souleyez 2.43.29__py3-none-any.whl → 2.43.34__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.


This version of souleyez might be problematic. Click here for more details.

Files changed (358) hide show
  1. souleyez/__init__.py +1 -2
  2. souleyez/ai/__init__.py +21 -15
  3. souleyez/ai/action_mapper.py +249 -150
  4. souleyez/ai/chain_advisor.py +116 -100
  5. souleyez/ai/claude_provider.py +29 -28
  6. souleyez/ai/context_builder.py +80 -62
  7. souleyez/ai/executor.py +158 -117
  8. souleyez/ai/feedback_handler.py +136 -121
  9. souleyez/ai/llm_factory.py +27 -20
  10. souleyez/ai/llm_provider.py +4 -2
  11. souleyez/ai/ollama_provider.py +6 -9
  12. souleyez/ai/ollama_service.py +44 -37
  13. souleyez/ai/path_scorer.py +91 -76
  14. souleyez/ai/recommender.py +176 -144
  15. souleyez/ai/report_context.py +74 -73
  16. souleyez/ai/report_service.py +84 -66
  17. souleyez/ai/result_parser.py +222 -229
  18. souleyez/ai/safety.py +67 -44
  19. souleyez/auth/__init__.py +23 -22
  20. souleyez/auth/audit.py +36 -26
  21. souleyez/auth/engagement_access.py +65 -48
  22. souleyez/auth/permissions.py +14 -3
  23. souleyez/auth/session_manager.py +54 -37
  24. souleyez/auth/user_manager.py +109 -64
  25. souleyez/commands/audit.py +40 -43
  26. souleyez/commands/auth.py +35 -15
  27. souleyez/commands/deliverables.py +55 -50
  28. souleyez/commands/engagement.py +47 -28
  29. souleyez/commands/license.py +32 -23
  30. souleyez/commands/screenshots.py +36 -32
  31. souleyez/commands/user.py +82 -36
  32. souleyez/config.py +52 -44
  33. souleyez/core/credential_tester.py +87 -81
  34. souleyez/core/cve_mappings.py +179 -192
  35. souleyez/core/cve_matcher.py +162 -148
  36. souleyez/core/msf_auto_mapper.py +100 -83
  37. souleyez/core/msf_chain_engine.py +294 -256
  38. souleyez/core/msf_database.py +153 -70
  39. souleyez/core/msf_integration.py +679 -673
  40. souleyez/core/msf_rpc_client.py +40 -42
  41. souleyez/core/msf_rpc_manager.py +77 -79
  42. souleyez/core/msf_sync_manager.py +241 -181
  43. souleyez/core/network_utils.py +22 -15
  44. souleyez/core/parser_handler.py +34 -25
  45. souleyez/core/pending_chains.py +114 -63
  46. souleyez/core/templates.py +158 -107
  47. souleyez/core/tool_chaining.py +9526 -2879
  48. souleyez/core/version_utils.py +79 -94
  49. souleyez/core/vuln_correlation.py +136 -89
  50. souleyez/core/web_utils.py +33 -32
  51. souleyez/data/wordlists/ad_users.txt +378 -0
  52. souleyez/data/wordlists/api_endpoints_large.txt +769 -0
  53. souleyez/data/wordlists/home_dir_sensitive.txt +39 -0
  54. souleyez/data/wordlists/lfi_payloads.txt +82 -0
  55. souleyez/data/wordlists/passwords_brute.txt +1548 -0
  56. souleyez/data/wordlists/passwords_crack.txt +2479 -0
  57. souleyez/data/wordlists/passwords_spray.txt +386 -0
  58. souleyez/data/wordlists/subdomains_large.txt +5057 -0
  59. souleyez/data/wordlists/usernames_common.txt +694 -0
  60. souleyez/data/wordlists/web_dirs_large.txt +4769 -0
  61. souleyez/detection/__init__.py +1 -1
  62. souleyez/detection/attack_signatures.py +12 -17
  63. souleyez/detection/mitre_mappings.py +61 -55
  64. souleyez/detection/validator.py +97 -86
  65. souleyez/devtools.py +23 -10
  66. souleyez/docs/README.md +4 -4
  67. souleyez/docs/api-reference/cli-commands.md +2 -2
  68. souleyez/docs/developer-guide/adding-new-tools.md +562 -0
  69. souleyez/docs/user-guide/auto-chaining.md +30 -8
  70. souleyez/docs/user-guide/getting-started.md +1 -1
  71. souleyez/docs/user-guide/installation.md +26 -3
  72. souleyez/docs/user-guide/metasploit-integration.md +2 -2
  73. souleyez/docs/user-guide/rbac.md +1 -1
  74. souleyez/docs/user-guide/scope-management.md +1 -1
  75. souleyez/docs/user-guide/siem-integration.md +1 -1
  76. souleyez/docs/user-guide/tools-reference.md +1 -8
  77. souleyez/docs/user-guide/worker-management.md +1 -1
  78. souleyez/engine/background.py +1239 -535
  79. souleyez/engine/base.py +4 -1
  80. souleyez/engine/job_status.py +17 -49
  81. souleyez/engine/log_sanitizer.py +103 -77
  82. souleyez/engine/manager.py +38 -7
  83. souleyez/engine/result_handler.py +2200 -1550
  84. souleyez/engine/worker_manager.py +50 -41
  85. souleyez/export/evidence_bundle.py +72 -62
  86. souleyez/feature_flags/features.py +16 -20
  87. souleyez/feature_flags.py +5 -9
  88. souleyez/handlers/__init__.py +11 -0
  89. souleyez/handlers/base.py +188 -0
  90. souleyez/handlers/bash_handler.py +277 -0
  91. souleyez/handlers/bloodhound_handler.py +243 -0
  92. souleyez/handlers/certipy_handler.py +311 -0
  93. souleyez/handlers/crackmapexec_handler.py +486 -0
  94. souleyez/handlers/dnsrecon_handler.py +344 -0
  95. souleyez/handlers/enum4linux_handler.py +400 -0
  96. souleyez/handlers/evil_winrm_handler.py +493 -0
  97. souleyez/handlers/ffuf_handler.py +815 -0
  98. souleyez/handlers/gobuster_handler.py +1114 -0
  99. souleyez/handlers/gpp_extract_handler.py +334 -0
  100. souleyez/handlers/hashcat_handler.py +444 -0
  101. souleyez/handlers/hydra_handler.py +563 -0
  102. souleyez/handlers/impacket_getuserspns_handler.py +343 -0
  103. souleyez/handlers/impacket_psexec_handler.py +222 -0
  104. souleyez/handlers/impacket_secretsdump_handler.py +426 -0
  105. souleyez/handlers/john_handler.py +286 -0
  106. souleyez/handlers/katana_handler.py +425 -0
  107. souleyez/handlers/kerbrute_handler.py +298 -0
  108. souleyez/handlers/ldapsearch_handler.py +636 -0
  109. souleyez/handlers/lfi_extract_handler.py +464 -0
  110. souleyez/handlers/msf_auxiliary_handler.py +408 -0
  111. souleyez/handlers/msf_exploit_handler.py +380 -0
  112. souleyez/handlers/nikto_handler.py +413 -0
  113. souleyez/handlers/nmap_handler.py +821 -0
  114. souleyez/handlers/nuclei_handler.py +359 -0
  115. souleyez/handlers/nxc_handler.py +371 -0
  116. souleyez/handlers/rdp_sec_check_handler.py +353 -0
  117. souleyez/handlers/registry.py +292 -0
  118. souleyez/handlers/responder_handler.py +232 -0
  119. souleyez/handlers/service_explorer_handler.py +434 -0
  120. souleyez/handlers/smbclient_handler.py +344 -0
  121. souleyez/handlers/smbmap_handler.py +510 -0
  122. souleyez/handlers/smbpasswd_handler.py +296 -0
  123. souleyez/handlers/sqlmap_handler.py +1116 -0
  124. souleyez/handlers/theharvester_handler.py +601 -0
