souleyez 2.43.28__py3-none-any.whl → 2.43.32__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (356) hide show
  1. souleyez/__init__.py +1 -2
  2. souleyez/ai/__init__.py +21 -15
  3. souleyez/ai/action_mapper.py +249 -150
  4. souleyez/ai/chain_advisor.py +116 -100
  5. souleyez/ai/claude_provider.py +29 -28
  6. souleyez/ai/context_builder.py +80 -62
  7. souleyez/ai/executor.py +158 -117
  8. souleyez/ai/feedback_handler.py +136 -121
  9. souleyez/ai/llm_factory.py +27 -20
  10. souleyez/ai/llm_provider.py +4 -2
  11. souleyez/ai/ollama_provider.py +6 -9
  12. souleyez/ai/ollama_service.py +44 -37
  13. souleyez/ai/path_scorer.py +91 -76
  14. souleyez/ai/recommender.py +176 -144
  15. souleyez/ai/report_context.py +74 -73
  16. souleyez/ai/report_service.py +84 -66
  17. souleyez/ai/result_parser.py +222 -229
  18. souleyez/ai/safety.py +67 -44
  19. souleyez/auth/__init__.py +23 -22
  20. souleyez/auth/audit.py +36 -26
  21. souleyez/auth/engagement_access.py +65 -48
  22. souleyez/auth/permissions.py +14 -3
  23. souleyez/auth/session_manager.py +54 -37
  24. souleyez/auth/user_manager.py +109 -64
  25. souleyez/commands/audit.py +40 -43
  26. souleyez/commands/auth.py +35 -15
  27. souleyez/commands/deliverables.py +55 -50
  28. souleyez/commands/engagement.py +47 -28
  29. souleyez/commands/license.py +32 -23
  30. souleyez/commands/screenshots.py +36 -32
  31. souleyez/commands/user.py +82 -36
  32. souleyez/config.py +52 -44
  33. souleyez/core/credential_tester.py +87 -81
  34. souleyez/core/cve_mappings.py +179 -192
  35. souleyez/core/cve_matcher.py +162 -148
  36. souleyez/core/msf_auto_mapper.py +100 -83
  37. souleyez/core/msf_chain_engine.py +294 -256
  38. souleyez/core/msf_database.py +153 -70
  39. souleyez/core/msf_integration.py +679 -673
  40. souleyez/core/msf_rpc_client.py +40 -42
  41. souleyez/core/msf_rpc_manager.py +77 -79
  42. souleyez/core/msf_sync_manager.py +241 -181
  43. souleyez/core/network_utils.py +22 -15
  44. souleyez/core/parser_handler.py +34 -25
  45. souleyez/core/pending_chains.py +114 -63
  46. souleyez/core/templates.py +158 -107
  47. souleyez/core/tool_chaining.py +9592 -2879
  48. souleyez/core/version_utils.py +79 -94
  49. souleyez/core/vuln_correlation.py +136 -89
  50. souleyez/core/web_utils.py +33 -32
  51. souleyez/data/wordlists/ad_users.txt +378 -0
  52. souleyez/data/wordlists/api_endpoints_large.txt +769 -0
  53. souleyez/data/wordlists/home_dir_sensitive.txt +39 -0
  54. souleyez/data/wordlists/lfi_payloads.txt +82 -0
  55. souleyez/data/wordlists/passwords_brute.txt +1548 -0
  56. souleyez/data/wordlists/passwords_crack.txt +2479 -0
  57. souleyez/data/wordlists/passwords_spray.txt +386 -0
  58. souleyez/data/wordlists/subdomains_large.txt +5057 -0
  59. souleyez/data/wordlists/usernames_common.txt +694 -0
  60. souleyez/data/wordlists/web_dirs_large.txt +4769 -0
  61. souleyez/detection/__init__.py +1 -1
  62. souleyez/detection/attack_signatures.py +12 -17
  63. souleyez/detection/mitre_mappings.py +61 -55
  64. souleyez/detection/validator.py +97 -86
  65. souleyez/devtools.py +23 -10
  66. souleyez/docs/README.md +4 -4
  67. souleyez/docs/api-reference/cli-commands.md +2 -2
  68. souleyez/docs/developer-guide/adding-new-tools.md +562 -0
  69. souleyez/docs/user-guide/auto-chaining.md +30 -8
  70. souleyez/docs/user-guide/getting-started.md +1 -1
  71. souleyez/docs/user-guide/installation.md +26 -3
  72. souleyez/docs/user-guide/metasploit-integration.md +2 -2
  73. souleyez/docs/user-guide/rbac.md +1 -1
  74. souleyez/docs/user-guide/scope-management.md +1 -1
  75. souleyez/docs/user-guide/siem-integration.md +1 -1
  76. souleyez/docs/user-guide/tools-reference.md +1 -8
  77. souleyez/docs/user-guide/worker-management.md +1 -1
  78. souleyez/engine/background.py +1238 -535
  79. souleyez/engine/base.py +4 -1
  80. souleyez/engine/job_status.py +17 -49
  81. souleyez/engine/log_sanitizer.py +103 -77
  82. souleyez/engine/manager.py +38 -7
  83. souleyez/engine/result_handler.py +2198 -1550
  84. souleyez/engine/worker_manager.py +50 -41
  85. souleyez/export/evidence_bundle.py +72 -62
  86. souleyez/feature_flags/features.py +16 -20
  87. souleyez/feature_flags.py +5 -9
  88. souleyez/handlers/__init__.py +11 -0
  89. souleyez/handlers/base.py +188 -0
  90. souleyez/handlers/bash_handler.py +277 -0
  91. souleyez/handlers/bloodhound_handler.py +243 -0
  92. souleyez/handlers/certipy_handler.py +311 -0
  93. souleyez/handlers/crackmapexec_handler.py +486 -0
  94. souleyez/handlers/dnsrecon_handler.py +344 -0
  95. souleyez/handlers/enum4linux_handler.py +400 -0
  96. souleyez/handlers/evil_winrm_handler.py +493 -0
  97. souleyez/handlers/ffuf_handler.py +815 -0
  98. souleyez/handlers/gobuster_handler.py +1114 -0
  99. souleyez/handlers/gpp_extract_handler.py +334 -0
  100. souleyez/handlers/hashcat_handler.py +444 -0
  101. souleyez/handlers/hydra_handler.py +563 -0
  102. souleyez/handlers/impacket_getuserspns_handler.py +343 -0
  103. souleyez/handlers/impacket_psexec_handler.py +222 -0
  104. souleyez/handlers/impacket_secretsdump_handler.py +426 -0
  105. souleyez/handlers/john_handler.py +286 -0
  106. souleyez/handlers/katana_handler.py +425 -0
  107. souleyez/handlers/kerbrute_handler.py +298 -0
  108. souleyez/handlers/ldapsearch_handler.py +636 -0
  109. souleyez/handlers/lfi_extract_handler.py +464 -0
  110. souleyez/handlers/msf_auxiliary_handler.py +408 -0
  111. souleyez/handlers/msf_exploit_handler.py +380 -0
  112. souleyez/handlers/nikto_handler.py +413 -0
  113. souleyez/handlers/nmap_handler.py +821 -0
  114. souleyez/handlers/nuclei_handler.py +359 -0
  115. souleyez/handlers/nxc_handler.py +371 -0
  116. souleyez/handlers/rdp_sec_check_handler.py +353 -0
  117. souleyez/handlers/registry.py +288 -0
  118. souleyez/handlers/responder_handler.py +232 -0
  119. souleyez/handlers/service_explorer_handler.py +434 -0
  120. souleyez/handlers/smbclient_handler.py +344 -0
  121. souleyez/handlers/smbmap_handler.py +510 -0
  122. souleyez/handlers/smbpasswd_handler.py +296 -0
  123. souleyez/handlers/sqlmap_handler.py +1116 -0
  124. souleyez/handlers/theharvester_handler.py +601 -0
  125. souleyez/handlers/whois_handler.py +277 -0
  126. souleyez/handlers/wpscan_handler.py +554 -0
  127. souleyez/history.py +32 -16
  128. souleyez/importers/msf_importer.py +106 -75
  129. souleyez/importers/smart_importer.py +208 -147
  130. souleyez/integrations/siem/__init__.py +10 -10
  131. souleyez/integrations/siem/base.py +17 -18
  132. souleyez/integrations/siem/elastic.py +108 -122
  133. souleyez/integrations/siem/factory.py +207 -80
  134. souleyez/integrations/siem/googlesecops.py +146 -154
  135. souleyez/integrations/siem/rule_mappings/__init__.py +1 -1
  136. souleyez/integrations/siem/rule_mappings/wazuh_rules.py +8 -5
  137. souleyez/integrations/siem/sentinel.py +107 -109
  138. souleyez/integrations/siem/splunk.py +246 -212
  139. souleyez/integrations/siem/wazuh.py +65 -71
  140. souleyez/integrations/wazuh/__init__.py +5 -5
  141. souleyez/integrations/wazuh/client.py +70 -93
  142. souleyez/integrations/wazuh/config.py +85 -57
  143. souleyez/integrations/wazuh/host_mapper.py +28 -36
  144. souleyez/integrations/wazuh/sync.py +78 -68
  145. souleyez/intelligence/__init__.py +4 -5
  146. souleyez/intelligence/correlation_analyzer.py +309 -295
  147. souleyez/intelligence/exploit_knowledge.py +661 -623
  148. souleyez/intelligence/exploit_suggestions.py +159 -139
  149. souleyez/intelligence/gap_analyzer.py +132 -97
  150. souleyez/intelligence/gap_detector.py +251 -214
  151. souleyez/intelligence/sensitive_tables.py +266 -129
  152. souleyez/intelligence/service_parser.py +137 -123
  153. souleyez/intelligence/surface_analyzer.py +407 -268
  154. souleyez/intelligence/target_parser.py +159 -162
  155. souleyez/licensing/__init__.py +6 -6
  156. souleyez/licensing/validator.py +17 -19
  157. souleyez/log_config.py +79 -54
  158. souleyez/main.py +1505 -687
  159. souleyez/migrations/fix_job_counter.py +16 -14
  160. souleyez/parsers/bloodhound_parser.py +41 -39
  161. souleyez/parsers/crackmapexec_parser.py +178 -111
  162. souleyez/parsers/dalfox_parser.py +72 -77
  163. souleyez/parsers/dnsrecon_parser.py +103 -91
  164. souleyez/parsers/enum4linux_parser.py +183 -153
  165. souleyez/parsers/ffuf_parser.py +29 -25
  166. souleyez/parsers/gobuster_parser.py +301 -41
  167. souleyez/parsers/hashcat_parser.py +324 -79
  168. souleyez/parsers/http_fingerprint_parser.py +350 -103
  169. souleyez/parsers/hydra_parser.py +131 -111
  170. souleyez/parsers/impacket_parser.py +231 -178
  171. souleyez/parsers/john_parser.py +98 -86
  172. souleyez/parsers/katana_parser.py +316 -0
  173. souleyez/parsers/msf_parser.py +943 -498
  174. souleyez/parsers/nikto_parser.py +346 -65
  175. souleyez/parsers/nmap_parser.py +262 -174
  176. souleyez/parsers/nuclei_parser.py +40 -44
  177. souleyez/parsers/responder_parser.py +26 -26
  178. souleyez/parsers/searchsploit_parser.py +74 -74
  179. souleyez/parsers/service_explorer_parser.py +279 -0
  180. souleyez/parsers/smbmap_parser.py +180 -124
  181. souleyez/parsers/sqlmap_parser.py +434 -308
  182. souleyez/parsers/theharvester_parser.py +75 -57
  183. souleyez/parsers/whois_parser.py +135 -94
  184. souleyez/parsers/wpscan_parser.py +278 -190
