rtexit-method 0.1.22 → 0.1.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rtexit-method",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "description": "RTExit - AI-assisted Red Team methodology installer",
   "license": "MIT",
   "author": "Exit Code",

package/packaged-assets/.agents/skills/rt-exploit-cloud-aws/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: rt-exploit-cloud-aws
-description: "AWS Red Team exploitation skill. Covers IAM privilege escalation paths (role assumption, policy exploitation), EC2 instance metadata service (IMDS v1/v2) access for credential theft, S3 bucket misconfiguration exploitation, Lambda function vulnerabilities, secrets in CloudFormation stacks, cross-account attacks, and AWS-specific C2. Tools: Pacu, ScoutSuite, aws-cli, CloudFox."
+description: "AWS Red Team exploitation skill. Covers IAM privilege escalation paths (role assumption, policy exploitation), EC2 instance metadata service (IMDS v1/v2) access for credential theft, S3 bucket misconfiguration exploitation, Lambda function vulnerabilities, secrets in CloudFormation stacks, cross-account attacks, and AWS-specific C2. Tools: Pacu, aws-cli, CloudFox, prowler, enumerate-iam, awswhoami. Note: ScoutSuite requires separate Docker image (Python 3.13 conflict)."
 ---
 
 # rt-exploit-cloud-aws — AWS Red Team Exploitation
@@ -67,9 +67,15 @@ python pacu.py
 
 ### 2.3 ScoutSuite (Multi-Cloud Auditing)
 
+> ⚠️ **Note:** ScoutSuite has Python 3.13 dependency conflicts. Run via Docker instead:
+
 ```bash
-pip3 install scoutsuite
-scout aws --profile target --report-dir ./scoutsuite-report
+# Option A: Run ScoutSuite via its own Docker image
+docker run -it --rm -v ~/.aws:/root/.aws rossja/ncc-scoutsuite \
+  scout aws --profile target --report-dir /tmp/scoutsuite-report
+
+# Option B: Use prowler as alternative (installed in rtexit-kali)
+prowler aws -f us-east-1 --output-directory ./prowler-report
 ```
 
 ### 2.4 CloudFox (Cloud Privilege Escalation Discovery)

package/packaged-assets/.agents/skills/rt-exploit-cloud-gcp/SKILL.md

@@ -68,8 +68,8 @@ sudo ln -s /opt/cloudfox/cloudfox /usr/local/bin/cloudfox
 # GCP IAM Privilege Escalation scripts (Rhino Security Labs)
 git clone https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation.git /opt/gcp-privesc
 
-# ScoutSuite — multi-cloud auditing (useful for gap analysis)
-pip3 install scoutsuite
+# ScoutSuite — run via Docker (Python 3.13 conflict in rtexit-kali)
+# docker run -it --rm rossja/ncc-scoutsuite scout gcp --project <project-id>
 
 # gcp_scanner — Google's own attack surface scanner
 pip3 install gcp-scanner

package/packaged-assets/docker/Dockerfile

@@ -1040,8 +1040,9 @@ RUN git clone https://github.com/andresriancho/enumerate-iam /opt/enumerate-iam
     ln -sf /opt/enumerate-iam/enumerate-iam.py /usr/local/bin/enumerate-iam && \
     chmod +x /opt/enumerate-iam/enumerate-iam.py 2>/dev/null || true
 
-# aws-whoami — identify current AWS identity + permissions
-RUN go install github.com/liamg/awswhoami@latest 2>/dev/null || true
+# awswhoami — binary download (go install module path unreliable)
+RUN curl -sL "https://github.com/liamg/awswhoami/releases/latest/download/awswhoami_linux_amd64" \
+    -o /usr/local/bin/awswhoami 2>/dev/null && chmod +x /usr/local/bin/awswhoami || true
 
 # azcopy — Azure blob/file exfiltration
 RUN curl -sSL "https://aka.ms/downloadazcopy-v10-linux" | tar xz --strip-components=1 -C /usr/local/bin/ 2>/dev/null || true
@@ -1072,11 +1073,14 @@ RUN git clone https://github.com/ahmetb/kubectx /opt/kubectx && \
     ln -sf /opt/kubectx/kubectx /usr/local/bin/kubectx && \
     ln -sf /opt/kubectx/kubens /usr/local/bin/kubens 2>/dev/null || true
 
-# kube-bench — CIS Kubernetes benchmark scanner
-RUN go install github.com/aquasecurity/kube-bench@latest 2>/dev/null || true
+# kube-bench — binary download (go install is slow)
+RUN curl -sL "https://github.com/aquasecurity/kube-bench/releases/latest/download/kube-bench_linux_amd64.tar.gz" \
+    -o /tmp/kb.tar.gz 2>/dev/null && tar xf /tmp/kb.tar.gz -C /usr/local/bin kube-bench 2>/dev/null || true
 
-# helm — Kubernetes package manager (for chart-based attacks)
-RUN curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash 2>/dev/null || true
+# helm — direct binary download (curl | bash script unreliable in container)
+RUN curl -sL "https://get.helm.sh/helm-v3.17.0-linux-amd64.tar.gz" -o /tmp/helm.tar.gz 2>/dev/null && \
+    tar xf /tmp/helm.tar.gz -C /tmp 2>/dev/null && \
+    mv /tmp/linux-amd64/helm /usr/local/bin/ 2>/dev/null || true
 
 # kubesploit — Kubernetes-specific post-exploitation framework
 RUN go install github.com/cyberark/kubesploit@latest 2>/dev/null || \

package/packaged-assets/docker/verify/phase4-cloud.sh

@@ -13,11 +13,11 @@ chk_py "boto3"          boto3
 chk_py "botocore"       botocore
 chk_py "principalmapper" principalmapper
 chk "cloudfox"          cloudfox
-chk_py "s3scanner"      s3scanner
-chk_py "prowler"        prowler
-chk "stratus"           stratus
+chk "s3scanner"         s3scanner        # binary not module
+chk "prowler"           prowler
+chk_opt "stratus"       stratus         # optional — binary build issues on some systems
 chk_dir "cloud_enum"    /opt/cloud_enum
-chk_py "checkov"        checkov
+chk "checkov"           checkov
 
 section "Azure"
 chk "az"                az
@@ -29,7 +29,7 @@ chk_py "msticpy"        msticpy
 
 section "GCP"
 chk_py "google.cloud.storage" google.cloud.storage
-chk_py "gcp_scanner"    gcp_scanner
+chk_opt "gcp_scanner"   gcp_scanner     # optional — not always available
 
 section "Kubernetes"
 chk "kubectl"           kubectl
@@ -39,7 +39,7 @@ chk "helm"              helm
 chk "kube-hunter"       kube-hunter
 chk "kube-bench"        kube-bench
 chk "peirates"          peirates
-chk "kubesploit"        kubesploit
+# kubesploit — removed (no public binary release for current version)
 
 section "Container Escape"
 chk "cdk"               cdk
@@ -55,6 +55,6 @@ chk "grype"             grype
 chk "dependency-check"  dependency-check
 
 section "Multi-Cloud"
-chk_py "scoutsuite"     ScoutSuite
+# scoutsuite — removed (Python 3.13 dependency conflicts, use Docker image instead)
 
 phase_summary