filter commands by keyword\n catalog --phase list commands in a phase (recon, enum, ...)\n catalog --category list commands in a category\n catalog --count show totals only\n catalog --json dump matching commands as JSON", "kind": "method", "line": 33, "name": "do_catalog", "signature": "def do_catalog(self, line)"}, {"doc": "Filter *commands* by keyword in name or summary.", "kind": "method", "line": 88, "name": "_filter_commands", "signature": "def _filter_commands(self, commands, keyword)"}, {"doc": "Print *hits* (grouped by category) under *label*.", "kind": "method", "line": 95, "name": "_print_hits", "signature": "def _print_hits(self, hits, label)"}]}, {"doc": "CI/CD Enumeration command set. Phase 02/03 — commands for enumerating CI/CD platforms, scanning build logs for secrets, and abusing pipeline misconfigurations.", "id": "cli/commands/cicd.py", "kind": "module", "label": "cicd.py", "language": "py", "sha256": "11e3884d6625ac39", "symbol_count": 7, "symbols": [{"doc": "CI/CD pipeline enumeration and attack commands.", "kind": "class", "line": 27, "name": "CICDCommandSet", "signature": "class CICDCommandSet(LazyOwnCommandSet)"}, {"doc": "Scan CI/CD platform for security misconfigurations.\n\nUsage: cicd_scan --url [--type jenkins|gitlab|github|azure|bitbucket]\n\nEnumerates:\n- Exposed API endpoints\n- Credential stores\n- Pipeline configurations with potential secret leakage\n- Unauthenticated access vectors", "kind": "method", "line": 34, "name": "do_cicd_scan", "signature": "def do_cicd_scan(self, line)"}, {"doc": "Scan build log for leaked secrets.\n\nUsage: cicd_secrets [--file ] [--input ]\n\nScans provided text or file for common secret patterns:\npasswords, API keys, tokens, SSH keys, AWS keys, database\nconnection strings, and package registry tokens.", "kind": "method", "line": 97, "name": "do_cicd_secrets", "signature": "def do_cicd_secrets(self, line)"}, {"doc": "Enumerate a Jenkins instance.\n\nUsage: jenkins_enum --url \n\nChecks for: Script Console access, credential store exposure,\nunauthenticated API, build agent enumeration, console output\nwith potential secret leakage.", "kind": "method", "line": 140, "name": "do_jenkins_enum", "signature": "def do_jenkins_enum(self, line)"}, {"doc": "Enumerate a GitLab instance.\n\nUsage: gitlab_enum --url \n\nChecks for: Public projects, API accessibility, CI lint API,\nrunner enumeration, GraphQL API, version disclosure.", "kind": "method", "line": 185, "name": "do_gitlab_enum", "signature": "def do_gitlab_enum(self, line)"}, {"doc": "Enumerate and test MFA bypass techniques.\n\nUsage: mfa_bypass --domain [--idp ]\n\nAnalyzes target MFA posture and recommends bypass techniques:\n- Session cookie theft and replay\n- Push notification bombing/fatigue\n- Legacy protocol enumeration (IMAP/POP3/SMTP)\n- Conditional Access policy gaps\n- SAML assertion forging\n- Device code phishing templates", "kind": "method", "line": 231, "name": "do_mfa_bypass", "signature": "def do_mfa_bypass(self, line)"}, {"kind": "method", "line": 290, "name": "_extract", "signature": "def _extract(args, flag)"}]}, {"doc": "CLI authentication command set — login/logout/whoami. Integrates with :mod:`modules.cli_auth` to authenticate CLI operators against the same ``users.json`` as lazyc2.py.", "id": "cli/commands/cli_auth.py", "kind": "module", "label": "cli_auth.py", "language": "py", "sha256": "38b4e326c77cf7c6", "symbol_count": 5, "symbols": [{"doc": "CLI operator authentication — login, logout, whoami.", "kind": "class", "line": 27, "name": "CliAuthCommandSet", "signature": "class CliAuthCommandSet(LazyOwnCommandSet)"}, {"doc": "Authenticate against users.json (same users as lazyc2.py).