  185. souleyez/plugins/afp.py +44 -36
  186. souleyez/plugins/afp_brute.py +114 -46
  187. souleyez/plugins/ard.py +48 -37
  188. souleyez/plugins/bloodhound.py +95 -61
  189. souleyez/plugins/certipy.py +303 -0
  190. souleyez/plugins/crackmapexec.py +186 -85
  191. souleyez/plugins/dalfox.py +120 -59
  192. souleyez/plugins/dns_hijack.py +146 -41
  193. souleyez/plugins/dnsrecon.py +97 -61
  194. souleyez/plugins/enum4linux.py +91 -66
  195. souleyez/plugins/evil_winrm.py +291 -0
  196. souleyez/plugins/ffuf.py +166 -90
  197. souleyez/plugins/firmware_extract.py +133 -29
  198. souleyez/plugins/gobuster.py +387 -190
  199. souleyez/plugins/gpp_extract.py +393 -0
  200. souleyez/plugins/hashcat.py +100 -73
  201. souleyez/plugins/http_fingerprint.py +854 -267
  202. souleyez/plugins/hydra.py +566 -200
  203. souleyez/plugins/impacket_getnpusers.py +117 -69
  204. souleyez/plugins/impacket_psexec.py +84 -64
  205. souleyez/plugins/impacket_secretsdump.py +103 -69
  206. souleyez/plugins/impacket_smbclient.py +89 -75
  207. souleyez/plugins/john.py +86 -69
  208. souleyez/plugins/katana.py +313 -0
  209. souleyez/plugins/kerbrute.py +237 -0
  210. souleyez/plugins/lfi_extract.py +541 -0
  211. souleyez/plugins/macos_ssh.py +117 -48
  212. souleyez/plugins/mdns.py +35 -30
  213. souleyez/plugins/msf_auxiliary.py +253 -130
  214. souleyez/plugins/msf_exploit.py +239 -161
  215. souleyez/plugins/nikto.py +134 -78
  216. souleyez/plugins/nmap.py +275 -91
  217. souleyez/plugins/nuclei.py +180 -89
  218. souleyez/plugins/nxc.py +285 -0
  219. souleyez/plugins/plugin_base.py +35 -36
  220. souleyez/plugins/plugin_template.py +13 -5
  221. souleyez/plugins/rdp_sec_check.py +130 -0
  222. souleyez/plugins/responder.py +112 -71
  223. souleyez/plugins/router_http_brute.py +76 -65
  224. souleyez/plugins/router_ssh_brute.py +118 -41
  225. souleyez/plugins/router_telnet_brute.py +124 -42
  226. souleyez/plugins/routersploit.py +91 -59
  227. souleyez/plugins/routersploit_exploit.py +77 -55
  228. souleyez/plugins/searchsploit.py +91 -77
  229. souleyez/plugins/service_explorer.py +1160 -0
  230. souleyez/plugins/smbmap.py +122 -72
  231. souleyez/plugins/smbpasswd.py +215 -0
  232. souleyez/plugins/sqlmap.py +301 -113
  233. souleyez/plugins/theharvester.py +127 -75
  234. souleyez/plugins/tr069.py +79 -57
  235. souleyez/plugins/upnp.py +65 -47
  236. souleyez/plugins/upnp_abuse.py +73 -55
  237. souleyez/plugins/vnc_access.py +129 -42
  238. souleyez/plugins/vnc_brute.py +109 -38
  239. souleyez/plugins/whois.py +77 -58
  240. souleyez/plugins/wpscan.py +173 -69
  241. souleyez/reporting/__init__.py +2 -1
  242. souleyez/reporting/attack_chain.py +411 -346
  243. souleyez/reporting/charts.py +436 -501
  244. souleyez/reporting/compliance_mappings.py +334 -201
  245. souleyez/reporting/detection_report.py +126 -125
  246. souleyez/reporting/formatters.py +828 -591
  247. souleyez/reporting/generator.py +386 -302
  248. souleyez/reporting/metrics.py +72 -75
  249. souleyez/scanner.py +35 -29
  250. souleyez/security/__init__.py +37 -11
  251. souleyez/security/scope_validator.py +175 -106
  252. souleyez/security/validation.py +223 -149
  253. souleyez/security.py +22 -6
  254. souleyez/storage/credentials.py +247 -186
  255. souleyez/storage/crypto.py +296 -129
  256. souleyez/storage/database.py +73 -50
  257. souleyez/storage/db.py +58 -36
  258. souleyez/storage/deliverable_evidence.py +177 -128
  259. souleyez/storage/deliverable_exporter.py +282 -246
  260. souleyez/storage/deliverable_templates.py +134 -116
  261. souleyez/storage/deliverables.py +135 -130
  262. souleyez/storage/engagements.py +109 -56
  263. souleyez/storage/evidence.py +181 -152
  264. souleyez/storage/execution_log.py +31 -17
  265. souleyez/storage/exploit_attempts.py +93 -57
  266. souleyez/storage/exploits.py +67 -36
  267. souleyez/storage/findings.py +48 -61
  268. souleyez/storage/hosts.py +176 -144
  269. souleyez/storage/migrate_to_engagements.py +43 -19
  270. souleyez/storage/migrations/_001_add_credential_enhancements.py +22 -12
  271. souleyez/storage/migrations/_002_add_status_tracking.py +10 -7
  272. souleyez/storage/migrations/_003_add_execution_log.py +14 -8
  273. souleyez/storage/migrations/_005_screenshots.py +13 -5
  274. souleyez/storage/migrations/_006_deliverables.py +13 -5
  275. souleyez/storage/migrations/_007_deliverable_templates.py +12 -7
  276. souleyez/storage/migrations/_008_add_nuclei_table.py +10 -4
  277. souleyez/storage/migrations/_010_evidence_linking.py +17 -10
  278. souleyez/storage/migrations/_011_timeline_tracking.py +20 -13
  279. souleyez/storage/migrations/_012_team_collaboration.py +34 -21
  280. souleyez/storage/migrations/_013_add_host_tags.py +12 -6
  281. souleyez/storage/migrations/_014_exploit_attempts.py +22 -10
  282. souleyez/storage/migrations/_015_add_mac_os_fields.py +15 -7
  283. souleyez/storage/migrations/_016_add_domain_field.py +10 -4
  284. souleyez/storage/migrations/_017_msf_sessions.py +16 -8
  285. souleyez/storage/migrations/_018_add_osint_target.py +10 -6
  286. souleyez/storage/migrations/_019_add_engagement_type.py +10 -6
  287. souleyez/storage/migrations/_020_add_rbac.py +36 -15
  288. souleyez/storage/migrations/_021_wazuh_integration.py +20 -8
  289. souleyez/storage/migrations/_022_wazuh_indexer_columns.py +6 -4
  290. souleyez/storage/migrations/_023_fix_detection_results_fk.py +16 -6
  291. souleyez/storage/migrations/_024_wazuh_vulnerabilities.py +26 -10
  292. souleyez/storage/migrations/_025_multi_siem_support.py +3 -5
  293. souleyez/storage/migrations/_026_add_engagement_scope.py +31 -12
  294. souleyez/storage/migrations/_027_multi_siem_persistence.py +32 -15
  295. souleyez/storage/migrations/__init__.py +26 -26
  296. souleyez/storage/migrations/migration_manager.py +19 -19
  297. souleyez/storage/msf_sessions.py +100 -65
  298. souleyez/storage/osint.py +17 -24
  299. souleyez/storage/recommendation_engine.py +269 -235
  300. souleyez/storage/screenshots.py +33 -32
  301. souleyez/storage/smb_shares.py +136 -92
  302. souleyez/storage/sqlmap_data.py +183 -128
  303. souleyez/storage/team_collaboration.py +135 -141
  304. souleyez/storage/timeline_tracker.py +122 -94
  305. souleyez/storage/wazuh_vulns.py +64 -66
  306. souleyez/storage/web_paths.py +33 -37
  307. souleyez/testing/credential_tester.py +221 -205
  308. souleyez/ui/__init__.py +1 -1
  309. souleyez/ui/ai_quotes.py +12 -12
  310. souleyez/ui/attack_surface.py +2439 -1516
  311. souleyez/ui/chain_rules_view.py +914 -382
  312. souleyez/ui/correlation_view.py +312 -230
  313. souleyez/ui/dashboard.py +2382 -1130
  314. souleyez/ui/deliverables_view.py +148 -62
  315. souleyez/ui/design_system.py +13 -13
  316. souleyez/ui/errors.py +49 -49
  317. souleyez/ui/evidence_linking_view.py +284 -179
  318. souleyez/ui/evidence_vault.py +393 -285
  319. souleyez/ui/exploit_suggestions_view.py +555 -349
  320. souleyez/ui/export_view.py +100 -66
  321. souleyez/ui/gap_analysis_view.py +315 -171
  322. souleyez/ui/help_system.py +105 -97
  323. souleyez/ui/intelligence_view.py +436 -293
  324. souleyez/ui/interactive.py +23142 -10430
  325. souleyez/ui/interactive_selector.py +75 -68
  326. souleyez/ui/log_formatter.py +47 -39
  327. souleyez/ui/menu_components.py +22 -13
  328. souleyez/ui/msf_auxiliary_menu.py +184 -133
  329. souleyez/ui/pending_chains_view.py +336 -172
  330. souleyez/ui/progress_indicators.py +5 -3
  331. souleyez/ui/recommendations_view.py +195 -137
  332. souleyez/ui/rule_builder.py +343 -225
  333. souleyez/ui/setup_wizard.py +678 -284
  334. souleyez/ui/shortcuts.py +217 -165
  335. souleyez/ui/splunk_gap_analysis_view.py +452 -270
  336. souleyez/ui/splunk_vulns_view.py +139 -86
  337. souleyez/ui/team_dashboard.py +498 -335
  338. souleyez/ui/template_selector.py +196 -105
  339. souleyez/ui/terminal.py +6 -6
  340. souleyez/ui/timeline_view.py +198 -127
  341. souleyez/ui/tool_setup.py +264 -164
  342. souleyez/ui/tutorial.py +202 -72
  343. souleyez/ui/tutorial_state.py +40 -40
  344. souleyez/ui/wazuh_vulns_view.py +235 -141
  345. souleyez/ui/wordlist_browser.py +260 -107
  346. souleyez/ui.py +464 -312
  347. souleyez/utils/tool_checker.py +427 -367
  348. souleyez/utils.py +33 -29
  349. souleyez/wordlists.py +134 -167
  350. {souleyez-2.43.28.dist-info → souleyez-2.43.32.dist-info}/METADATA +1 -1
  351. souleyez-2.43.32.dist-info/RECORD +441 -0
  352. {souleyez-2.43.28.dist-info → souleyez-2.43.32.dist-info}/WHEEL +1 -1
  353. souleyez-2.43.28.dist-info/RECORD +0 -379
  354. {souleyez-2.43.28.dist-info → souleyez-2.43.32.dist-info}/entry_points.txt +0 -0
  355. {souleyez-2.43.28.dist-info → souleyez-2.43.32.dist-info}/licenses/LICENSE +0 -0
  356. {souleyez-2.43.28.dist-info → souleyez-2.43.32.dist-info}/top_level.txt +0 -0
@@ -20,7 +20,7 @@ class MSFChainEngine:
20
20
  self,
21
21
  target_hosts: List[int],
22
22
  objectives: List[str] = None,
23
- risk_tolerance: str = 'moderate'
23
+ risk_tolerance: str = "moderate",
24
24
  ) -> Dict:
25
25
  """
26
26
  Build progressive attack chain.
@@ -34,42 +34,44 @@ class MSFChainEngine:
34
34
  Chain definition with phases and modules
35
35
  """
36
36
  if objectives is None:
37
- objectives = ['recon', 'exploit', 'escalate']
37
+ objectives = ["recon", "exploit", "escalate"]
38
38
 
