cloudxpl 4.2.0__py3-none-any.whl

cloudxpl/modules/aws/ecs_exploit.py

@@ -0,0 +1,77 @@
+"""AWS ECS exploitation — task definitions, container escape vectors, secrets."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.ecs_exploit.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1610"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS ECS Exploitation Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    ecs = session.client("ecs")
+    results = {"clusters": [], "task_definitions": [], "escape_vectors": []}
+    try:
+        clusters = ecs.list_clusters()["clusterArns"]
+        for carn in clusters:
+            cname = carn.split("/")[-1]
+            results["clusters"].append({"name": cname, "arn": carn})
+            print(f"  [+] Cluster: {cname}")
+    except Exception as exc:
+        print(f"[-] Cluster enum failed: {exc}")
+    try:
+        paginator = ecs.get_paginator("list_task_definitions")
+        for page in paginator.paginate(status="ACTIVE", sort="DESC"):
+            for td_arn in page["taskDefinitionArns"][:50]:
+                try:
+                    td = ecs.describe_task_definition(taskDefinition=td_arn)["taskDefinition"]
+                    info = {"family": td["family"], "revision": td["revision"], "containers": []}
+                    for container in td.get("containerDefinitions", []):
+                        cinfo = {"name": container["name"], "image": container.get("image", "")}
+                        if container.get("privileged"):
+                            cinfo["privileged"] = True
+                            results["escape_vectors"].append({"task_def": td["family"], "container": container["name"], "type": "privileged"})
+                            print(f"  [!] {td['family']}/{container['name']}: PRIVILEGED container")
+                        secrets = container.get("secrets", [])
+                        if secrets:
+                            cinfo["secrets_count"] = len(secrets)
+                        env = container.get("environment", [])
+                        sensitive_env = [e["name"] for e in env if any(k in e["name"].upper() for k in ["KEY", "SECRET", "TOKEN", "PASSWORD"])]
+                        if sensitive_env:
+                            cinfo["sensitive_env"] = sensitive_env
+                        info["containers"].append(cinfo)
+                    results["task_definitions"].append(info)
+                except Exception: pass
+    except Exception: pass
+    _save(args, "aws_ecs_exploit", results)
+    print(f"[+] {len(results['clusters'])} clusters, {len(results['task_definitions'])} task defs, {len(results['escape_vectors'])} escape vectors")
+    return 0

cloudxpl/modules/aws/eks_enum.py

@@ -0,0 +1,67 @@
+"""AWS EKS cluster enumeration — clusters, node groups, RBAC, IRSA."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.eks_enum.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1526"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS EKS Enumeration (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    eks = session.client("eks")
+    results = {"clusters": []}
+    try:
+        clusters = eks.list_clusters()["clusters"]
+        for cname in clusters:
+            cluster = eks.describe_cluster(name=cname)["cluster"]
+            info = {"name": cname, "version": cluster.get("version"), "endpoint": cluster.get("endpoint", "")[:50] + "...", "status": cluster["status"], "public_access": cluster.get("resourcesVpcConfig", {}).get("endpointPublicAccess", False), "logging": {}}
+            logging_config = cluster.get("logging", {}).get("clusterLogging", [])
+            for lc in logging_config:
+                for lt in lc.get("types", []):
+                    info["logging"][lt] = lc.get("enabled", False)
+            if info["public_access"]:
+                cidrs = cluster.get("resourcesVpcConfig", {}).get("publicAccessCidrs", [])
+                if "0.0.0.0/0" in cidrs:
+                    print(f"  [!] {cname}: public endpoint open to 0.0.0.0/0")
+                else:
+                    print(f"  [+] {cname}: public endpoint restricted")
+            try:
+                nodegroups = eks.list_nodegroups(clusterName=cname)["nodegroups"]
+                info["nodegroups"] = len(nodegroups)
+            except Exception: pass
+            results["clusters"].append(info)
+    except Exception as exc:
+        print(f"[-] EKS enum failed: {exc}"); return 1
+    _save(args, "aws_eks_enum", results)
+    print(f"[+] {len(results['clusters'])} EKS clusters found")
+    return 0