  125. souleyez/handlers/web_login_test_handler.py +327 -0
  126. souleyez/handlers/whois_handler.py +277 -0
  127. souleyez/handlers/wpscan_handler.py +554 -0
  128. souleyez/history.py +32 -16
  129. souleyez/importers/msf_importer.py +106 -75
  130. souleyez/importers/smart_importer.py +208 -147
  131. souleyez/integrations/siem/__init__.py +10 -10
  132. souleyez/integrations/siem/base.py +17 -18
  133. souleyez/integrations/siem/elastic.py +108 -122
  134. souleyez/integrations/siem/factory.py +207 -80
  135. souleyez/integrations/siem/googlesecops.py +146 -154
  136. souleyez/integrations/siem/rule_mappings/__init__.py +1 -1
  137. souleyez/integrations/siem/rule_mappings/wazuh_rules.py +8 -5
  138. souleyez/integrations/siem/sentinel.py +107 -109
  139. souleyez/integrations/siem/splunk.py +246 -212
  140. souleyez/integrations/siem/wazuh.py +65 -71
  141. souleyez/integrations/wazuh/__init__.py +5 -5
  142. souleyez/integrations/wazuh/client.py +70 -93
  143. souleyez/integrations/wazuh/config.py +85 -57
  144. souleyez/integrations/wazuh/host_mapper.py +28 -36
  145. souleyez/integrations/wazuh/sync.py +78 -68
  146. souleyez/intelligence/__init__.py +4 -5
  147. souleyez/intelligence/correlation_analyzer.py +309 -295
  148. souleyez/intelligence/exploit_knowledge.py +661 -623
  149. souleyez/intelligence/exploit_suggestions.py +159 -139
  150. souleyez/intelligence/gap_analyzer.py +132 -97
  151. souleyez/intelligence/gap_detector.py +251 -214
  152. souleyez/intelligence/sensitive_tables.py +266 -129
  153. souleyez/intelligence/service_parser.py +137 -123
  154. souleyez/intelligence/surface_analyzer.py +407 -268
  155. souleyez/intelligence/target_parser.py +159 -162
  156. souleyez/licensing/__init__.py +6 -6
  157. souleyez/licensing/validator.py +17 -19
  158. souleyez/log_config.py +79 -54
  159. souleyez/main.py +1505 -687
  160. souleyez/migrations/fix_job_counter.py +16 -14
  161. souleyez/parsers/bloodhound_parser.py +41 -39
  162. souleyez/parsers/crackmapexec_parser.py +178 -111
  163. souleyez/parsers/dalfox_parser.py +72 -77
  164. souleyez/parsers/dnsrecon_parser.py +103 -91
  165. souleyez/parsers/enum4linux_parser.py +183 -153
  166. souleyez/parsers/ffuf_parser.py +29 -25
  167. souleyez/parsers/gobuster_parser.py +301 -41
  168. souleyez/parsers/hashcat_parser.py +324 -79
  169. souleyez/parsers/http_fingerprint_parser.py +350 -103
  170. souleyez/parsers/hydra_parser.py +131 -111
  171. souleyez/parsers/impacket_parser.py +231 -178
  172. souleyez/parsers/john_parser.py +98 -86
  173. souleyez/parsers/katana_parser.py +316 -0
  174. souleyez/parsers/msf_parser.py +943 -498
  175. souleyez/parsers/nikto_parser.py +346 -65
  176. souleyez/parsers/nmap_parser.py +262 -174
  177. souleyez/parsers/nuclei_parser.py +40 -44
  178. souleyez/parsers/responder_parser.py +26 -26
  179. souleyez/parsers/searchsploit_parser.py +74 -74
  180. souleyez/parsers/service_explorer_parser.py +279 -0
  181. souleyez/parsers/smbmap_parser.py +180 -124
  182. souleyez/parsers/sqlmap_parser.py +434 -308
  183. souleyez/parsers/theharvester_parser.py +75 -57
  184. souleyez/parsers/whois_parser.py +135 -94
  185. souleyez/parsers/wpscan_parser.py +278 -190
  186. souleyez/plugins/afp.py +44 -36
  187. souleyez/plugins/afp_brute.py +114 -46
  188. souleyez/plugins/ard.py +48 -37
  189. souleyez/plugins/bloodhound.py +95 -61
  190. souleyez/plugins/certipy.py +303 -0
  191. souleyez/plugins/crackmapexec.py +186 -85
  192. souleyez/plugins/dalfox.py +120 -59
  193. souleyez/plugins/dns_hijack.py +146 -41
  194. souleyez/plugins/dnsrecon.py +97 -61
  195. souleyez/plugins/enum4linux.py +91 -66
  196. souleyez/plugins/evil_winrm.py +291 -0
  197. souleyez/plugins/ffuf.py +166 -90
  198. souleyez/plugins/firmware_extract.py +133 -29
  199. souleyez/plugins/gobuster.py +387 -190
  200. souleyez/plugins/gpp_extract.py +393 -0
  201. souleyez/plugins/hashcat.py +100 -73
  202. souleyez/plugins/http_fingerprint.py +854 -267
  203. souleyez/plugins/hydra.py +566 -200
  204. souleyez/plugins/impacket_getnpusers.py +117 -69
  205. souleyez/plugins/impacket_psexec.py +84 -64
  206. souleyez/plugins/impacket_secretsdump.py +103 -69
  207. souleyez/plugins/impacket_smbclient.py +89 -75
  208. souleyez/plugins/john.py +86 -69
  209. souleyez/plugins/katana.py +313 -0
  210. souleyez/plugins/kerbrute.py +237 -0
  211. souleyez/plugins/lfi_extract.py +541 -0
  212. souleyez/plugins/macos_ssh.py +117 -48
  213. souleyez/plugins/mdns.py +35 -30
  214. souleyez/plugins/msf_auxiliary.py +253 -130
  215. souleyez/plugins/msf_exploit.py +239 -161
  216. souleyez/plugins/nikto.py +134 -78
  217. souleyez/plugins/nmap.py +275 -91
  218. souleyez/plugins/nuclei.py +180 -89
  219. souleyez/plugins/nxc.py +285 -0
  220. souleyez/plugins/plugin_base.py +35 -36
  221. souleyez/plugins/plugin_template.py +13 -5
  222. souleyez/plugins/rdp_sec_check.py +130 -0
  223. souleyez/plugins/responder.py +112 -71
  224. souleyez/plugins/router_http_brute.py +76 -65
  225. souleyez/plugins/router_ssh_brute.py +118 -41
  226. souleyez/plugins/router_telnet_brute.py +124 -42
  227. souleyez/plugins/routersploit.py +91 -59
  228. souleyez/plugins/routersploit_exploit.py +77 -55
  229. souleyez/plugins/searchsploit.py +91 -77
  230. souleyez/plugins/service_explorer.py +1160 -0
  231. souleyez/plugins/smbmap.py +122 -72
  232. souleyez/plugins/smbpasswd.py +215 -0
  233. souleyez/plugins/sqlmap.py +301 -113
  234. souleyez/plugins/theharvester.py +127 -75
  235. souleyez/plugins/tr069.py +79 -57
  236. souleyez/plugins/upnp.py +65 -47
  237. souleyez/plugins/upnp_abuse.py +73 -55
  238. souleyez/plugins/vnc_access.py +129 -42
  239. souleyez/plugins/vnc_brute.py +109 -38
  240. souleyez/plugins/web_login_test.py +417 -0
  241. souleyez/plugins/whois.py +77 -58
  242. souleyez/plugins/wpscan.py +173 -69
  243. souleyez/reporting/__init__.py +2 -1
  244. souleyez/reporting/attack_chain.py +411 -346
  245. souleyez/reporting/charts.py +436 -501
  246. souleyez/reporting/compliance_mappings.py +334 -201
  247. souleyez/reporting/detection_report.py +126 -125
  248. souleyez/reporting/formatters.py +828 -591
  249. souleyez/reporting/generator.py +386 -302
  250. souleyez/reporting/metrics.py +72 -75
  251. souleyez/scanner.py +35 -29