39
39
  # Map risk tolerance to risk levels
40
40
  risk_map = {
41
- 'safe': ['safe'],
42
- 'moderate': ['safe', 'noisy', 'moderate'],
43
- 'aggressive': ['safe', 'noisy', 'moderate', 'dangerous']
41
+ "safe": ["safe"],
42
+ "moderate": ["safe", "noisy", "moderate"],
43
+ "aggressive": ["safe", "noisy", "moderate", "dangerous"],
44
44
  }
45
- risk_levels = risk_map.get(risk_tolerance, ['safe', 'noisy'])
45
+ risk_levels = risk_map.get(risk_tolerance, ["safe", "noisy"])
46
46
 
47
47
  chain = {
48
- 'chain_id': f'attack_chain_{self.engagement_id}',
49
- 'engagement_id': self.engagement_id,
50
- 'target_hosts': target_hosts,
51
- 'objectives': objectives,
52
- 'risk_tolerance': risk_tolerance,
53
- 'phases': []
48
+ "chain_id": f"attack_chain_{self.engagement_id}",
49
+ "engagement_id": self.engagement_id,
50
+ "target_hosts": target_hosts,
51
+ "objectives": objectives,
52
+ "risk_tolerance": risk_tolerance,
53
+ "phases": [],
54
54
  }
55
55
 