cloudxpl/modules/aws/eks_exploit.py

@@ -0,0 +1,66 @@
+"""AWS EKS exploitation — IRSA abuse, pod identity, OIDC misconfiguration."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.eks_exploit.v1",
+    "safety_class": "ACTIVE",
+    "requires_authorization": True,
+    "side_effects": ['aws_api_calls'],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1078","T1610"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS EKS Exploitation Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    eks = session.client("eks")
+    iam = session.client("iam")
+    results = {"clusters": [], "irsa_roles": [], "exploit_vectors": []}
+    try:
+        clusters = eks.list_clusters()["clusters"]
+        for cname in clusters:
+            cluster = eks.describe_cluster(name=cname)["cluster"]
+            oidc_issuer = cluster.get("identity", {}).get("oidc", {}).get("issuer", "")
+            info = {"name": cname, "oidc_issuer": oidc_issuer}
+            if oidc_issuer:
+                print(f"  [+] {cname}: OIDC issuer = {oidc_issuer}")
+                try:
+                    paginator = iam.get_paginator("list_roles")
+                    for page in paginator.paginate():
+                        for role in page["Roles"]:
+                            trust = str(role.get("AssumeRolePolicyDocument", {}))
+                            if oidc_issuer.replace("https://", "") in trust:
+                                results["irsa_roles"].append({"cluster": cname, "role": role["RoleName"], "arn": role["Arn"]})
+                                print(f"    [+] IRSA role: {role['RoleName']}")
+                except Exception: pass
+            results["clusters"].append(info)
+    except Exception as exc:
+        print(f"[-] EKS exploit analysis failed: {exc}"); return 1
+    _save(args, "aws_eks_exploit", results)
+    print(f"[+] {len(results['irsa_roles'])} IRSA roles found")
+    return 0

cloudxpl/modules/aws/eventbridge_exploit.py

@@ -0,0 +1,65 @@
+"""AWS EventBridge rule injection and event bus analysis."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.eventbridge_exploit.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1648"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS EventBridge Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    eb = session.client("events")
+    results = {"event_buses": [], "rules": []}
+    try:
+        buses = eb.list_event_buses()["EventBuses"]
+        for bus in buses:
+            info = {"name": bus["Name"], "arn": bus.get("Arn", "")}
+            policy = bus.get("Policy")
+            if policy:
+                import json as _json
+                pol = _json.loads(policy)
+                for stmt in pol.get("Statement", []):
+                    if stmt.get("Principal") in ("*", {"AWS": "*"}):
+                        info["public"] = True
+                        print(f"  [!] EventBus {bus['Name']}: PUBLIC access")
+            results["event_buses"].append(info)
+    except Exception as exc:
+        print(f"[-] EventBridge enum failed: {exc}")
+    try:
+        rules = eb.list_rules()["Rules"]
+        for rule in rules:
+            results["rules"].append({"name": rule["Name"], "state": rule["State"], "event_bus": rule.get("EventBusName", "default")})
+    except Exception: pass
+    _save(args, "aws_eventbridge_exploit", results)
+    print(f"[+] {len(results['event_buses'])} buses, {len(results['rules'])} rules")
+    return 0

cloudxpl/modules/aws/glue_exploit.py

@@ -0,0 +1,63 @@
+"""AWS Glue exploitation — job enumeration, ETL data access, connection secrets."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.glue_exploit.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1530"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS Glue Exploitation Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    glue = session.client("glue")
+    results = {"jobs": [], "connections": [], "secrets_found": []}
+    try:
+        jobs = glue.get_jobs()["Jobs"]
+        for job in jobs:
+            info = {"name": job["Name"], "role": job.get("Role", ""), "command": job.get("Command", {}).get("Name")}
+            args_dict = job.get("DefaultArguments", {})
+            for k, v in args_dict.items():
+                if any(s in k.upper() for s in ["SECRET", "PASSWORD", "KEY", "TOKEN"]):
+                    results["secrets_found"].append({"job": job["Name"], "arg": k})
+                    print(f"  [!] {job['Name']}: sensitive arg {k}")
+            results["jobs"].append(info)
+    except Exception as exc:
+        print(f"[-] Glue enum failed: {exc}")
+    try:
+        conns = glue.get_connections()["ConnectionList"]
+        for conn in conns:
+            info = {"name": conn["Name"], "type": conn.get("ConnectionType"), "has_password": "PASSWORD" in str(conn.get("ConnectionProperties", {}).keys()).upper()}
+            results["connections"].append(info)
+    except Exception: pass
+    _save(args, "aws_glue_exploit", results)
+    print(f"[+] {len(results['jobs'])} jobs, {len(results['connections'])} connections")
+    return 0

