Skip to content

Commit 757fd17

Browse files
grisunogrisuno
committed
feat(feat): new exploit \n\n Version: release/0.2.129 \n\n with love \n\n LazyOwn on HackTheBox: https://app.hackthebox.com/teams/overview/6429 \n\n LazyOwn/ https://grisuno.github.io/LazyOwn/ \n\n \n\n Fecha: dom 17 may 2026 23:59:39 -04 \n\n Hora: 1779076779
1 parent 42443be commit 757fd17

14 files changed

Lines changed: 3703 additions & 2903 deletions

‎CHANGELOG.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,13 @@
22
# Changelog
33

44

5+
### Nuevas características
6+
7+
### Otros
8+
9+
* * feat(feat): new exploit \n\n Version: release/0.2.129 \n\n with love \n\n LazyOwn on HackTheBox: https://app.hackthebox.com/teams/overview/6429 \n\n LazyOwn/ https://grisuno.github.io/LazyOwn/ \n\n \n\n Fecha: dom 17 may 2026 23:59:39 -04 \n\n Hora: 1779076779
10+
11+
512
### Nuevas características
613

714
### Otros

‎CLAUDE.md‎

Lines changed: 311 additions & 757 deletions
Large diffs are not rendered by default.

‎COMPARISON.md‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
# LazyOwn vs Other Open-Source Red Team Frameworks
2+
3+
Honest, side-by-side comparison. Updated 2026-05-17.
4+
5+
If you find a row that is inaccurate, open an issue. We will fix it. We would
6+
rather lose a tick than mislead an operator.
7+
8+
---
9+
10+
## At a glance
11+
12+
| Capability | LazyOwn | Sliver | Havoc | Mythic | Empire 5.x | Caldera | Metasploit |
13+
|---|:-:|:-:|:-:|:-:|:-:|:-:|:-:|
14+
| Active OSS development | yes | yes | yes | yes | yes | yes | yes |
15+
| License | GPLv3 | GPLv3 | GPLv3 | BSD-3 | BSD-3 | Apache-2 | BSD-3 |
16+
| Single-binary install path | yes | yes | partial | container only | yes | partial | yes |
17+
| Operator CLI (interactive) | yes (cmd2) | yes | partial | partial | yes | no (web) | yes |
18+
| Operator web UI | yes (Flask) | no | yes (Qt) | yes (React) | yes (Starkiller) | yes | no |
19+
| Multi-operator collaboration | yes (SSE + locks) | yes (multiplayer) | yes | yes | partial | yes | no (msfrpcd) |
20+
| Windows beacon (in-memory) | yes (Go + C) | yes | yes (Demon) | yes (many) | yes | yes (sandcat) | yes |
21+
| Linux beacon | yes (Go + C) | yes | partial | yes | yes (Starkiller) | yes (sandcat) | yes |
22+
| macOS beacon | yes (Go) | yes | no | yes | partial | yes | yes |
23+
| **Linux BOF support** | **yes (ELF dlopen)** | **no** | **no** | **no** | **no** | **no** | **no** |
24+
| Windows BOF support | partial (via beacon.yaml addon) | yes (COFF loader) | yes | yes (apollo, athena) | partial | no | no |
25+
| Malleable C2 HTTP profile | yes | yes | yes | yes (via containers) | partial | partial | yes (advanced) |
26+
| DNS C2 | yes (built-in resolver) | yes | partial | yes | yes | no | yes |
27+
| TLS / mTLS | yes (self-signed + mTLS-ready) | yes | yes | yes | yes | partial | yes |
28+
| Built-in phishing engine | yes (templates + SMTP + tracker) | no | no | no | partial | no | no (msfvenom only) |
29+
| Recon / scanning suite bundled | yes (nmap, gobuster, ffuf, enum4linux, responder, etc.) | no | no | no | partial | no | partial |
30+