  252. souleyez/security/__init__.py +37 -11
  253. souleyez/security/scope_validator.py +175 -106
  254. souleyez/security/validation.py +223 -149
  255. souleyez/security.py +22 -6
  256. souleyez/storage/credentials.py +247 -186
  257. souleyez/storage/crypto.py +296 -129
  258. souleyez/storage/database.py +73 -50
  259. souleyez/storage/db.py +58 -36
  260. souleyez/storage/deliverable_evidence.py +177 -128
  261. souleyez/storage/deliverable_exporter.py +282 -246
  262. souleyez/storage/deliverable_templates.py +134 -116
  263. souleyez/storage/deliverables.py +135 -130
  264. souleyez/storage/engagements.py +109 -56
  265. souleyez/storage/evidence.py +181 -152
  266. souleyez/storage/execution_log.py +31 -17
  267. souleyez/storage/exploit_attempts.py +93 -57
  268. souleyez/storage/exploits.py +67 -36
  269. souleyez/storage/findings.py +48 -61
  270. souleyez/storage/hosts.py +176 -144
  271. souleyez/storage/migrate_to_engagements.py +43 -19
  272. souleyez/storage/migrations/_001_add_credential_enhancements.py +22 -12
  273. souleyez/storage/migrations/_002_add_status_tracking.py +10 -7
  274. souleyez/storage/migrations/_003_add_execution_log.py +14 -8
  275. souleyez/storage/migrations/_005_screenshots.py +13 -5
  276. souleyez/storage/migrations/_006_deliverables.py +13 -5
  277. souleyez/storage/migrations/_007_deliverable_templates.py +12 -7
  278. souleyez/storage/migrations/_008_add_nuclei_table.py +10 -4
  279. souleyez/storage/migrations/_010_evidence_linking.py +17 -10
  280. souleyez/storage/migrations/_011_timeline_tracking.py +20 -13
  281. souleyez/storage/migrations/_012_team_collaboration.py +34 -21
  282. souleyez/storage/migrations/_013_add_host_tags.py +12 -6
  283. souleyez/storage/migrations/_014_exploit_attempts.py +22 -10
  284. souleyez/storage/migrations/_015_add_mac_os_fields.py +15 -7
  285. souleyez/storage/migrations/_016_add_domain_field.py +10 -4
  286. souleyez/storage/migrations/_017_msf_sessions.py +16 -8
  287. souleyez/storage/migrations/_018_add_osint_target.py +10 -6
  288. souleyez/storage/migrations/_019_add_engagement_type.py +10 -6
  289. souleyez/storage/migrations/_020_add_rbac.py +36 -15
  290. souleyez/storage/migrations/_021_wazuh_integration.py +20 -8
  291. souleyez/storage/migrations/_022_wazuh_indexer_columns.py +6 -4
  292. souleyez/storage/migrations/_023_fix_detection_results_fk.py +16 -6
  293. souleyez/storage/migrations/_024_wazuh_vulnerabilities.py +26 -10
  294. souleyez/storage/migrations/_025_multi_siem_support.py +3 -5
  295. souleyez/storage/migrations/_026_add_engagement_scope.py +31 -12
  296. souleyez/storage/migrations/_027_multi_siem_persistence.py +32 -15
  297. souleyez/storage/migrations/__init__.py +26 -26
  298. souleyez/storage/migrations/migration_manager.py +19 -19
  299. souleyez/storage/msf_sessions.py +100 -65
  300. souleyez/storage/osint.py +17 -24
  301. souleyez/storage/recommendation_engine.py +269 -235
  302. souleyez/storage/screenshots.py +33 -32
  303. souleyez/storage/smb_shares.py +136 -92
  304. souleyez/storage/sqlmap_data.py +183 -128
  305. souleyez/storage/team_collaboration.py +135 -141
  306. souleyez/storage/timeline_tracker.py +122 -94
  307. souleyez/storage/wazuh_vulns.py +64 -66
  308. souleyez/storage/web_paths.py +33 -37
  309. souleyez/testing/credential_tester.py +221 -205
  310. souleyez/ui/__init__.py +1 -1
  311. souleyez/ui/ai_quotes.py +12 -12
  312. souleyez/ui/attack_surface.py +2439 -1516
  313. souleyez/ui/chain_rules_view.py +914 -382
  314. souleyez/ui/correlation_view.py +312 -230
  315. souleyez/ui/dashboard.py +2382 -1130
  316. souleyez/ui/deliverables_view.py +148 -62
  317. souleyez/ui/design_system.py +13 -13
  318. souleyez/ui/errors.py +49 -49
  319. souleyez/ui/evidence_linking_view.py +284 -179
  320. souleyez/ui/evidence_vault.py +393 -285
  321. souleyez/ui/exploit_suggestions_view.py +555 -349
  322. souleyez/ui/export_view.py +100 -66
  323. souleyez/ui/gap_analysis_view.py +315 -171
  324. souleyez/ui/help_system.py +105 -97
  325. souleyez/ui/intelligence_view.py +436 -293
  326. souleyez/ui/interactive.py +22827 -10678
  327. souleyez/ui/interactive_selector.py +75 -68
  328. souleyez/ui/log_formatter.py +47 -39
  329. souleyez/ui/menu_components.py +22 -13
  330. souleyez/ui/msf_auxiliary_menu.py +184 -133
  331. souleyez/ui/pending_chains_view.py +336 -172
  332. souleyez/ui/progress_indicators.py +5 -3
  333. souleyez/ui/recommendations_view.py +195 -137
  334. souleyez/ui/rule_builder.py +343 -225
  335. souleyez/ui/setup_wizard.py +678 -284
  336. souleyez/ui/shortcuts.py +217 -165
  337. souleyez/ui/splunk_gap_analysis_view.py +452 -270
  338. souleyez/ui/splunk_vulns_view.py +139 -86
  339. souleyez/ui/team_dashboard.py +498 -335
  340. souleyez/ui/template_selector.py +196 -105
  341. souleyez/ui/terminal.py +6 -6
  342. souleyez/ui/timeline_view.py +198 -127
  343. souleyez/ui/tool_setup.py +264 -164
  344. souleyez/ui/tutorial.py +202 -72
  345. souleyez/ui/tutorial_state.py +40 -40
  346. souleyez/ui/wazuh_vulns_view.py +235 -141
  347. souleyez/ui/wordlist_browser.py +260 -107
  348. souleyez/ui.py +464 -312
  349. souleyez/utils/tool_checker.py +427 -367
  350. souleyez/utils.py +33 -29
  351. souleyez/wordlists.py +134 -167
  352. {souleyez-2.43.29.dist-info → souleyez-2.43.34.dist-info}/METADATA +1 -1
  353. souleyez-2.43.34.dist-info/RECORD +443 -0
  354. {souleyez-2.43.29.dist-info → souleyez-2.43.34.dist-info}/WHEEL +1 -1
  355. souleyez-2.43.29.dist-info/RECORD +0 -379
  356. {souleyez-2.43.29.dist-info → souleyez-2.43.34.dist-info}/entry_points.txt +0 -0
  357. {souleyez-2.43.29.dist-info → souleyez-2.43.34.dist-info}/licenses/LICENSE +0 -0
  358. {souleyez-2.43.29.dist-info → souleyez-2.43.34.dist-info}/top_level.txt +0 -0
@@ -20,7 +20,7 @@ class MSFChainEngine:
20
20
  self,
21
21
  target_hosts: List[int],
22
22
  objectives: List[str] = None,
23
- risk_tolerance: str = 'moderate'
23
+ risk_tolerance: str = "moderate",
24
24
  ) -> Dict:
25
25
  """
26
26
  Build progressive attack chain.
@@ -34,42 +34,44 @@ class MSFChainEngine:
34
34
  Chain definition with phases and modules
35
35
  """
36
36
  if objectives is None:
37
- objectives = ['recon', 'exploit', 'escalate']
37
+ objectives = ["recon", "exploit", "escalate"]
38
38
 