cloudxpl/modules/aws/guardduty_bypass.py

@@ -0,0 +1,71 @@
+"""AWS GuardDuty evasion analysis — detector status, suppression rules, finding types."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.guardduty_bypass.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1562.001"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS GuardDuty Evasion Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    gd = session.client("guardduty")
+    results = {"detectors": [], "findings_summary": [], "evasion_notes": []}
+    try:
+        detector_ids = gd.list_detectors()["DetectorIds"]
+        for did in detector_ids:
+            det = gd.get_detector(DetectorId=did)
+            info = {"detector_id": did, "status": det["Status"], "data_sources": {}}
+            for src in ["S3Logs", "CloudTrail", "DNSLogs", "FlowLogs", "Kubernetes"]:
+                ds = det.get("DataSources", {}).get(src, {})
+                if ds:
+                    info["data_sources"][src] = ds.get("Status", "UNKNOWN")
+            results["detectors"].append(info)
+            if det["Status"] != "ENABLED":
+                print(f"  [!] Detector {did}: NOT ENABLED")
+                results["evasion_notes"].append(f"Detector {did} is {det['Status']}")
+            else:
+                print(f"  [+] Detector {did}: enabled")
+                for src, status in info["data_sources"].items():
+                    if status != "ENABLED":
+                        print(f"    [!] {src}: {status}")
+                        results["evasion_notes"].append(f"{src} not enabled on {did}")
+            try:
+                filters = gd.list_filters(DetectorId=did)
+                if filters.get("FilterNames"):
+                    results["evasion_notes"].append(f"{len(filters['FilterNames'])} suppression filters on {did}")
+            except Exception: pass
+    except Exception as exc:
+        print(f"[-] GuardDuty enum failed: {exc}"); return 1
+    _save(args, "aws_guardduty_bypass", results)
+    print(f"[+] {len(results['detectors'])} detectors, {len(results['evasion_notes'])} evasion notes")
+    return 0

cloudxpl/modules/aws/iam_enum.py

@@ -0,0 +1,101 @@
+"""AWS IAM enumeration — users, roles, policies, access keys."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.iam_enum.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": ["aws_api_calls"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1087.004"],
+}
+
+
+def run(args: Any) -> int:
+    print(f"[*] AWS IAM Enumeration (region: {args.region})")
+
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed: pip install cloudxpl-forge[aws]", file=sys.stderr)
+        return 1
+
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    iam = session.client("iam")
+    sts = session.client("sts")
+
+    results: dict[str, Any] = {}
+
+    try:
+        identity = sts.get_caller_identity()
+        results["caller_identity"] = {
+            "account": identity["Account"],
+            "arn": identity["Arn"],
+            "user_id": identity["UserId"],
+        }
+        print(f"[+] Identity: {identity['Arn']}")
+    except Exception as exc:
+        print(f"[-] get_caller_identity failed: {exc}", file=sys.stderr)
+        return 1
+
+    try:
+        users = iam.list_users()["Users"]
+        results["users"] = [
+            {"UserName": u["UserName"], "Arn": u["Arn"],
+             "CreateDate": u["CreateDate"].isoformat(),
+             "PasswordLastUsed": u.get("PasswordLastUsed", "").isoformat() if u.get("PasswordLastUsed") else None}
+            for u in users
+        ]
+        print(f"[+] {len(users)} IAM users")
+    except Exception as exc:
+        results["users_error"] = str(exc)
+
+    try:
+        roles = iam.list_roles()["Roles"]
+        results["roles"] = [
+            {"RoleName": r["RoleName"], "Arn": r["Arn"],
+             "AssumeRolePolicyDocument": r.get("AssumeRolePolicyDocument")}
+            for r in roles
+        ]
+        print(f"[+] {len(roles)} IAM roles")
+    except Exception as exc:
+        results["roles_error"] = str(exc)
+
+    try:
+        policies = iam.list_policies(Scope="Local")["Policies"]
+        results["custom_policies"] = [
+            {"PolicyName": p["PolicyName"], "Arn": p["Arn"],
+             "AttachmentCount": p["AttachmentCount"]}
+            for p in policies
+        ]
+        print(f"[+] {len(policies)} custom policies")
+    except Exception as exc:
+        results["policies_error"] = str(exc)
+
+    for user in results.get("users", []):
+        try:
+            keys = iam.list_access_keys(UserName=user["UserName"])["AccessKeyMetadata"]
+            user["access_keys"] = [
+                {"AccessKeyId": k["AccessKeyId"], "Status": k["Status"],
+                 "CreateDate": k["CreateDate"].isoformat()}
+                for k in keys
+            ]
+        except Exception:
+            pass
+
+    os.makedirs(args.output, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_path = os.path.join(args.output, f"aws_iam_{ts}.json")
+    with open(out_path, "w") as fh:
+        json.dump(results, fh, indent=2, default=str)
+
+    print(f"[+] Output: {out_path}")
+    return 0