| MITRE ATT&CK adversary emulation | yes (`playbooks/apt_*.yaml`) | no | no | partial | no | **yes (primary use case)** | partial |
31+
| Automated kill-chain loop | yes (`autonomous_daemon`) | no | no | no | no | yes (operations) | no |
32+
| LLM-assisted operator (built-in) | **yes** (Groq, Ollama, Claude via MCP) | no | no | no | no | no | no |
33+
| Multi-agent AI (hive-mind / MoE) | **yes** (SWAN + hive_mind) | no | no | no | no | no | no |
34+
| MCP server for Claude / agents | **yes (95+ tools)** | no | no | no | no | no | no |
35+
| Knowledge graph navigation | yes (`graphify-out/`) | no | no | no | no | no | no |
36+
| Knowledge bases (GTFOBins, LOLBas, ATT&CK) | yes (parquet) | no | no | no | no | partial | yes (modules db) |
37+
| Plugin system | yes (YAML addons + Lua + .tool) | yes (armory + extensions) | yes (modules) | yes (containers) | yes (modules) | yes (plugins) | yes (modules) |
38+
| Reporting (auto-generated) | yes (Markdown + DOCX + executive JSON) | no | no | no | no | yes | partial |
39+
| Decoy / deception landing site | yes (canary, webcam capture) | no | no | no | no | no | no |
40+
| Container image (official) | yes (`lazyown-docker/`) | yes | yes | yes (compose) | yes | yes | yes |
41+
| Active campaign state on disk | yes (`sessions/`) | yes | yes | yes | yes | yes | yes (db) |
42+
| Free for commercial use | yes (GPLv3) | yes | yes | yes | yes | yes | yes (community) |
43+
44+
Legend: yes = first-class, partial = present but limited or experimental, no = not implemented.
45+
46+
---
47+
48+
## Where LazyOwn wins today
49+
50+
**Linux BOF.** As of 2026-05-17 LazyOwn is the only open-source C2 framework
51+
shipping a Beacon Object File runtime for Linux targets. BOFs are compiled
52+
as position-independent ELF shared objects and loaded via `dlopen` into the
53+
running beacon. The `datap` API is source-compatible with the Windows BOF
54+
contract, so porting an existing BOF means swapping Win32 calls for Linux
55+
syscalls or libc equivalents. See `docs/PORTING_BOFS_TO_LINUX.md`.
56+
57+
**Adversary emulation.** Seven YAML profiles ship under `playbooks/`: APT28,
58+
APT29, APT41, Conti, FIN7, Lazarus, and LockBit. Each maps to MITRE group
59+
IDs and references published CTI. Replay one with `playbook_run apt_apt28`.
60+
61+
**AI-native operations.** Every other framework treats LLMs as an add-on. In
62+
LazyOwn the model orchestrates the engagement: `autonomous_daemon` drives a
63+
reward-shaped kill chain, `swan_ensemble` routes tasks through a mixture of
64+
experts, and `hive_spawn` runs role-specialised drones in parallel. The MCP
65+
server exposes 95+ tools to Claude Code so the operator can drive the whole
66+
framework from a conversational interface.
67+
68+
**Breadth in a single repo.** Recon, exploitation, lateral movement,
69+
credential access, persistence, C2, phishing, and reporting all ship in one
70+
install. No glue between four projects, no separate framework for each
71+
phase.
72+
73+
**Reproducible campaign state.** Everything lands in `sessions/`. Restart
74+
the shell, restore the directory on another box, and the campaign keeps