39
39
  # Map risk tolerance to risk levels
40
40
  risk_map = {
41
- 'safe': ['safe'],
42
- 'moderate': ['safe', 'noisy', 'moderate'],
43
- 'aggressive': ['safe', 'noisy', 'moderate', 'dangerous']
41
+ "safe": ["safe"],
42
+ "moderate": ["safe", "noisy", "moderate"],
43
+ "aggressive": ["safe", "noisy", "moderate", "dangerous"],
44
44
  }
45
- risk_levels = risk_map.get(risk_tolerance, ['safe', 'noisy'])
45
+ risk_levels = risk_map.get(risk_tolerance, ["safe", "noisy"])
46
46
 
47
47
  chain = {
48
- 'chain_id': f'attack_chain_{self.engagement_id}',
49
- 'engagement_id': self.engagement_id,
50
- 'target_hosts': target_hosts,
51
- 'objectives': objectives,
52
- 'risk_tolerance': risk_tolerance,
53
- 'phases': []
48
+ "chain_id": f"attack_chain_{self.engagement_id}",
49
+ "engagement_id": self.engagement_id,
50
+ "target_hosts": target_hosts,
51
+ "objectives": objectives,
52
+ "risk_tolerance": risk_tolerance,
53
+ "phases": [],
54
54
  }
55
55
 
56
56
  # Build phases based on objectives
57
- if 'recon' in objectives:
58
- chain['phases'].append(self._build_recon_phase(target_hosts))
57
+ if "recon" in objectives:
58
+ chain["phases"].append(self._build_recon_phase(target_hosts))
59
59
 
60
- if 'exploit' in objectives:
61
- chain['phases'].append(self._build_exploitation_phase(target_hosts, risk_levels))
60
+ if "exploit" in objectives:
61
+ chain["phases"].append(
62
+ self._build_exploitation_phase(target_hosts, risk_levels)
63
+ )
62
64
 
63
- if 'escalate' in objectives or 'pivot' in objectives or 'persist' in objectives:
65
+ if "escalate" in objectives or "pivot" in objectives or "persist" in objectives:
64
66
  post_objectives = []
65
- if 'escalate' in objectives:
66
- post_objectives.append('escalate')
67
- if 'pivot' in objectives:
68
- post_objectives.append('pivot')
69
- if 'persist' in objectives:
70
- post_objectives.append('persist')
67
+ if "escalate" in objectives:
68
+ post_objectives.append("escalate")
69
+ if "pivot" in objectives:
70
+ post_objectives.append("pivot")
71
+ if "persist" in objectives:
72
+ post_objectives.append("persist")
71
73
 