56
56
  # Build phases based on objectives
57
- if 'recon' in objectives:
58
- chain['phases'].append(self._build_recon_phase(target_hosts))
57
+ if "recon" in objectives:
58
+ chain["phases"].append(self._build_recon_phase(target_hosts))
59
59
 
60
- if 'exploit' in objectives:
61
- chain['phases'].append(self._build_exploitation_phase(target_hosts, risk_levels))
60
+ if "exploit" in objectives:
61
+ chain["phases"].append(
62
+ self._build_exploitation_phase(target_hosts, risk_levels)
63
+ )
62
64
 
63
- if 'escalate' in objectives or 'pivot' in objectives or 'persist' in objectives:
65
+ if "escalate" in objectives or "pivot" in objectives or "persist" in objectives:
64
66
  post_objectives = []
65
- if 'escalate' in objectives:
66
- post_objectives.append('escalate')
67
- if 'pivot' in objectives:
68
- post_objectives.append('pivot')
69
- if 'persist' in objectives:
70
- post_objectives.append('persist')
67
+ if "escalate" in objectives:
68
+ post_objectives.append("escalate")
69
+ if "pivot" in objectives:
70
+ post_objectives.append("pivot")
71
+ if "persist" in objectives:
72
+ post_objectives.append("persist")
71
73
 