75+
going. Reporting reads the same artefacts the operator does.
76+
77+
---
78+
79+
## Where the alternatives win today
80+
81+
**Sliver.** More mature implant ecosystem on Windows. COFF loader for
82+
Windows BOFs is battle-tested. Better support for cross-compilation of
83+
implants out of the box. If your engagement is Windows-only and you do not
84+
need AI orchestration, Sliver is a strong default.
85+
86+
**Havoc.** Best-in-class operator desktop UI. The Demon agent has excellent
87+
Windows tradecraft. If your team values a polished native GUI over a web
88+
dashboard plus CLI, Havoc is the better visual experience.
89+
90+
**Mythic.** Containerised payload architecture lets you mix language-agnostic
91+
agents (Apollo, Athena, Poseidon, Medusa). If you need to swap implants per
92+
target environment, Mythic's model is more flexible than LazyOwn's
93+
single-beacon-family approach.
94+
95+
**Caldera.** MITRE-funded, designed around adversary emulation as the
96+
primary use case. If your engagement is purple-team or detection
97+
validation rather than penetration testing, Caldera's operation/adversary
98+
abstractions map more directly to that workflow.
99+
100+
**Metasploit.** Largest exploit module library and the deepest history of
101+
hardening. If you need exploits for a specific CVE today, Metasploit is
102+
still the fastest path.
103+
104+
**Empire 5.x.** Most polished PowerShell tradecraft for legacy Windows
105+
estates. If your scope is heavily AD-focused on Windows-only targets,
106+
Empire's modules remain very strong.
107+
108+
---
109+
110+
## When NOT to pick LazyOwn
111+
112+
- **You need a stable Cobalt-Strike-shaped Windows engagement and nothing
113+
else.** Sliver or Havoc will feel more familiar.
114+
- **You require FedRAMP/government certification.** None of the OSS C2s
115+
qualify; you need a commercial product.
116+
- **You operate without internet access and cannot use a hosted LLM.** The
117+
AI features degrade gracefully (Ollama is supported locally), but the full
118+
experience assumes Groq or another API. Without any LLM, the differentiator
119+
shrinks to recon breadth and Linux BOF.
120+
- **You want a desktop GUI as the primary interface.** LazyOwn ships
121+
`lazygui/` and a Textual TUI, but Havoc's Qt UI is more polished today.
122+
123+
---
124+
125+
## Roadmap to close known gaps
126+
127+
Tracked in GitHub issues, summarised here:
128+
129+
- Windows COFF loader parity with Sliver inside the Go beacon.
130+
- ARM/IoT beacon (`blackzincbeacon`) for embedded targets.
131+
- Operator handbook with screenshots and a guided demo engagement.
132+
- Reproducible end-to-end demo video pinned to the README.
133+
- Signed releases (cosign) and SBOM publication.
134+
- Plugin marketplace index at addons.lazyown.io.
135+
136+
---
137+
138+
## How we keep this honest
139+
140+
Every claim in the table above is testable from the repo. If you can show
141+
an addon, route, or `do_*` command that contradicts a "no", we owe you a
142+
patch. Pull requests against this file are welcome.

