cloudxpl 4.2.0__py3-none-any.whl

cloudxpl/modules/virt/hyperv_enum.py

@@ -0,0 +1,40 @@
+"""CloudXPL-Forge module: Enumerate Hyper-V hosts, VMs, virtual switches via WMI/PowerShell"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.virt.hyperv_enum.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": ["api_calls"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1580"],
+}
+
+
+def run(args: Any) -> int:
+    """Execute Enumerate Hyper-V hosts, VMs, virtual switches via WMI/PowerShell."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific API calls
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0

cloudxpl/modules/virt/hyperv_escape.py

@@ -0,0 +1,40 @@
+"""CloudXPL-Forge module: Hyper-V guest-to-host escape techniques (CVE-2026-40402, UAF)"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.virt.hyperv_escape.v1",
+    "safety_class": "EXPLOIT",
+    "requires_authorization": True,
+    "side_effects": ["api_calls", "state_change"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1611"],
+}
+
+
+def run(args: Any) -> int:
+    """Execute Hyper-V guest-to-host escape techniques (CVE-2026-40402, UAF)."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific API calls
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0

cloudxpl/modules/virt/hyperv_remotefx.py

@@ -0,0 +1,40 @@
+"""CloudXPL-Forge module: Hyper-V RemoteFX vGPU RCE series (CVE-2020-1036/1040/1041/1042/1043, KEV)"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.virt.hyperv_remotefx.v1",
+    "safety_class": "EXPLOIT",
+    "requires_authorization": True,
+    "side_effects": ["api_calls", "state_change"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1611", "T1210"],
+}
+
+
+def run(args: Any) -> int:
+    """Detect Hyper-V RemoteFX vGPU RCE series. CVE-2020-1040 in KEV. CVSS 9.0."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific logic
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0

cloudxpl/modules/virt/hypervisor_resources_bridge.py

@@ -0,0 +1,41 @@
+"""CloudXPL-Forge — Hypervisor Resources Collection (Bridge)."""
+
+from __future__ import annotations
+
+MANIFEST: dict = {
+    "name": "Hypervisor Resources Collection (Bridge)",
+    "mitre": ["T1592"],
+    "description": "Bridge to husseinmuhaisen/Hypervisor — comprehensive hypervisor security resources and research.",
+    "references": ["https://github.com/husseinmuhaisen/Hypervisor"],
+}
+
+
+import os
+import subprocess
+import sys
+
+REPO = "husseinmuhaisen/Hypervisor"
+REPO_URL = f"https://github.com/{REPO}.git"
+
+
+def run(args):
+    clone_dir = os.path.join(getattr(args, "output", "."), REPO.split("/")[-1])
+    if os.path.isdir(clone_dir):
+        print(f"[*] Repository already cloned at {clone_dir}")
+    else:
+        print(f"[*] Cloning {REPO_URL} -> {clone_dir}")
+        ret = subprocess.call(["git", "clone", "--depth", "1", REPO_URL, clone_dir])
+        if ret != 0:
+            print(f"[!] Clone failed (rc={ret})", file=sys.stderr)
+            return ret
+    print(f"[+] Repository ready at {clone_dir}")
+    print("[*] Inspect contents before execution per security policy")
+    if getattr(args, "verbose", False):
+        for root, dirs, files in os.walk(clone_dir):
+            level = root.replace(clone_dir, "").count(os.sep)
+            indent = " " * 2 * level
+            print(f"{indent}{os.path.basename(root)}/")
+            subindent = " " * 2 * (level + 1)
+            for f in files[:20]:
+                print(f"{subindent}{f}")
+    return 0

cloudxpl/modules/virt/intel_tdx_enum.py

@@ -0,0 +1,29 @@
+"""CloudXPL-Forge — Intel TDX Attack Surface Scanner."""
+
+from __future__ import annotations
+
+MANIFEST: dict = {
+    "name": "Intel TDX Attack Surface Scanner",
+    "mitre": ["T1082"],
+    "description": "Enumerates Intel TDX deployment state, microcode version, SEAM module, and known attack surface.",
+    "references": [],
+}
+
+
+import sys
+
+
+def run(args):
+    target = getattr(args, "target", None)
+    verbose = getattr(args, "verbose", False)
+    output = getattr(args, "output", ".")
+
+    print(f"[*] {MANIFEST['name']}")
+    if not target:
+        print("[!] --target required", file=sys.stderr)
+        return 1
+
+    print(f"[*] Target: {target}")
+    # TODO: implement exploit/scanner logic
+    print("[!] Module stub — implement exploit logic")
+    return 0

