.subject.cn:"*.flocksafety.com"` | Flock TLS certificates |
+| `org:"Flock Safety"` | All Flock-owned infrastructure |
+
+---
+
+## Safety
+
+- **Exploitation disabled by default** — requires explicit `--exploit` flag
+- **Rate-limited threads** — default 10, configurable with `-T`
+- **Discovery mode is passive** — only sends probe/identification packets
+- **User confirmation** required before any exploit execution
+
+```bash
+# Scan only (no exploitation)
+python3 scanner.py -t 192.168.1.100
+
+# Scan + exploit (requires confirmation)
+python3 scanner.py -t 192.168.1.100 --exploit
+```
+
+
+
+<p align="center">
+  <sub>Authorized security testing only. Use on systems you own or have written permission to test.</sub>
+</p>
@@ -0,0 +1,18 @@
+#!/bin/bash
+# masscan_wrapper.sh - Use masscan to find targets
+
+echo "CVE-2025 Masscan Wrapper"
+echo "========================"
+
+# Common ports for vulnerable services
+PORTS="80,443,5555,5037,8080,8443,9000,8443"
+
+echo "Running masscan for ports: $PORTS"
+sudo masscan -p$PORTS --rate=1000 -oJ masscan_results.json 0.0.0.0/0
+
+echo "Extracting IPs..."
+cat masscan_results.json | jq -r '.[] | .ip' > targets.txt
+
+echo "Found $(wc -l < targets.txt) targets"
+echo "Now scanning targets with CVE scanner..."
+python3 cve_scanner.py -f targets.txt -o results.json
@@ -0,0 +1,34 @@
+#!/bin/bash
+# Run scanner with proper Shodan queries
+
+echo "CVE-2025 Scanner with Shodan Integration"
+echo "========================================"
+echo ""
+
+# Generate queries
+echo "Generating Shodan queries..."
+python3 shodan_queries.py
+
+echo ""
+echo "Select option:"
+echo "1. Run scanner with Shodan auto-query"
+echo "2. Run scanner with manual IP"
+echo "3. Run scanner with file"
+
+read -p "Choice (1-3): " choice
+
+case $choice in
+    1)
+        echo "Running scanner with Shodan..."
+        # Use the scanner with a specific query
+        python3 scanner.py -v
+        ;;
+    2)
+        read -p "Enter IP: " ip
+        python3 scanner.py -t $ip --exploit
+        ;;
+    3)
+        read -p "Enter file: " file
+        python3 scanner.py -f $file
+        ;;
+esac
@@ -0,0 +1,80 @@
+#!/usr/bin/env python3
+"""
+shodan_queries.py - Generate Shodan queries for CVE-2025 vulnerabilities + Discovery
+"""
+
+QUERIES = {
+    'CVE-2025-59403': [
+        'title:"Falcon"',
+        'title:"Sparrow"',
+        '"/api/v1/admin"',
+        '"/api/v1/system"',
+        '"/api/v1/debug"',
+        'port:5555 "Android"',
+        '"Android Debug Bridge"',
+        'port:5037 adb',
+        'http.title:"ADB"',
+        '"Falcon" "api" port:443',
+        '"Sparrow" "api" port:443',
+        '"/api/v1/execute"',
+        '"/api/v1/command"',
+    ],
+    'CVE-2025-59407': [
+        '"Android" "v6.35.33"',
+        '"keystore" "hardcoded"',
+        '"crypto" "key" "Android"',
+        '"/api/v1/keystore"',
+        '"/api/v1/security"',
+        '"hardcoded_key"',
+        '"default_key"',
+    ],
+    'CVE-2025-47818': [
+        '"hotspot" "fallback"',
+        '"/api/v1/hotspot"',
+        '"default" "hotspot" "credentials"',
+        '"/api/v1/wifi"',
+        '"hotspot" "config"',
+        '"wifi" "credentials"',
+    ],
+    'CVE-2025-47823': [
+        '"ALPR" "v2.0"',
+        '"ALPR" "v2.1"',
+        '"ALPR" "v2.2"',
+        '"/api/v1/alpr"',
+        '"license plate" "system"',
+        '"LPR" "firmware"',
+        '"ALPR" "firmware"',
+        '"/alpr" "/api"',
+    ],
+    'FLOCK_DISCOVERY': [
+        'title:"admin_page_template"',
+        '"admin_page_template.html"',
+        '"/onvif/device_service" Flock',
+        '"SpeedPourer" port:21',
+        '"FRP" "flock" port:7000',
+        '"M5NanoC6" "flock"',
+        '"flock" "ADB" port:5555',
+        'ssl.cert.subject.cn:"*.flocksafety.com"',
+        'ssl.cert.subject.cn:"*.ops.flocksafety.com"',
+        'org:"Flock Safety"',
+        '"flock-hibiki"',
+    ],
+}
+
+def generate_shodan_queries():
+    """Generate combined Shodan queries"""
+    print("# CVE-2025 Vulnerability + Discovery Shodan Queries")
+    print("# ==================================================")
+    print()
+    for cve, queries in QUERIES.items():
+        print(f"# {cve}")
+        print(" OR ".join(queries))
+        print()
+    all_q = []
+    for qs in QUERIES.values():
+        all_q.extend(qs)
+    print("# ALL Queries Combined")
+    print(" OR ".join(all_q))
+
+if __name__ == "__main__":
+    generate_shodan_queries()