72
- chain['phases'].append(self._build_post_exploitation_phase(post_objectives))
74
+ chain["phases"].append(self._build_post_exploitation_phase(post_objectives))
73
75
 
74
76
  return chain
75
77
 
@@ -77,6 +79,7 @@ class MSFChainEngine:
77
79
  """Build reconnaissance phase."""
78
80
  try:
79
81
  from souleyez.storage.hosts import HostManager
82
+
80
83
  hm = HostManager()
81
84
 
82
85
  modules = []
@@ -85,44 +88,52 @@ class MSFChainEngine:
85
88
  services = hm.get_host_services(host_id)
86
89
 
87
90
  for service in services:
88
- service_name = service.get('service_name', '').lower()
91
+ service_name = service.get("service_name", "").lower()
89
92
 
90
93
  # Get version scanners
91
94
  recommendations = self.module_selector.get_recommendations(
92
- service=service_name,
93
- include_risk=['safe']
95
+ service=service_name, include_risk=["safe"]
94
96
  )
95
97
 
96
98
  # Filter to version scanners
97
- scanners = [r for r in recommendations if 'version' in r.get('name', '').lower()]
99
+ scanners = [
100
+ r
101
+ for r in recommendations
102
+ if "version" in r.get("name", "").lower()
103
+ ]
98
104
 
99
105
  for scanner in scanners:
100
- modules.append({
101
- 'module': scanner.get('path'),
102
- 'target_host': hm.get_host(host_id).get('ip_address'),
103
- 'target_service': service_name,
104
- 'risk': 'safe'
105
- })
106
+ modules.append(
107
+ {
108
+ "module": scanner.get("path"),
109
+ "target_host": hm.get_host(host_id).get("ip_address"),
110
+ "target_service": service_name,
111
+ "risk": "safe",
112
+ }
113
+ )
106
114
 
107
115
  return {
108
- 'name': 'reconnaissance',
109
- 'modules': modules,
110
- 'auto_advance': True,
111
- 'success_criteria': 'all_services_fingerprinted',
112
- 'expected_duration': f'{len(modules) * 30} seconds'
116
+ "name": "reconnaissance",
117
+ "modules": modules,
118
+ "auto_advance": True,
119
+ "success_criteria": "all_services_fingerprinted",
120
+ "expected_duration": f"{len(modules) * 30} seconds",
113
121
  }
114
122
  except:
115
123
  return {
116
- 'name': 'reconnaissance',
117
- 'modules': [],
118
- 'auto_advance': True,
119
- 'success_criteria': 'all_services_fingerprinted'
124
+ "name": "reconnaissance",
125
+ "modules": [],
126
+ "auto_advance": True,
127
+ "success_criteria": "all_services_fingerprinted",
120
128
  }
121
129
 
122
- def _build_exploitation_phase(self, target_hosts: List[int], risk_levels: List[str]) -> Dict:
130
+ def _build_exploitation_phase(
131
+ self, target_hosts: List[int], risk_levels: List[str]
132
+ ) -> Dict:
123
133
  """Build exploitation phase with ranked targets."""
124
134
  try:
125
135
  from souleyez.storage.hosts import HostManager
136
+
126
137
  hm = HostManager()
127
138
 
128
139
  exploits = []
@@ -131,49 +142,55 @@ class MSFChainEngine:
131
142
  services = hm.get_host_services(host_id)
132
143
 
133
144
  for service in services:
134
- service_name = service.get('service_name', '')
135
- version = service.get('service_version', '')
145
+ service_name = service.get("service_name", "")
146
+ version = service.get("service_version", "")
136
147
 
137
148
  # Get exploit recommendations
138
- recommendations = self.module_selector.get_recommendations_for_service(
139
- service=service_name,
140
- version=version,
141
- engagement_id=self.engagement_id,
142
- risk_levels=risk_levels,
143
- include_cve_matches=True
149
+ recommendations = (
150
+ self.module_selector.get_recommendations_for_service(
151
+ service=service_name,
152
+ version=version,
153
+ engagement_id=self.engagement_id,
154
+ risk_levels=risk_levels,
155
+ include_cve_matches=True,
156
+ )
144
157
  )
145
158
 
146
159
  # Filter to exploits only
147
- exploit_mods = [r for r in recommendations if r.get('category') == 'exploit']
160
+ exploit_mods = [
161
+ r for r in recommendations if r.get("category") == "exploit"
162
+ ]
148
163
 
149
164
  for exploit in exploit_mods:
150
- exploits.append({
151
- 'module': exploit.get('path'),
152
- 'target_host': hm.get_host(host_id).get('ip_address'),
153
- 'target_service': service_name,
154
- 'score': exploit.get('score', 0),
155
- 'cves': exploit.get('cve', []),
156
- 'reliability': exploit.get('reliability', 'unknown'),
157
- 'risk': exploit.get('risk', 'moderate')
158
- })
165
+ exploits.append(
166
+ {
167
+ "module": exploit.get("path"),
168
+ "target_host": hm.get_host(host_id).get("ip_address"),
169
+ "target_service": service_name,
170
+ "score": exploit.get("score", 0),
171
+ "cves": exploit.get("cve", []),
172
+ "reliability": exploit.get("reliability", "unknown"),
173
+ "risk": exploit.get("risk", "moderate"),
174
+ }
175
+ )
159
176
 
160
177
  # Sort by score descending
161
- exploits.sort(key=lambda x: x.get('score', 0), reverse=True)
178
+ exploits.sort(key=lambda x: x.get("score", 0), reverse=True)
162
179
 
163
180
  return {
164
- 'name': 'exploitation',
165
- 'modules': exploits[:20], # Top 20 exploits
166
- 'auto_advance': False,
167
- 'success_criteria': 'session_obtained',
168
- 'fallback': 'brute_force_authentication',
169
- 'expected_duration': f'{len(exploits[:20]) * 120} seconds'
181
+ "name": "exploitation",
182
+ "modules": exploits[:20], # Top 20 exploits
183
+ "auto_advance": False,
184
+ "success_criteria": "session_obtained",
185
+ "fallback": "brute_force_authentication",
186
+ "expected_duration": f"{len(exploits[:20]) * 120} seconds",
170
187
  }
171
188
  except:
172
189
  return {
173
- 'name': 'exploitation',
174
- 'modules': [],
175
- 'auto_advance': False,
176
- 'success_criteria': 'session_obtained'
190
+ "name": "exploitation",
191
+ "modules": [],
192
+ "auto_advance": False,
193
+ "success_criteria": "session_obtained",
177
194
  }
178
195
 