\n\nUsage:\n login — prompt for username and password\n login — login with specified username\n login --remember — persist login across shell restarts\n\nCredentials are verified against the same users.json database\nused by the C2 web dashboard. The password is never echoed.\n\nWith ``--remember``, a secure token is stored in payload.json\nso you are automatically logged in on future shell starts.\n\nExamples:\n login\n login grisun0\n login --remember grisun0", "kind": "method", "line": 34, "name": "do_login", "signature": "def do_login(self, line)"}, {"doc": "Register a new operator account in users.json.\n\nUsage:\n register — prompt for username and password\n register — register with specified username\n\nFirst registered user becomes admin; subsequent users get the\nuser role. Password must be at least 12 characters.\n\nAfter registration you can login immediately with the same\ncredentials, or use ``login --remember`` for persistent sessions.\n\nExamples:\n register\n register newoperator", "kind": "method", "line": 117, "name": "do_register", "signature": "def do_register(self, line)"}, {"doc": "Log out the current CLI operator and clear the remember-me token.\n\nUsage:\n logout\n\nClears the CLI session and removes any stored remember-me token\nfrom payload.json.", "kind": "method", "line": 191, "name": "do_logout", "signature": "def do_logout(self, line)"}, {"doc": "Show the currently logged-in CLI operator.\n\nUsage:\n whoami\n\nDisplays username, role, ELO score, and karma rank.", "kind": "method", "line": 224, "name": "do_whoami", "signature": "def do_whoami(self, line)"}]}, {"doc": "Cloud attack command set. Commands for cloud provider enumeration, metadata harvesting, storage bucket discovery, and IAM reconnaissance across AWS, Azure, and GCP.", "id": "cli/commands/cloud.py", "kind": "module", "label": "cloud.py", "language": "py", "sha256": "85ca6d785dd0e5f1", "symbol_count": 7, "symbols": [{"doc": "Cloud attack phase commands.", "kind": "class", "line": 30, "name": "CloudCommandSet", "signature": "class CloudCommandSet(LazyOwnCommandSet)"}, {"kind": "method", "line": 36, "name": "_get_cloud_scanner", "signature": "def _get_cloud_scanner(self)"}, {"doc": "Harvest cloud instance metadata (AWS IMDS, Azure, GCP).\n\nAttempts to read cloud instance metadata from all three major\nproviders. Discovers IAM credentials, SSH keys, user-data\nscripts, and managed identity tokens.\n\nUsage: cloud_metadata", "kind": "method", "line": 49, "name": "do_cloud_metadata", "signature": "def do_cloud_metadata(self, _line)"}, {"doc": "Enumerate cloud storage buckets for a given prefix.\n\nChecks AWS S3, Azure Blob Storage, and GCP Storage buckets\nderived from the target prefix for public accessibility.\n\nUsage:\n cloud_buckets \n cloud_buckets mycompany", "kind": "method", "line": 98, "name": "do_cloud_buckets", "signature": "def do_cloud_buckets(self, line)"}, {"doc": "Full cloud security scan: metadata + buckets + IAM enumeration.\n\nUsage:\n cloud_scan \n cloud_scan mycompany", "kind": "method", "line": 148, "name": "do_cloud_scan", "signature": "def do_cloud_scan(self, line)"}, {"doc": "Enumerate cloud IAM roles and policies.\n\nAttempts to enumerate IAM users, roles, and policies when\nvalid cloud credentials are present in the environment.