72
- chain['phases'].append(self._build_post_exploitation_phase(post_objectives))
74
+ chain["phases"].append(self._build_post_exploitation_phase(post_objectives))
73
75
 
74
76
  return chain
75
77
 
@@ -77,6 +79,7 @@ class MSFChainEngine:
77
79
  """Build reconnaissance phase."""
78
80
  try:
79
81
  from souleyez.storage.hosts import HostManager
82
+
80
83
  hm = HostManager()
81
84
 
82
85
  modules = []
@@ -85,44 +88,52 @@ class MSFChainEngine:
85
88
  services = hm.get_host_services(host_id)
86
89
 
87
90
  for service in services:
88
- service_name = service.get('service_name', '').lower()
91
+ service_name = service.get("service_name", "").lower()
89
92
 
90
93
  # Get version scanners
91
94
  recommendations = self.module_selector.get_recommendations(
92
- service=service_name,
93
- include_risk=['safe']
95
+ service=service_name, include_risk=["safe"]
94
96
  )
95
97
 
96
98
  # Filter to version scanners
97
- scanners = [r for r in recommendations if 'version' in r.get('name', '').lower()]
99
+ scanners = [
100
+ r
101
+ for r in recommendations
102
+ if "version" in r.get("name", "").lower()
103
+ ]
98
104
 
99
105
  for scanner in scanners:
100
- modules.append({
101
- 'module': scanner.get('path'),
102
- 'target_host': hm.get_host(host_id).get('ip_address'),
103
- 'target_service': service_name,
104
- 'risk': 'safe'
105
- })
106
+ modules.append(
107
+ {
108
+ "module": scanner.get("path"),
109
+ "target_host": hm.get_host(host_id).get("ip_address"),
110
+ "target_service": service_name,
111
+ "risk": "safe",
112
+ }
113
+ )
106
114
 
107
115
  return {
108
- 'name': 'reconnaissance',
109
- 'modules': modules,
110
- 'auto_advance': True,
111
- 'success_criteria': 'all_services_fingerprinted',
112
- 'expected_duration': f'{len(modules) * 30} seconds'
116
+ "name": "reconnaissance",
117
+ "modules": modules,
118
+ "auto_advance": True,
119
+ "success_criteria": "all_services_fingerprinted",
120
+ "expected_duration": f"{len(modules) * 30} seconds",
113
121
  }
114
122
  except:
115
123
  return {
116
- 'name': 'reconnaissance',
117
- 'modules': [],
118
- 'auto_advance': True,
119
- 'success_criteria': 'all_services_fingerprinted'
124
+ "name": "reconnaissance",
125
+ "modules": [],
126
+ "auto_advance": True,
127
+ "success_criteria": "all_services_fingerprinted",
120
128
  }
121
129
 
122
- def _build_exploitation_phase(self, target_hosts: List[int], risk_levels: List[str]) -> Dict:
130
+ def _build_exploitation_phase(
131
+ self, target_hosts: List[int], risk_levels: List[str]
132
+ ) -> Dict:
123
133
  """Build exploitation phase with ranked targets."""
124
134
  try:
125
135
  from souleyez.storage.hosts import HostManager
136
+
126
137
  hm = HostManager()
127
138
 
128
139
  exploits = []
@@ -131,49 +142,55 @@ class MSFChainEngine:
131
142
  services = hm.get_host_services(host_id)
132
143
 
133
144
  for service in services:
134
- service_name = service.get('service_name', '')
135
- version = service.get('service_version', '')
145
+ service_name = service.get("service_name", "")
146
+ version = service.get("service_version", "")
136
147
 
137
148
  # Get exploit recommendations
138
- recommendations = self.module_selector.get_recommendations_for_service(
139
- service=service_name,
140
- version=version,
141
- engagement_id=self.engagement_id,
142
- risk_levels=risk_levels,
143
- include_cve_matches=True
149
+ recommendations = (
150
+ self.module_selector.get_recommendations_for_service(
151
+ service=service_name,
152
+ version=version,
153
+ engagement_id=self.engagement_id,
154
+ risk_levels=risk_levels,
155
+ include_cve_matches=True,
156
+ )
144
157
  )
145
158
 
146
159
  # Filter to exploits only
147
- exploit_mods = [r for r in recommendations if r.get('category') == 'exploit']
160
+ exploit_mods = [
161
+ r for r in recommendations if r.get("category") == "exploit"
162
+ ]
148
163
 
149
164
  for exploit in exploit_mods:
150
- exploits.append({
151
- 'module': exploit.get('path'),
152
- 'target_host': hm.get_host(host_id).get('ip_address'),
153
- 'target_service': service_name,
154
- 'score': exploit.get('score', 0),
155
- 'cves': exploit.get('cve', []),
156
- 'reliability': exploit.get('reliability', 'unknown'),
157
- 'risk': exploit.get('risk', 'moderate')
158
- })
165
+ exploits.append(
166
+ {
167
+ "module": exploit.get("path"),
168
+ "target_host": hm.get_host(host_id).get("ip_address"),
169
+ "target_service": service_name,
170
+ "score": exploit.get("score", 0),
171
+ "cves": exploit.get("cve", []),
172
+ "reliability": exploit.get("reliability", "unknown"),
173
+ "risk": exploit.get("risk", "moderate"),
174
+ }
175
+ )
159
176
 
160
177
  # Sort by score descending
161
- exploits.sort(key=lambda x: x.get('score', 0), reverse=True)
178
+ exploits.sort(key=lambda x: x.get("score", 0), reverse=True)
162
179
 
163
180
  return {
164
- 'name': 'exploitation',
165
- 'modules': exploits[:20], # Top 20 exploits
166
- 'auto_advance': False,
167
- 'success_criteria': 'session_obtained',
168
- 'fallback': 'brute_force_authentication',
169
- 'expected_duration': f'{len(exploits[:20]) * 120} seconds'
181
+ "name": "exploitation",
182
+ "modules": exploits[:20], # Top 20 exploits
183
+ "auto_advance": False,
184
+ "success_criteria": "session_obtained",
185
+ "fallback": "brute_force_authentication",
186
+ "expected_duration": f"{len(exploits[:20]) * 120} seconds",
170
187
  }
171
188
  except:
172
189
  return {
173
- 'name': 'exploitation',
174
- 'modules': [],
175
- 'auto_advance': False,
176
- 'success_criteria': 'session_obtained'
190
+ "name": "exploitation",
191
+ "modules": [],
192
+ "auto_advance": False,
193
+ "success_criteria": "session_obtained",
177
194
  }
178
195
 