179
196
  def _build_post_exploitation_phase(self, objectives: List[str]) -> Dict:
@@ -183,44 +200,44 @@ class MSFChainEngine:
183
200
  # Common post-exploitation modules
184
201
  common_modules = [
185
202
  {
186
- 'module': 'post/multi/recon/local_exploit_suggester',
187
- 'description': 'Suggest local privilege escalation exploits',
188
- 'objective': 'escalate'
203
+ "module": "post/multi/recon/local_exploit_suggester",
204
+ "description": "Suggest local privilege escalation exploits",
205
+ "objective": "escalate",
189
206
  },
190
207
  {
191
- 'module': 'post/windows/gather/hashdump',
192
- 'description': 'Dump password hashes (Windows)',
193
- 'objective': 'escalate'
208
+ "module": "post/windows/gather/hashdump",
209
+ "description": "Dump password hashes (Windows)",
210
+ "objective": "escalate",
194
211
  },
195
212
  {
196
- 'module': 'post/linux/gather/hashdump',
197
- 'description': 'Dump password hashes (Linux)',
198
- 'objective': 'escalate'
213
+ "module": "post/linux/gather/hashdump",
214
+ "description": "Dump password hashes (Linux)",
215
+ "objective": "escalate",
199
216
  },
200
217
  {
201
- 'module': 'post/multi/manage/autoroute',
202
- 'description': 'Setup routing for pivoting',
203
- 'objective': 'pivot'
218
+ "module": "post/multi/manage/autoroute",
219
+ "description": "Setup routing for pivoting",
220
+ "objective": "pivot",
204
221
  },
205
222
  {
206
- 'module': 'post/windows/manage/persistence_exe',
207
- 'description': 'Install persistent backdoor (Windows)',
208
- 'objective': 'persist'
209
- }
223
+ "module": "post/windows/manage/persistence_exe",
224
+ "description": "Install persistent backdoor (Windows)",
225
+ "objective": "persist",
226
+ },
210
227
  ]
211
228
 
212
229
  # Filter by objectives
213
230
  for module in common_modules:
214
- if module['objective'] in objectives:
231
+ if module["objective"] in objectives:
215
232
  modules.append(module)
216
233
 
217
234
  return {
218
- 'name': 'post_exploitation',
219
- 'modules': modules,
220
- 'triggers': ['session_obtained'],
221
- 'auto_advance': False,
222
- 'success_criteria': 'credentials_dumped or persistence_established',
223
- 'expected_duration': f'{len(modules) * 60} seconds'
235
+ "name": "post_exploitation",
236
+ "modules": modules,
237
+ "triggers": ["session_obtained"],
238
+ "auto_advance": False,
239
+ "success_criteria": "credentials_dumped or persistence_established",
240
+ "expected_duration": f"{len(modules) * 60} seconds",
224
241
  }
225
242
 
226
243
  def generate_progressive_chain(self, host_id: int) -> Dict:
@@ -235,88 +252,101 @@ class MSFChainEngine:
235
252
  """
236
253
  try:
237
254
  from souleyez.storage.hosts import HostManager
255
+
238
256
  hm = HostManager()
239
257
 
240
258
  host = hm.get_host(host_id)
241
259
  services = hm.get_host_services(host_id)
242
260
 
243
261
  chain = {
244
- 'target': host.get('ip_address', 'Unknown'),
245
- 'host_id': host_id,
246
- 'phases': []
262
+ "target": host.get("ip_address", "Unknown"),
263
+ "host_id": host_id,
264
+ "phases": [],
247
265
  }
248
266
 
249
267
  # Phase 1: Reconnaissance
250
268
  recon_modules = self._build_recon_phase_for_host(host_id, services)
251
- chain['phases'].append({
252
- 'name': 'reconnaissance',
253
- 'modules': recon_modules,
254
- 'auto_advance': True,
255
- 'success_criteria': 'all_services_fingerprinted'
256
- })
269
+ chain["phases"].append(
270
+ {
271
+ "name": "reconnaissance",
272
+ "modules": recon_modules,
273
+ "auto_advance": True,
274
+ "success_criteria": "all_services_fingerprinted",
275
+ }
276
+ )
257
277
 
258
278
  # Phase 2: Vulnerability Assessment
259
279
  vuln_modules = self._build_vuln_assessment_phase(services)
260
- chain['phases'].append({
261
- 'name': 'vulnerability_assessment',
262
- 'modules': vuln_modules,
263
- 'auto_advance': False,
264
- 'success_criteria': 'vulnerabilities_confirmed'
265
- })
280
+ chain["phases"].append(
281
+ {
282
+ "name": "vulnerability_assessment",
283
+ "modules": vuln_modules,
284
+ "auto_advance": False,
285
+ "success_criteria": "vulnerabilities_confirmed",
286
+ }
287
+ )
266
288
 
267
289
  # Phase 3: Exploitation
268
290
  exploit_modules = self._build_exploitation_phase_for_host(host_id, services)
269
- chain['phases'].append({
270
- 'name': 'exploitation',
271
- 'modules': exploit_modules,
272
- 'auto_advance': False,
273
- 'success_criteria': 'session_obtained',
274
- 'fallback': 'brute_force_authentication'
275
- })
291
+ chain["phases"].append(
292
+ {
293
+ "name": "exploitation",
294
+ "modules": exploit_modules,
295
+ "auto_advance": False,
296
+ "success_criteria": "session_obtained",
297
+ "fallback": "brute_force_authentication",
298
+ }
299
+ )
276
300
 
277
301
  # Phase 4: Post-Exploitation
278
302
  post_modules = self._build_post_exploitation_phase_for_host(host)
279
- chain['phases'].append({
280
- 'name': 'post_exploitation',
281
- 'modules': post_modules,
282
- 'triggers': ['session_obtained'],
283
- 'auto_advance': False,
284
- 'success_criteria': 'credentials_dumped'
285
- })
303
+ chain["phases"].append(
304
+ {
305
+ "name": "post_exploitation",
306
+ "modules": post_modules,
307
+ "triggers": ["session_obtained"],
308
+ "auto_advance": False,
309
+ "success_criteria": "credentials_dumped",
310
+ }
311
+ )
286
312
 
287
313
  return chain
288
314
  except Exception as e:
289
- return {'target': 'Unknown', 'phases': [], 'error': str(e)}
315
+ return {"target": "Unknown", "phases": [], "error": str(e)}
290
316
 
291
- def _build_recon_phase_for_host(self, host_id: int, services: List[Dict]) -> List[Dict]:
317
+ def _build_recon_phase_for_host(
318
+ self, host_id: int, services: List[Dict]
319
+ ) -> List[Dict]:
292
320
  """Build recon modules for a specific host."""
293
321
  modules = []
294
322
 