cloudxpl/modules/aws/iam_privesc.py

@@ -0,0 +1,92 @@
+"""AWS IAM privilege escalation path analysis — identifies 20+ escalation vectors."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.iam_privesc.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1078","T1068"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS IAM Privilege Escalation Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    iam = session.client("iam")
+    sts = session.client("sts")
+    caller = sts.get_caller_identity()
+    print(f"[+] Caller: {caller['Arn']}")
+    escalation_paths = []
+    DANGEROUS_ACTIONS = [
+        "iam:CreatePolicyVersion", "iam:SetDefaultPolicyVersion",
+        "iam:PassRole", "iam:CreateLoginProfile", "iam:UpdateLoginProfile",
+        "iam:AttachUserPolicy", "iam:AttachGroupPolicy", "iam:AttachRolePolicy",
+        "iam:PutUserPolicy", "iam:PutGroupPolicy", "iam:PutRolePolicy",
+        "iam:CreateAccessKey", "iam:AddUserToGroup",
+        "sts:AssumeRole", "iam:UpdateAssumeRolePolicy",
+        "lambda:CreateFunction", "lambda:InvokeFunction", "lambda:UpdateFunctionCode",
+        "ec2:RunInstances", "cloudformation:CreateStack",
+        "datapipeline:CreatePipeline", "glue:CreateDevEndpoint",
+    ]
+    try:
+        paginator = iam.get_paginator("list_users")
+        for page in paginator.paginate():
+            for user in page["Users"]:
+                uname = user["UserName"]
+                try:
+                    policies = iam.list_attached_user_policies(UserName=uname)["AttachedPolicies"]
+                    inline = iam.list_user_policies(UserName=uname)["PolicyNames"]
+                    for pol in policies:
+                        try:
+                            arn = pol["PolicyArn"]
+                            ver = iam.get_policy(PolicyArn=arn)["Policy"]["DefaultVersionId"]
+                            doc = iam.get_policy_version(PolicyArn=arn, VersionId=ver)["PolicyVersion"]["Document"]
+                            stmts = doc.get("Statement", [])
+                            if isinstance(stmts, dict): stmts = [stmts]
+                            for stmt in stmts:
+                                if stmt.get("Effect") != "Allow": continue
+                                actions = stmt.get("Action", [])
+                                if isinstance(actions, str): actions = [actions]
+                                for act in actions:
+                                    if act == "*" or act in DANGEROUS_ACTIONS:
+                                        escalation_paths.append({
+                                            "user": uname, "policy": pol["PolicyName"],
+                                            "action": act, "resource": str(stmt.get("Resource", "*")),
+                                        })
+                                        print(f"  [!] {uname}: {act} via {pol['PolicyName']}")
+                        except Exception:
+                            pass
+                except Exception:
+                    pass
+    except Exception as exc:
+        print(f"[-] Enumeration failed: {exc}", file=sys.stderr)
+    results = {"caller": caller["Arn"], "escalation_paths": escalation_paths, "total": len(escalation_paths)}
+    _save(args, "aws_iam_privesc", results)
+    print(f"[+] {len(escalation_paths)} escalation paths found")
+    return 0