179
196
  def _build_post_exploitation_phase(self, objectives: List[str]) -> Dict:
@@ -183,44 +200,44 @@ class MSFChainEngine:
183
200
  # Common post-exploitation modules
184
201
  common_modules = [
185
202
  {
186
- 'module': 'post/multi/recon/local_exploit_suggester',
187
- 'description': 'Suggest local privilege escalation exploits',
188
- 'objective': 'escalate'
203
+ "module": "post/multi/recon/local_exploit_suggester",
204
+ "description": "Suggest local privilege escalation exploits",
205
+ "objective": "escalate",
189
206
  },
190
207
  {
191
- 'module': 'post/windows/gather/hashdump',
192
- 'description': 'Dump password hashes (Windows)',
193
- 'objective': 'escalate'
208
+ "module": "post/windows/gather/hashdump",
209
+ "description": "Dump password hashes (Windows)",
210
+ "objective": "escalate",
194
211
  },
195
212
  {
196
- 'module': 'post/linux/gather/hashdump',
197
- 'description': 'Dump password hashes (Linux)',
198
- 'objective': 'escalate'
213
+ "module": "post/linux/gather/hashdump",
214
+ "description": "Dump password hashes (Linux)",
215
+ "objective": "escalate",
199
216
  },
200
217
  {
201
- 'module': 'post/multi/manage/autoroute',
202
- 'description': 'Setup routing for pivoting',
203
- 'objective': 'pivot'
218
+ "module": "post/multi/manage/autoroute",
219
+ "description": "Setup routing for pivoting",
220
+ "objective": "pivot",
204
221
  },
205
222
  {
206
- 'module': 'post/windows/manage/persistence_exe',
207
- 'description': 'Install persistent backdoor (Windows)',
208
- 'objective': 'persist'
209
- }
223
+ "module": "post/windows/manage/persistence_exe",
224
+ "description": "Install persistent backdoor (Windows)",
225
+ "objective": "persist",
226
+ },
210
227
  ]
211
228
 
212
229
  # Filter by objectives
213
230
  for module in common_modules:
214
- if module['objective'] in objectives:
231
+ if module["objective"] in objectives:
215
232
  modules.append(module)
216
233
 
217
234
  return {
218
- 'name': 'post_exploitation',
219
- 'modules': modules,
220
- 'triggers': ['session_obtained'],
221
- 'auto_advance': False,
222
- 'success_criteria': 'credentials_dumped or persistence_established',
223
- 'expected_duration': f'{len(modules) * 60} seconds'
235
+ "name": "post_exploitation",
236
+ "modules": modules,
237
+ "triggers": ["session_obtained"],
238
+ "auto_advance": False,
239
+ "success_criteria": "credentials_dumped or persistence_established",
240
+ "expected_duration": f"{len(modules) * 60} seconds",
224
241
  }
225
242
 
226
243
  def generate_progressive_chain(self, host_id: int) -> Dict:
@@ -235,88 +252,101 @@ class MSFChainEngine:
235
252
  """
236
253
  try:
237
254
  from souleyez.storage.hosts import HostManager
255
+
238
256
  hm = HostManager()
239
257
 
240
258
  host = hm.get_host(host_id)
241
259
  services = hm.get_host_services(host_id)
242
260
 
243
261
  chain = {
244
- 'target': host.get('ip_address', 'Unknown'),
245
- 'host_id': host_id,
246
- 'phases': []
262
+ "target": host.get("ip_address", "Unknown"),
263
+ "host_id": host_id,
264
+ "phases": [],
247
265
  }
248
266
 
249
267
  # Phase 1: Reconnaissance
250
268
  recon_modules = self._build_recon_phase_for_host(host_id, services)
251
- chain['phases'].append({
252
- 'name': 'reconnaissance',
253
- 'modules': recon_modules,
254
- 'auto_advance': True,
255
- 'success_criteria': 'all_services_fingerprinted'
256
- })
269
+ chain["phases"].append(
270
+ {
271
+ "name": "reconnaissance",
272
+ "modules": recon_modules,
273
+ "auto_advance": True,
274
+ "success_criteria": "all_services_fingerprinted",
275
+ }
276
+ )
257
277
 
258
278
  # Phase 2: Vulnerability Assessment
259
279
  vuln_modules = self._build_vuln_assessment_phase(services)
260
- chain['phases'].append({
261
- 'name': 'vulnerability_assessment',
262
- 'modules': vuln_modules,
263
- 'auto_advance': False,
264
- 'success_criteria': 'vulnerabilities_confirmed'
265
- })
280
+ chain["phases"].append(
281
+ {
282
+ "name": "vulnerability_assessment",
283
+ "modules": vuln_modules,
284
+ "auto_advance": False,
285
+ "success_criteria": "vulnerabilities_confirmed",
286
+ }
287
+ )
266
288
 
267
289
  # Phase 3: Exploitation
268
290
  exploit_modules = self._build_exploitation_phase_for_host(host_id, services)
269
- chain['phases'].append({
270
- 'name': 'exploitation',
271
- 'modules': exploit_modules,
272
- 'auto_advance': False,
273
- 'success_criteria': 'session_obtained',
274
- 'fallback': 'brute_force_authentication'
275
- })
291
+ chain["phases"].append(
292
+ {
293
+ "name": "exploitation",
294
+ "modules": exploit_modules,
295
+ "auto_advance": False,
296
+ "success_criteria": "session_obtained",
297
+ "fallback": "brute_force_authentication",
298
+ }
299
+ )
276
300
 
277
301
  # Phase 4: Post-Exploitation
278
302
  post_modules = self._build_post_exploitation_phase_for_host(host)
279
- chain['phases'].append({
280
- 'name': 'post_exploitation',
281
- 'modules': post_modules,
282
- 'triggers': ['session_obtained'],
283
- 'auto_advance': False,
284
- 'success_criteria': 'credentials_dumped'
285
- })
303
+ chain["phases"].append(
304
+ {
305
+ "name": "post_exploitation",
306
+ "modules": post_modules,
307
+ "triggers": ["session_obtained"],
308
+ "auto_advance": False,
309
+ "success_criteria": "credentials_dumped",
310
+ }
311
+ )
286
312
 
287
313
  return chain
288
314
  except Exception as e:
289
- return {'target': 'Unknown', 'phases': [], 'error': str(e)}
315
+ return {"target": "Unknown", "phases": [], "error": str(e)}
290
316
 