295
323
  for service in services:
296
- service_name = service.get('service_name', '').lower()
324
+ service_name = service.get("service_name", "").lower()
297
325
 
298
326
  # Get version scanner
299
327
  version_module = self._get_version_scanner(service_name)
300
328
  if version_module:
301
- modules.append({
302
- 'module': version_module,
303
- 'target_service': service_name,
304
- 'risk': 'safe'
305
- })
329
+ modules.append(
330
+ {
331
+ "module": version_module,
332
+ "target_service": service_name,
333
+ "risk": "safe",
334
+ }
335
+ )
306
336
 
307
337
  return modules
308
338
 
309
339
  def _get_version_scanner(self, service_name: str) -> str:
310
340
  """Get version scanner module for service."""
311
341
  scanner_map = {
312
- 'ssh': 'auxiliary/scanner/ssh/ssh_version',
313
- 'smb': 'auxiliary/scanner/smb/smb_version',
314
- 'http': 'auxiliary/scanner/http/http_version',
315
- 'https': 'auxiliary/scanner/http/http_version',
316
- 'ftp': 'auxiliary/scanner/ftp/ftp_version',
317
- 'mysql': 'auxiliary/scanner/mysql/mysql_version',
318
- 'postgresql': 'auxiliary/scanner/postgres/postgres_version',
319
- 'mssql': 'auxiliary/scanner/mssql/mssql_ping'
342
+ "ssh": "auxiliary/scanner/ssh/ssh_version",
343
+ "smb": "auxiliary/scanner/smb/smb_version",
344
+ "http": "auxiliary/scanner/http/http_version",
345
+ "https": "auxiliary/scanner/http/http_version",
346
+ "ftp": "auxiliary/scanner/ftp/ftp_version",
347
+ "mysql": "auxiliary/scanner/mysql/mysql_version",
348
+ "postgresql": "auxiliary/scanner/postgres/postgres_version",
349
+ "mssql": "auxiliary/scanner/mssql/mssql_ping",
320
350
  }
321
351
 
322
352
  return scanner_map.get(service_name)
@@ -326,48 +356,56 @@ class MSFChainEngine:
326
356
  modules = []
327
357
 
328
358
  for service in services:
329
- service_name = service.get('service_name', '').lower()
359
+ service_name = service.get("service_name", "").lower()
330
360
 
331
361
  # Add service-specific vuln scanners
332
- if service_name == 'smb':
333
- modules.append({
334
- 'module': 'auxiliary/scanner/smb/smb_ms17_010',
335
- 'description': 'Check for MS17-010 (EternalBlue)',
336
- 'risk': 'safe'
337
- })
362
+ if service_name == "smb":
363
+ modules.append(
364
+ {
365
+ "module": "auxiliary/scanner/smb/smb_ms17_010",
366
+ "description": "Check for MS17-010 (EternalBlue)",
367
+ "risk": "safe",
368
+ }
369
+ )
338
370
 
339
371
  return modules
340
372
 
341
- def _build_exploitation_phase_for_host(self, host_id: int, services: List[Dict]) -> List[Dict]:
373
+ def _build_exploitation_phase_for_host(
374
+ self, host_id: int, services: List[Dict]
375
+ ) -> List[Dict]:
342
376
  """Build exploitation modules for a specific host."""
343
377
  exploits = []
344
378
 
345
379
  for service in services:
346
- service_id = service.get('id')
347
- service_name = service.get('service_name', '')
348
- version = service.get('service_version', '')
380
+ service_id = service.get("id")
381
+ service_name = service.get("service_name", "")
382
+ version = service.get("service_version", "")
349
383
 
350
384
  # Get exploit recommendations
351
385
  recommendations = self.module_selector.get_recommendations_for_service(
352
386
  service=service_name,
353
387
  version=version,
354
388
  engagement_id=self.engagement_id,
355
- include_cve_matches=True
389
+ include_cve_matches=True,
356
390
  )
357
391
 
358
392
  # Filter to exploits
359
- exploit_mods = [r for r in recommendations if r.get('category') == 'exploit']
393
+ exploit_mods = [
394
+ r for r in recommendations if r.get("category") == "exploit"
395
+ ]
360
396
 
361
397
  for exploit in exploit_mods:
362
- exploits.append({
363
- 'module': exploit.get('path'),
364
- 'score': exploit.get('score', 0),
365
- 'cves': exploit.get('cve', []),
366
- 'reliability': exploit.get('reliability', 'unknown')
367
- })
398
+ exploits.append(
399
+ {
400
+ "module": exploit.get("path"),
401
+ "score": exploit.get("score", 0),
402
+ "cves": exploit.get("cve", []),
403
+ "reliability": exploit.get("reliability", "unknown"),
404
+ }
405
+ )
368
406
 
369
407
  # Sort by score
370
- exploits.sort(key=lambda x: x.get('score', 0), reverse=True)
408
+ exploits.sort(key=lambda x: x.get("score", 0), reverse=True)
371
409
 
372
410
  return exploits
373
411
 
@@ -376,36 +414,42 @@ class MSFChainEngine:
376
414
  modules = []
377
415
 
378
416
  # OS-specific modules
379
- os_type = host.get('os', 'unknown').lower()
380
-
381
- if 'windows' in os_type:
382
- modules.extend([
383
- {
384
- 'module': 'post/windows/gather/hashdump',
385
- 'description': 'Dump password hashes'
386
- },
387
- {
388
- 'module': 'post/windows/gather/enum_patches',
389
- 'description': 'Enumerate installed patches'
390
- }
391
- ])
392
- elif 'linux' in os_type:
393
- modules.extend([
394
- {
395
- 'module': 'post/linux/gather/hashdump',
396
- 'description': 'Dump password hashes'
397
- },
398
- {
399
- 'module': 'post/linux/gather/enum_system',
400
- 'description': 'Enumerate system information'
401
- }
402
- ])
417
+ os_type = host.get("os", "unknown").lower()
418
+
419
+ if "windows" in os_type:
420
+ modules.extend(
421
+ [
422
+ {
423
+ "module": "post/windows/gather/hashdump",
424
+ "description": "Dump password hashes",
425
+ },
426
+ {
427
+ "module": "post/windows/gather/enum_patches",
428
+ "description": "Enumerate installed patches",
429
+ },
430
+ ]
431
+ )
432
+ elif "linux" in os_type:
433
+ modules.extend(
434
+ [
435
+ {
436
+ "module": "post/linux/gather/hashdump",
437
+ "description": "Dump password hashes",
438
+ },
439
+ {
440
+ "module": "post/linux/gather/enum_system",
441
+ "description": "Enumerate system information",
442
+ },
443
+ ]
444
+ )
403
445
 