‎README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13024,6 +13024,13 @@ No description available.
1302413024
# Changelog
1302513025

1302613026

13027+
### Nuevas características
13028+
13029+
### Otros
13030+
13031+
* * feat(feat): new orquestator \n\n Version: release/0.2.128 \n\n with love \n\n LazyOwn on HackTheBox: https://app.hackthebox.com/teams/overview/6429 \n\n LazyOwn/ https://grisuno.github.io/LazyOwn/ \n\n \n\n Fecha: dom 17 may 2026 00:56:05 -04 \n\n Hora: 1778993765
13032+
13033+
1302713034
### Nuevas características
1302813035

1302913036
### Otros

‎docs/ATTACK_MATRIX.md‎

Lines changed: 205 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
# MITRE ATT&CK Coverage Matrix
2+
3+
Mapping of LazyOwn capabilities to MITRE ATT&CK Enterprise tactics and
4+
techniques. Updated 2026-05-17. The intent is honesty, not credit: a row
5+
without strong evidence is marked `partial` or `none`, never `yes`.
6+
7+
Verify a claim by running the listed command, addon, or skill and observing
8+
that the artefact lands in `sessions/`. If a row is wrong, open an issue
9+
with the failing reproducer.
10+
11+
Categories below mirror the kill-chain layout used by the CLI
12+
(`utils.py:recon_category` and friends). Each LazyOwn category maps onto
13+
one or more ATT&CK tactics.
14+
15+
---
16+
17+
## TA0043 — Reconnaissance
18+
19+
| Technique | ATT&CK ID | LazyOwn surface | Status |
20+
|---|---|---|---|
21+
| Active Scanning: Scanning IP Blocks | T1595.001 | `do_lazynmap`, `do_amass`, `do_arpscan` | yes |
22+
| Active Scanning: Vulnerability Scanning | T1595.002 | `do_nikto`, `do_wpscan`, `modules/integrations/nuclei_bridge.py` | yes |
23+
| Gather Victim Host Information | T1592 | `do_enum4linux`, `do_enum4linux_ng` | yes |
24+
| Search Open Websites/Domains | T1593 | `do_amass`, OSINT skills | partial |
25+
| Search Open Technical Databases | T1596 | `find_ss`, `find_ea`, `nvddb`, `packetstormsecurity` | yes |
26+
| Phishing for Information | T1598 | phishing blueprint + SMTP tracker | yes |
27+
28+
## TA0042 — Resource Development
29+
30+
| Technique | ATT&CK ID | LazyOwn surface | Status |
31+
|---|---|---|---|
32+
| Acquire Infrastructure: Domains | T1583.001 | manual; documented in QUICKSTART | none |
33+
| Develop Capabilities: Malware | T1587.001 | Go beacon, BlackSandBeacon, Windows beacon addon | yes |
34+
| Develop Capabilities: Code Signing Certificates | T1587.002 | `gen_cert.sh`, `generate_certificates()` | partial |
35+
| Obtain Capabilities: Exploits | T1588.005 | `searchsploit`, ExploitAlert scrapers | yes |
36+
| Stage Capabilities: Upload Malware | T1608.001 | C2 staging routes, `sessions/<artefact>` | yes |
37+
| Stage Capabilities: Drive-by Target | T1608.004 | decoy site + landing pages | yes |
38+
39+
## TA0001 — Initial Access
40+
41+
| Technique | ATT&CK ID | LazyOwn surface | Status |
42+
|---|---|---|---|
43+
| Phishing: Spearphishing Link | T1566.002 | phishing blueprint + tracker | yes |
44+
| Phishing: Spearphishing Attachment | T1566.001 | phishing blueprint with attachment templates | yes |
45+
| Drive-by Compromise | T1189 | landing pages + decoy capture | partial |
46+
| Exploit Public-Facing Application | T1190 | `do_sqlmap`, `do_nikto`, `do_wpscan` | yes |
47+
| Valid Accounts | T1078 | `start_user` / `start_pass` payload keys, `do_hydra` | yes |
48+
| External Remote Services | T1133 | RDP/SSH probing via nmap and `do_responder` | partial |
49+
50+
## TA0002 — Execution
51+
52+
| Technique | ATT&CK ID | LazyOwn surface | Status |
53+
|---|---|---|---|
54+
| Command and Scripting Interpreter: Bash | T1059.004 | beacon + `do_run` | yes |
55+
| Command and Scripting Interpreter: PowerShell | T1059.001 | `do_empire`, Windows beacon | yes |
56+
| Command and Scripting Interpreter: Python | T1059.006 | impacket suite | yes |
57+