291
- def _build_recon_phase_for_host(self, host_id: int, services: List[Dict]) -> List[Dict]:
317
+ def _build_recon_phase_for_host(
318
+ self, host_id: int, services: List[Dict]
319
+ ) -> List[Dict]:
292
320
  """Build recon modules for a specific host."""
293
321
  modules = []
294
322
 
295
323
  for service in services:
296
- service_name = service.get('service_name', '').lower()
324
+ service_name = service.get("service_name", "").lower()
297
325
 
298
326
  # Get version scanner
299
327
  version_module = self._get_version_scanner(service_name)
300
328
  if version_module:
301
- modules.append({
302
- 'module': version_module,
303
- 'target_service': service_name,
304
- 'risk': 'safe'
305
- })
329
+ modules.append(
330
+ {
331
+ "module": version_module,
332
+ "target_service": service_name,
333
+ "risk": "safe",
334
+ }
335
+ )
306
336
 
307
337
  return modules
308
338
 
309
339
  def _get_version_scanner(self, service_name: str) -> str:
310
340
  """Get version scanner module for service."""
311
341
  scanner_map = {
312
- 'ssh': 'auxiliary/scanner/ssh/ssh_version',
313
- 'smb': 'auxiliary/scanner/smb/smb_version',
314
- 'http': 'auxiliary/scanner/http/http_version',
315
- 'https': 'auxiliary/scanner/http/http_version',
316
- 'ftp': 'auxiliary/scanner/ftp/ftp_version',
317
- 'mysql': 'auxiliary/scanner/mysql/mysql_version',
318
- 'postgresql': 'auxiliary/scanner/postgres/postgres_version',
319
- 'mssql': 'auxiliary/scanner/mssql/mssql_ping'
342
+ "ssh": "auxiliary/scanner/ssh/ssh_version",
343
+ "smb": "auxiliary/scanner/smb/smb_version",
344
+ "http": "auxiliary/scanner/http/http_version",
345
+ "https": "auxiliary/scanner/http/http_version",
346
+ "ftp": "auxiliary/scanner/ftp/ftp_version",
347
+ "mysql": "auxiliary/scanner/mysql/mysql_version",
348
+ "postgresql": "auxiliary/scanner/postgres/postgres_version",
349
+ "mssql": "auxiliary/scanner/mssql/mssql_ping",
320
350
  }
321
351
 
322
352
  return scanner_map.get(service_name)
@@ -326,48 +356,56 @@ class MSFChainEngine:
326
356
  modules = []
327
357
 
328
358
  for service in services:
329
- service_name = service.get('service_name', '').lower()
359
+ service_name = service.get("service_name", "").lower()
330
360
 
331
361
  # Add service-specific vuln scanners
332
- if service_name == 'smb':
333
- modules.append({
334
- 'module': 'auxiliary/scanner/smb/smb_ms17_010',
335
- 'description': 'Check for MS17-010 (EternalBlue)',
336
- 'risk': 'safe'
337
- })
362
+ if service_name == "smb":
363
+ modules.append(
364
+ {
365
+ "module": "auxiliary/scanner/smb/smb_ms17_010",
366
+ "description": "Check for MS17-010 (EternalBlue)",
367
+ "risk": "safe",
368
+ }
369
+ )
338
370
 
339
371
  return modules
340
372
 
341
- def _build_exploitation_phase_for_host(self, host_id: int, services: List[Dict]) -> List[Dict]:
373
+ def _build_exploitation_phase_for_host(
374
+ self, host_id: int, services: List[Dict]
375
+ ) -> List[Dict]:
342
376
  """Build exploitation modules for a specific host."""
343
377
  exploits = []
344
378
 
345
379
  for service in services:
346
- service_id = service.get('id')
347
- service_name = service.get('service_name', '')
348
- version = service.get('service_version', '')
380
+ service_id = service.get("id")
381
+ service_name = service.get("service_name", "")
382
+ version = service.get("service_version", "")
349
383
 
350
384
  # Get exploit recommendations
351
385
  recommendations = self.module_selector.get_recommendations_for_service(
352
386
  service=service_name,
353
387
  version=version,
354
388
  engagement_id=self.engagement_id,
355
- include_cve_matches=True
389
+ include_cve_matches=True,
356
390
  )
357
391
 
358
392
  # Filter to exploits
359
- exploit_mods = [r for r in recommendations if r.get('category') == 'exploit']
393
+ exploit_mods = [
394
+ r for r in recommendations if r.get("category") == "exploit"
395
+ ]
360
396
 
361
397
  for exploit in exploit_mods:
362
- exploits.append({
363
- 'module': exploit.get('path'),
364
- 'score': exploit.get('score', 0),
365
- 'cves': exploit.get('cve', []),
366
- 'reliability': exploit.get('reliability', 'unknown')
367
- })
398
+ exploits.append(
399
+ {
400
+ "module": exploit.get("path"),
401
+ "score": exploit.get("score", 0),
402
+ "cves": exploit.get("cve", []),
403
+ "reliability": exploit.get("reliability", "unknown"),
404
+ }
405
+ )
368
406
 
369
407
  # Sort by score
370
- exploits.sort(key=lambda x: x.get('score', 0), reverse=True)
408
+ exploits.sort(key=lambda x: x.get("score", 0), reverse=True)
371
409
 
372
410
  return exploits
373
411
 
@@ -376,36 +414,42 @@ class MSFChainEngine:
376
414
  modules = []
377
415
 
378
416
  # OS-specific modules
379
- os_type = host.get('os', 'unknown').lower()
380
-
381
- if 'windows' in os_type:
382
- modules.extend([
383
- {
384
- 'module': 'post/windows/gather/hashdump',
385
- 'description': 'Dump password hashes'
386
- },
387
- {
388
- 'module': 'post/windows/gather/enum_patches',
389
- 'description': 'Enumerate installed patches'
390
- }
391
- ])
392
- elif 'linux' in os_type:
393
- modules.extend([
394
- {
395
- 'module': 'post/linux/gather/hashdump',
396
- 'description': 'Dump password hashes'
397
- },
398
- {
399
- 'module': 'post/linux/gather/enum_system',
400
- 'description': 'Enumerate system information'
401
- }
402
- ])
417
+ os_type = host.get("os", "unknown").lower()
418
+
419
+ if "windows" in os_type:
420
+ modules.extend(
421
+ [
422
+ {
423
+ "module": "post/windows/gather/hashdump",
424
+ "description": "Dump password hashes",
425
+ },
426
+ {
427
+ "module": "post/windows/gather/enum_patches",
428
+ "description": "Enumerate installed patches",
429
+ },
430
+ ]
431
+ )
432
+ elif "linux" in os_type:
433
+ modules.extend(
434
+ [
435
+ {
436
+ "module": "post/linux/gather/hashdump",
437
+ "description": "Dump password hashes",
438
+ },
439
+ {
440
+ "module": "post/linux/gather/enum_system",
441
+ "description": "Enumerate system information",
442
+ },
443
+ ]
444
+ )
403
445
 