404
446
  # Universal modules
405
- modules.append({
406
- 'module': 'post/multi/recon/local_exploit_suggester',
407
- 'description': 'Suggest privilege escalation exploits'
408
- })
447
+ modules.append(
448
+ {
449
+ "module": "post/multi/recon/local_exploit_suggester",
450
+ "description": "Suggest privilege escalation exploits",
451
+ }
452
+ )
409
453
 
410
454
  return modules
411
455
 
@@ -414,94 +458,88 @@ class MSFChainTemplates:
414
458
  """Pre-built attack chain templates for common scenarios."""
415
459
 
416
460
  TEMPLATES = {
417
- 'windows_domain_takeover': {
418
- 'name': 'Windows Domain Takeover',
419
- 'description': 'Progressive attack to compromise AD domain',
420
- 'phases': [
461
+ "windows_domain_takeover": {
462
+ "name": "Windows Domain Takeover",
463
+ "description": "Progressive attack to compromise AD domain",
464
+ "phases": [
421
465
  {
422
- 'name': 'Initial Foothold',
423
- 'modules': [
424
- 'auxiliary/scanner/smb/smb_ms17_010',
425
- 'exploit/windows/smb/ms17_010_eternalblue',
426
- 'auxiliary/scanner/smb/smb_enumshares'
427
- ]
466
+ "name": "Initial Foothold",
467
+ "modules": [
468
+ "auxiliary/scanner/smb/smb_ms17_010",
469
+ "exploit/windows/smb/ms17_010_eternalblue",
470
+ "auxiliary/scanner/smb/smb_enumshares",
471
+ ],
428
472
  },
429
473
  {
430
- 'name': 'Credential Harvesting',
431
- 'modules': [
432
- 'post/windows/gather/hashdump',
433
- 'post/windows/gather/credentials/credential_collector',
434
- 'post/windows/gather/cachedump'
474
+ "name": "Credential Harvesting",
475
+ "modules": [
476
+ "post/windows/gather/hashdump",
477
+ "post/windows/gather/credentials/credential_collector",
478
+ "post/windows/gather/cachedump",
435
479
  ],
436
- 'triggers': ['session_obtained']
480
+ "triggers": ["session_obtained"],
437
481
  },
438
482
  {
439
- 'name': 'Lateral Movement',
440
- 'modules': [
441
- 'exploit/windows/smb/psexec',
442
- 'exploit/windows/local/bypassuac'
483
+ "name": "Lateral Movement",
484
+ "modules": [
485
+ "exploit/windows/smb/psexec",
486
+ "exploit/windows/local/bypassuac",
443
487
  ],
444
- 'triggers': ['credentials_obtained']
445
- }
446
- ]
488
+ "triggers": ["credentials_obtained"],
489
+ },
490
+ ],
447
491
  },
448
- 'linux_privilege_escalation': {
449
- 'name': 'Linux Privilege Escalation Chain',
450
- 'description': 'Escalate from user to root on Linux',
451
- 'phases': [
492
+ "linux_privilege_escalation": {
493
+ "name": "Linux Privilege Escalation Chain",
494
+ "description": "Escalate from user to root on Linux",
495
+ "phases": [
452
496
  {
453
- 'name': 'Initial Access',
454
- 'modules': [
455
- 'auxiliary/scanner/ssh/ssh_login'
456
- ]
497
+ "name": "Initial Access",
498
+ "modules": ["auxiliary/scanner/ssh/ssh_login"],
457
499
  },
458
500
  {
459
- 'name': 'Enumeration',
460
- 'modules': [
461
- 'post/linux/gather/enum_system',
462
- 'post/linux/gather/checkvm',
463
- 'post/linux/gather/enum_configs'
501
+ "name": "Enumeration",
502
+ "modules": [
503
+ "post/linux/gather/enum_system",
504
+ "post/linux/gather/checkvm",
505
+ "post/linux/gather/enum_configs",
464
506
  ],
465
- 'triggers': ['session_obtained']
507
+ "triggers": ["session_obtained"],
466
508
  },
467
509
  {
468
- 'name': 'Privilege Escalation',
469
- 'modules': [
470
- 'exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec',
471
- 'exploit/linux/local/sudo_baron_samedit',
472
- 'post/multi/recon/local_exploit_suggester'
510
+ "name": "Privilege Escalation",
511
+ "modules": [
512
+ "exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec",
513
+ "exploit/linux/local/sudo_baron_samedit",
514
+ "post/multi/recon/local_exploit_suggester",
473
515
  ],
474
- 'triggers': ['user_session_obtained']
475
- }
476
- ]
516
+ "triggers": ["user_session_obtained"],
517
+ },
518
+ ],
477
519
  },
478
- 'web_app_to_system': {
479
- 'name': 'Web Application to System Access',
480
- 'description': 'From web vuln to full system compromise',
481
- 'phases': [
520
+ "web_app_to_system": {
521
+ "name": "Web Application to System Access",
522
+ "description": "From web vuln to full system compromise",
523
+ "phases": [
482
524
  {
483
- 'name': 'Web Exploitation',
484
- 'modules': [
485
- 'auxiliary/scanner/http/dir_scanner',
486
- 'exploit/multi/http/php_cgi_arg_injection'
487
- ]
525
+ "name": "Web Exploitation",
526
+ "modules": [
527
+ "auxiliary/scanner/http/dir_scanner",
528
+ "exploit/multi/http/php_cgi_arg_injection",
529
+ ],
488
530
  },
489
531
  {
490
- 'name': 'Reverse Shell',
491
- 'modules': [
492
- 'payload/php/meterpreter/reverse_tcp'
493
- ],
494
- 'triggers': ['web_access_obtained']
532
+ "name": "Reverse Shell",
533
+ "modules": ["payload/php/meterpreter/reverse_tcp"],
534
+ "triggers": ["web_access_obtained"],
495
535
  },
496
536
  {
497
- 'name': 'Privilege Escalation',
498
- 'modules': [
499
- 'post/multi/recon/local_exploit_suggester'
500
- ],
501
- 'triggers': ['shell_obtained']
502
- }
503
- ]
504
- }
537
+ "name": "Privilege Escalation",
538
+ "modules": ["post/multi/recon/local_exploit_suggester"],
539
+ "triggers": ["shell_obtained"],
540
+ },
541
+ ],
542
+ },
505
543
  }
506
544
 
507
545
  @classmethod