| Native API | T1106 | Windows beacon NT API, BlackSandBeacon direct syscalls | yes |
58+
| Inter-Process Communication | T1559 | BOF runtime + Unix sockets | partial |
59+
| User Execution: Malicious File | T1204.002 | phishing payload templates | yes |
60+
61+
## TA0003 — Persistence
62+
63+
| Technique | ATT&CK ID | LazyOwn surface | Status |
64+
|---|---|---|---|
65+
| Account Manipulation | T1098 | post-exploitation utilities | partial |
66+
| Boot or Logon Autostart Execution | T1547 | `modules/rootkit/`, addons | partial |
67+
| Scheduled Task/Job | T1053 | `do_cron` | yes |
68+
| Server Software Component: Web Shell | T1505.003 | reverse-shell generators | yes |
69+
| Create or Modify System Process | T1543 | `modules/rootkit/` Linux LKM | yes |
70+
71+
## TA0004 — Privilege Escalation
72+
73+
| Technique | ATT&CK ID | LazyOwn surface | Status |
74+
|---|---|---|---|
75+
| Abuse Elevation Control Mechanism: Sudo | T1548.003 | GTFOBins parquet KB | yes |
76+
| Exploitation for Privilege Escalation | T1068 | `searchsploit` integration, reactive_engine | yes |
77+
| Process Injection | T1055 | Windows beacon Early Bird APC | yes |
78+
| Setuid and Setgid | T1548.001 | GTFOBins parquet KB | yes |
79+
80+
## TA0005 — Defense Evasion
81+
82+
| Technique | ATT&CK ID | LazyOwn surface | Status |
83+
|---|---|---|---|
84+
| Obfuscated Files or Information | T1027 | Go beacon Garble obfuscation, XOR stub | yes |
85+
| Indicator Removal: File Deletion | T1070.004 | manual (no first-class surface) | none |
86+
| Masquerading | T1036 | decoy site, malleable C2 user-agents | yes |
87+
| Reflective Code Loading | T1620 | Windows BOF + Linux BOF dlopen | yes |
88+
| Direct Volume Access / Direct Syscalls | T1006 | BlackSandBeacon direct syscalls | yes |
89+
| Use Alternate Authentication Material | T1550 | Kerberos relay tooling | partial |
90+
91+
## TA0006 — Credential Access
92+
93+
| Technique | ATT&CK ID | LazyOwn surface | Status |
94+
|---|---|---|---|
95+
| OS Credential Dumping: LSASS Memory | T1003.001 | `do_mimikatzpy` | yes |
96+
| OS Credential Dumping: NTDS | T1003.003 | impacket secretsdump | yes |
97+
| OS Credential Dumping: /etc/shadow | T1003.008 | post-exploitation utilities | yes |
98+
| Brute Force: Password Cracking | T1110.002 | `do_john2hash`, `do_hashcat` | yes |
99+
| Brute Force: Credential Stuffing | T1110.004 | `do_hydra` | yes |
100+
| Credentials from Password Stores | T1555 | `do_john2keepas`, browser addons | partial |
101+
| Steal or Forge Kerberos Tickets | T1558 | impacket suite | yes |
102+
| Adversary-in-the-Middle: LLMNR Poisoning | T1557.001 | `do_responder` | yes |
103+
104+
## TA0007 — Discovery
105+
106+
| Technique | ATT&CK ID | LazyOwn surface | Status |
107+
|---|---|---|---|
108+
| Account Discovery | T1087 | `do_enum4linux`, AD enumeration | yes |
109+
| Domain Trust Discovery | T1482 | `do_bloodhound` | yes |
110+
| Network Share Discovery | T1135 | impacket smbclient | yes |
111+
| Network Service Discovery | T1046 | `do_lazynmap` | yes |
112+
| Permission Groups Discovery | T1069 | BloodHound | yes |
113+
| Process Discovery | T1057 | post-exploitation utilities | yes |
114+
| Remote System Discovery | T1018 | network_discovery, `do_lazynmap` | yes |
115+
| System Information Discovery | T1082 | `auto_populate` | yes |
116+
117+
## TA0008 — Lateral Movement
118+
119+
| Technique | ATT&CK ID | LazyOwn surface | Status |
120+
|---|---|---|---|
121+
| Remote Services: SMB/Windows Admin Shares | T1021.002 | `do_psexec`, `do_psexec_py` | yes |
122+
| Remote Services: WinRM | T1021.006 | `do_evilwinrm` | yes |
123+
| Remote Services: SSH | T1021.004 | beacon SSH module | yes |
124+
| Use Alternate Authentication Material: Pass the Hash | T1550.002 | impacket suite | yes |
125+
| Lateral Tool Transfer | T1570 | `do_chisel`, `do_socat`, `do_ligolo` | yes |
126+
127+