404
446
  # Universal modules
405
- modules.append({
406
- 'module': 'post/multi/recon/local_exploit_suggester',
407
- 'description': 'Suggest privilege escalation exploits'
408
- })
447
+ modules.append(
448
+ {
449
+ "module": "post/multi/recon/local_exploit_suggester",
450
+ "description": "Suggest privilege escalation exploits",
451
+ }
452
+ )
409
453
 
410
454
  return modules
411
455
 
@@ -414,94 +458,88 @@ class MSFChainTemplates:
414
458
  """Pre-built attack chain templates for common scenarios."""
415
459
 
416
460
  TEMPLATES = {
417
- 'windows_domain_takeover': {
418
- 'name': 'Windows Domain Takeover',
419
- 'description': 'Progressive attack to compromise AD domain',
420
- 'phases': [
461
+ "windows_domain_takeover": {
462
+ "name": "Windows Domain Takeover",
463
+ "description": "Progressive attack to compromise AD domain",
464
+ "phases": [
421
465
  {
422
- 'name': 'Initial Foothold',
423
- 'modules': [
424
- 'auxiliary/scanner/smb/smb_ms17_010',
425
- 'exploit/windows/smb/ms17_010_eternalblue',
426
- 'auxiliary/scanner/smb/smb_enumshares'
427
- ]
466
+ "name": "Initial Foothold",
467
+ "modules": [
468
+ "auxiliary/scanner/smb/smb_ms17_010",
469
+ "exploit/windows/smb/ms17_010_eternalblue",
470
+ "auxiliary/scanner/smb/smb_enumshares",
471
+ ],
428
472
  },
429
473
  {
430
- 'name': 'Credential Harvesting',
431
- 'modules': [
432
- 'post/windows/gather/hashdump',
433
- 'post/windows/gather/credentials/credential_collector',
434
- 'post/windows/gather/cachedump'
474
+ "name": "Credential Harvesting",
475
+ "modules": [
476
+ "post/windows/gather/hashdump",
477
+ "post/windows/gather/credentials/credential_collector",
478
+ "post/windows/gather/cachedump",
435
479
  ],
436
- 'triggers': ['session_obtained']
480
+ "triggers": ["session_obtained"],
437
481
  },
438
482
  {
439
- 'name': 'Lateral Movement',
440
- 'modules': [
441
- 'exploit/windows/smb/psexec',
442
- 'exploit/windows/local/bypassuac'
483
+ "name": "Lateral Movement",
484
+ "modules": [
485
+ "exploit/windows/smb/psexec",
486
+ "exploit/windows/local/bypassuac",
443
487
  ],
444
- 'triggers': ['credentials_obtained']
445
- }
446
- ]
488
+ "triggers": ["credentials_obtained"],
489
+ },
490
+ ],
447
491
  },
448
- 'linux_privilege_escalation': {
449
- 'name': 'Linux Privilege Escalation Chain',
450
- 'description': 'Escalate from user to root on Linux',
451
- 'phases': [
492
+ "linux_privilege_escalation": {
493
+ "name": "Linux Privilege Escalation Chain",
494
+ "description": "Escalate from user to root on Linux",
495
+ "phases": [
452
496
  {
453
- 'name': 'Initial Access',
454
- 'modules': [
455
- 'auxiliary/scanner/ssh/ssh_login'
456
- ]
497
+ "name": "Initial Access",
498
+ "modules": ["auxiliary/scanner/ssh/ssh_login"],
457
499
  },
458
500
  {
459
- 'name': 'Enumeration',
460
- 'modules': [
461
- 'post/linux/gather/enum_system',
462
- 'post/linux/gather/checkvm',
463
- 'post/linux/gather/enum_configs'
501
+ "name": "Enumeration",
502
+ "modules": [
503
+ "post/linux/gather/enum_system",
504
+ "post/linux/gather/checkvm",
505
+ "post/linux/gather/enum_configs",
464
506
  ],
465
- 'triggers': ['session_obtained']
507
+ "triggers": ["session_obtained"],
466
508
  },
467
509
  {
468
- 'name': 'Privilege Escalation',
469
- 'modules': [
470
- 'exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec',
471
- 'exploit/linux/local/sudo_baron_samedit',
472
- 'post/multi/recon/local_exploit_suggester'
510
+ "name": "Privilege Escalation",
511
+ "modules": [
512
+ "exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec",
513
+ "exploit/linux/local/sudo_baron_samedit",
514
+ "post/multi/recon/local_exploit_suggester",
473
515
  ],
474
- 'triggers': ['user_session_obtained']
475
- }
476
- ]
516
+ "triggers": ["user_session_obtained"],
517
+ },
518
+ ],
477
519
  },
478
- 'web_app_to_system': {
479
- 'name': 'Web Application to System Access',
480
- 'description': 'From web vuln to full system compromise',
481
- 'phases': [
520
+ "web_app_to_system": {
521
+ "name": "Web Application to System Access",
522
+ "description": "From web vuln to full system compromise",
523
+ "phases": [
482
524
  {
483
- 'name': 'Web Exploitation',
484
- 'modules': [
485
- 'auxiliary/scanner/http/dir_scanner',
486
- 'exploit/multi/http/php_cgi_arg_injection'
487
- ]
525
+ "name": "Web Exploitation",
526
+ "modules": [
527
+ "auxiliary/scanner/http/dir_scanner",
528
+ "exploit/multi/http/php_cgi_arg_injection",
529
+ ],
488
530
  },
489
531
  {
490
- 'name': 'Reverse Shell',
491
- 'modules': [
492
- 'payload/php/meterpreter/reverse_tcp'
493
- ],
494
- 'triggers': ['web_access_obtained']
532
+ "name": "Reverse Shell",
533
+ "modules": ["payload/php/meterpreter/reverse_tcp"],
534
+ "triggers": ["web_access_obtained"],
495
535
  },
496
536
  {
497
- 'name': 'Privilege Escalation',
498
- 'modules': [
499
- 'post/multi/recon/local_exploit_suggester'
500
- ],
501
- 'triggers': ['shell_obtained']
502
- }
503
- ]
504
- }
537
+ "name": "Privilege Escalation",
538
+ "modules": ["post/multi/recon/local_exploit_suggester"],
539
+ "triggers": ["shell_obtained"],
540
+ },
541
+ ],
542
+ },
505
543
  }
506
544
 
507
545
  @classmethod