cloudxpl/modules/virt/kata_cve_2026_24834.py

@@ -0,0 +1,30 @@
+"""CloudXPL-Forge — Kata Containers virtio-pmem/DAX Overwrite (CVE-2026-24834)."""
+
+from __future__ import annotations
+
+MANIFEST: dict = {
+    "name": "Kata Containers virtio-pmem/DAX Overwrite (CVE-2026-24834)",
+    "cve": "CVE-2026-24834",
+    "mitre": ["T1611"],
+    "description": "Exploits virtio-pmem/DAX mapping in Kata Containers to overwrite read-only guest rootfs binary. CVSS 9.3.",
+    "references": ["https://bex.co/blog/2026/07/29/kata-containers-cve-2026-24834-cloud-hypervisor-rce"],
+}
+
+
+import sys
+
+
+def run(args):
+    target = getattr(args, "target", None)
+    verbose = getattr(args, "verbose", False)
+    output = getattr(args, "output", ".")
+
+    print(f"[*] {MANIFEST['name']}")
+    if not target:
+        print("[!] --target required", file=sys.stderr)
+        return 1
+
+    print(f"[*] Target: {target}")
+    # TODO: implement exploit/scanner logic
+    print("[!] Module stub — implement exploit logic")
+    return 0

cloudxpl/modules/virt/kata_escape.py

@@ -0,0 +1,40 @@
+"""CloudXPL-Forge module: Kata Containers VM escape (CVE-2026-44210 virtiofsd arg injection, CVE-2026-47243 FUSE host-root)"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.virt.kata_escape.v1",
+    "safety_class": "EXPLOIT",
+    "requires_authorization": True,
+    "side_effects": ["api_calls", "state_change"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1611"],
+}
+
+
+def run(args: Any) -> int:
+    """Detect Kata Containers VM escape. CVE-2026-44210 (virtiofsd arg injection, source=/), CVE-2026-47243 (FUSE host-root via virtio-fs PCI)."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific logic
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0

cloudxpl/modules/virt/kvm_arm64_escape.py

@@ -0,0 +1,40 @@
+"""CloudXPL-Forge module: CVE-2026-89775 — KVM/arm64 guest-to-host escape"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.virt.kvm_arm64_escape.v1",
+    "safety_class": "EXPLOIT",
+    "requires_authorization": True,
+    "side_effects": ["api_calls", "state_change"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1611"],
+}
+
+
+def run(args: Any) -> int:
+    """Execute CVE-2026-89775 — KVM/arm64 guest-to-host escape."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific API calls
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0

cloudxpl/modules/virt/kvm_cve_2019_14835.py

@@ -0,0 +1,40 @@
+"""CloudXPL-Forge module: CVE-2019-14835 — KVM vhost_net buffer overflow guest-to-host"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.virt.kvm_cve_2019_14835.v1",
+    "safety_class": "EXPLOIT",
+    "requires_authorization": True,
+    "side_effects": ["api_calls", "state_change"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1611"],
+}
+
+
+def run(args: Any) -> int:
+    """Detect CVE-2019-14835 — KVM vhost_net buffer overflow during live migration. Guest-to-host escape."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific logic
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0

cloudxpl/modules/virt/kvm_cve_2019_18389.py

@@ -0,0 +1,40 @@
+"""CloudXPL-Forge module: CVE-2019-18389 — virglrenderer/virtio-gpu first full VM escape (3dRedPill)"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.virt.kvm_cve_2019_18389.v1",
+    "safety_class": "EXPLOIT",
+    "requires_authorization": True,
+    "side_effects": ["api_calls", "state_change"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1611"],
+}
+
+
+def run(args: Any) -> int:
+    """Detect CVE-2019-18389 — virglrenderer heap overflow. First full virtio-based VM escape (3dRedPill, Geekpwn)."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific logic
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0

cloudxpl/modules/virt/kvm_cve_2026_3842.py

@@ -0,0 +1,41 @@
+"""CloudXPL-Forge module: CVE-2026-3842 — QEMU/KVM Hyper-V debugger crash"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.virt.kvm_cve_2026_3842.v1",
+    "safety_class": "EXPLOIT",
+    "requires_authorization": True,
+    "side_effects": ["api_calls", "state_change"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ['T1499'],
+    "references": ["CVE-2026-3842"],
+}
+
+
+def run(args: Any) -> int:
+    """Execute CVE-2026-3842 — QEMU/KVM Hyper-V debugger crash."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific API calls
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0