## TA0009 — Collection
128+
129+
| Technique | ATT&CK ID | LazyOwn surface | Status |
130+
|---|---|---|---|
131+
| Audio Capture | T1123 | decoy site capture | partial |
132+
| Video Capture | T1125 | decoy site capture | partial |
133+
| Data from Local System | T1005 | beacon download command | yes |
134+
| Data from Network Shared Drive | T1039 | impacket suite | yes |
135+
| Screen Capture | T1113 | `do_eyewitness`, `do_gowitness` (operator-side, web only) | partial |
136+
137+
## TA0011 — Command and Control
138+
139+
| Technique | ATT&CK ID | LazyOwn surface | Status |
140+
|---|---|---|---|
141+
| Application Layer Protocol: Web Protocols | T1071.001 | Flask C2 + malleable profile | yes |
142+
| Application Layer Protocol: DNS | T1071.004 | built-in `dnslib` resolver | yes |
143+
| Data Encoding: Standard Encoding | T1132.001 | beacon JSON + base64 | yes |
144+
| Data Obfuscation | T1001 | XOR stub, AES-256 channel | yes |
145+
| Dynamic Resolution: Domain Generation Algorithms | T1568.002 | manual | none |
146+
| Encrypted Channel: Symmetric Cryptography | T1573.001 | AES-256 beacon channel | yes |
147+
| Encrypted Channel: Asymmetric Cryptography | T1573.002 | TLS via `gen_cert.sh` | yes |
148+
| Fallback Channels | T1008 | short-URL beacon routes | yes |
149+
| Ingress Tool Transfer | T1105 | C2 staging endpoints | yes |
150+
| Proxy: Internal Proxy | T1090.001 | `do_chisel`, `do_ligolo`, `do_socat` | yes |
151+
| Proxy: Multi-hop Proxy | T1090.003 | chained chisel + ligolo | partial |
152+
| Web Service | T1102 | decoy site fallthrough | partial |
153+
154+
## TA0010 — Exfiltration
155+
156+
| Technique | ATT&CK ID | LazyOwn surface | Status |
157+
|---|---|---|---|
158+
| Exfiltration Over C2 Channel | T1041 | beacon upload command | yes |
159+
| Exfiltration Over Alternative Protocol: DNS | T1048.003 | DNS resolver | partial |
160+
| Exfiltration Over Web Service: Cloud Storage | T1567.002 | manual | none |
161+
| Scheduled Transfer | T1029 | scheduling addons | partial |
162+
163+
## TA0040 — Impact
164+
165+
LazyOwn does not implement destructive impact techniques (T1485 data
166+
destruction, T1486 ransomware, T1490 inhibit system recovery, T1499
167+
endpoint DoS, T1496 resource hijacking). These belong to malicious actors
168+
and are out of scope for an authorised red-team framework. Requests to add
169+
them will be rejected.
170+
171+
---
172+
173+
## Adversary emulation profiles
174+
175+
`playbooks/` ships seven named-actor YAML profiles: `apt_apt28.yaml`,
176+
`apt_apt29.yaml`, `apt_apt41.yaml`, `apt_conti.yaml`, `apt_fin7.yaml`,
177+
`apt_lazarus.yaml`, `apt_lockbit.yaml`. Each maps a sequence of LazyOwn
178+
commands onto MITRE technique IDs so an operator can replay a campaign
179+
end-to-end for purple-team validation. Separately, `lazyadversaries/`
180+
holds technique-level building blocks (AMSI, persistence, shellcode
181+
injection) that the playbooks compose.
182+
183+
Run a profile with:
184+
185+
```
186+
playbook_generate <profile>
187+
playbook_run <profile>
188+
```
189+
190+
The reward shaping in `skills/autonomous_daemon.py` scores each step
191+
against the technique it was tagged with, so detection telemetry can be
192+
correlated back to ATT&CK directly.
193+
194+
---
195+
196+
## What this matrix is not
197+
198+
- It is **not** a guarantee that every technique works against every target
199+
out of the box. Many require operator judgement (correct OS, correct
200+
privilege, correct service version).
201+
- It is **not** a substitute for reading the relevant `do_*` docstring,
202+
addon YAML, or `parquets/` knowledge base.
203+
- It is **not** updated automatically. When you add a `do_*` covering a new
204+
technique, edit the table in the same change. A row added here without
205+
a working command will be removed at review.

0 commit comments

Comments
 (0)