cloudxpl/modules/virt/kvm_cve_2026_64561.py

@@ -0,0 +1,41 @@
+"""CloudXPL-Forge module: CVE-2026-64561 Zapscape — KVM AMD nested virtualization escape"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.virt.kvm_cve_2026_64561.v1",
+    "safety_class": "EXPLOIT",
+    "requires_authorization": True,
+    "side_effects": ["api_calls", "state_change"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ['T1611'],
+    "references": ["CVE-2026-64561"],
+}
+
+
+def run(args: Any) -> int:
+    """Execute CVE-2026-64561 Zapscape — KVM AMD nested virtualization escape."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific API calls
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0

cloudxpl/modules/virt/kvm_cve_2026_99999.py

@@ -0,0 +1,41 @@
+"""CloudXPL-Forge module: CVE-2026-99999 PwnEscape — Linux kernel net-stack VM escape (KVM)"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.virt.kvm_cve_2026_99999.v1",
+    "safety_class": "EXPLOIT",
+    "requires_authorization": True,
+    "side_effects": ["api_calls", "state_change"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ['T1611'],
+    "references": ["CVE-2026-99999"],
+}
+
+
+def run(args: Any) -> int:
+    """Execute CVE-2026-99999 PwnEscape — Linux kernel net-stack VM escape (KVM)."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific API calls
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0

cloudxpl/modules/virt/kvm_januscape.py

@@ -0,0 +1,40 @@
+"""CloudXPL-Forge module: CVE-2026-53359 Januscape — KVM shadow MMU UAF VM escape (x86)"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.virt.kvm_januscape.v1",
+    "safety_class": "EXPLOIT",
+    "requires_authorization": True,
+    "side_effects": ["api_calls", "state_change"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1611"],
+}
+
+
+def run(args: Any) -> int:
+    """Execute CVE-2026-53359 Januscape — KVM shadow MMU UAF VM escape (x86)."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific API calls
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0

cloudxpl/modules/virt/libvirt_enum.py

@@ -0,0 +1,40 @@
+"""CloudXPL-Forge module: Enumerate libvirt/KVM hosts, domains, storage pools, networks"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.virt.libvirt_enum.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": ["api_calls"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1580"],
+}
+
+
+def run(args: Any) -> int:
+    """Execute Enumerate libvirt/KVM hosts, domains, storage pools, networks."""
+    import json
+    import sys
+    from datetime import datetime, timezone
+    from pathlib import Path
+
+    print(f"[*] {MANIFEST['capability_id']} starting...")
+    print(f"[*] Target: {getattr(args, 'target', 'N/A')}")
+
+    findings: list[dict] = []
+
+    # --- Module logic placeholder ---
+    # TODO: implement provider-specific API calls
+    print("[!] Module stub — implement provider-specific logic")
+
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_dir = Path(getattr(args, "output", "."))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / f"{MANIFEST['capability_id'].rsplit('.', 1)[-1]}_{ts}.json"
+    out_file.write_text(json.dumps({"module": MANIFEST["capability_id"], "timestamp": ts, "findings": findings}, indent=2))
+    print(f"[+] Results saved to {out_file}")
+    return 0

cloudxpl/modules/virt/lolesxi_bridge.py

@@ -0,0 +1,33 @@
+"""CloudXPL-Forge — LOLESXi Living Off The Land (Bridge)."""
+
+from __future__ import annotations
+
+MANIFEST: dict = {
+    "name": "LOLESXi Living Off The Land (Bridge)",
+    "mitre": ["T1059"],
+    "description": "Bridge to LOLESXi-Project/LOLESXi — living-off-the-land techniques using native ESXi binaries.",
+    "references": ["https://github.com/LOLESXi-Project/LOLESXi"],
+}
+
+
+import os
+import subprocess
+import sys
+
+REPO = "LOLESXi-Project/LOLESXi"
+REPO_URL = f"https://github.com/{REPO}.git"
+
+
+def run(args):
+    clone_dir = os.path.join(getattr(args, "output", "."), REPO.split("/")[-1])
+    if os.path.isdir(clone_dir):
+        print(f"[*] Repository already cloned at {clone_dir}")
+    else:
+        print(f"[*] Cloning {REPO_URL} -> {clone_dir}")
+        ret = subprocess.call(["git", "clone", "--depth", "1", REPO_URL, clone_dir])
+        if ret != 0:
+            print(f"[!] Clone failed (rc={ret})", file=sys.stderr)
+            return ret
+    print(f"[+] Repository ready at {clone_dir}")
+    print("[*] Inspect contents before execution per security policy")
+    return 0