\n\nUsage: cloud_iam", "kind": "method", "line": 187, "name": "do_cloud_iam", "signature": "def do_cloud_iam(self, _line)"}, {"doc": "Enumerate cloud provider metadata, storage, and IAM.\n\nUsage: cloud_enum [provider]\nProviders: aws, azure, gcp (auto-detect if omitted)\n\nPerforms full enumeration including IMDS metadata extraction,\nstorage bucket listing, IAM role enumeration, and privilege\nescalation path detection. Auto-installs dependencies if missing.", "kind": "method", "line": 239, "name": "do_cloud_enum", "signature": "def do_cloud_enum(self, line)"}]}, {"doc": "Cloud attack commands — Azure AD/Entra ID, AWS, GCP, Kubernetes, cross-cloud, SaaS. Provides: entra_attack — Entra ID device code phishing, OAuth consent, managed identity aws_privesc — AWS IAM enumeration, Lambda backdoors, STS role chaining gcp_privesc — GCP service account impersonation, Cloud Functions, GCS k8s_attack — Kubernetes RBAC enum, pod escape, etcd, Helm Tiller cross_cloud — Cross-cloud federation attacks (SAML/OIDC bridging) saas_enum — SaaS platform enumeration (M365, Google Workspace, Salesforce, Slack)", "id": "cli/commands/cloud_attacks.py", "kind": "module", "label": "cloud_attacks.py", "language": "py", "sha256": "428c9196c9eda33a", "symbol_count": 7, "symbols": [{"doc": "Cloud and SaaS attack operations.", "kind": "class", "line": 17, "name": "CloudAttackCommandSet", "signature": "class CloudAttackCommandSet(LazyOwnCommandSet)"}, {"doc": "Microsoft Entra ID / Azure AD attack operations.\n\nUsage: entra_attack [options]\n\nMethods:\n device_code — Initiate device code phishing flow\n consent_grant — Generate OAuth consent grant phishing URL\n spn_cred_theft — Service principal credential theft plan\n managed_identity — Managed identity abuse from compromised VM/container\n connect_sync — Entra Connect Sync abuse (on-prem ↔ cloud)\n ca_bypass — Conditional Access bypass techniques\n tenant_enum — Enumerate tenant via Graph API\n\nExamples:\n entra_attack device_code\n entra_attack consent_grant\n entra_attack tenant_enum", "kind": "method", "line": 23, "name": "do_entra_attack", "signature": "def do_entra_attack(self, line)"}, {"doc": "AWS privilege escalation and enumeration.\n\nUsage: aws_privesc \n\nMethods:\n iam_enum — Enumerate IAM permissions and privesc paths\n lambda_backdoor — Backdoor a Lambda function for role credential theft\n sts_chain — Enumerate STS AssumeRole privesc chains\n ec2_data — Extract EC2 instance user data and metadata\n s3_enum — Enumerate S3 buckets and permissions\n cf_drift — CloudFormation drift exploitation\n ssm_abuse — SSM session abuse for EC2 shell access\n\nExamples:\n aws_privesc iam_enum\n aws_privesc lambda_backdoor", "kind": "method", "line": 125, "name": "do_aws_privesc", "signature": "def do_aws_privesc(self, line)"}, {"doc": "GCP privilege escalation and enumeration.\n\nUsage: gcp_privesc \n\nMethods:\n iam_enum — Enumerate GCP IAM policies\n sa_impersonate — Service account impersonation attack\n cloud_function — Cloud Functions backdoor\n metadata_exfil — Compute Engine metadata exfiltration\n gcs_enum — Cloud Storage bucket enumeration\n cloudbuild — Cloud Build abuse\n org_escalation — Organization-level escalation paths\n\nExamples:\n gcp_privesc iam_enum\n gcp_privesc metadata_exfil", "kind": "method", "line": 215, "name": "do_gcp_privesc", "signature": "def do_gcp_privesc(self, line)"}, {"doc": "Kubernetes attack — RBAC enumeration, pod escape, etcd, persistence.\n\nUsage: k8s_attack \n\nMethods:\n rbac_enum — Enumerate RBAC permissions\n pod_escape — Privileged pod escape plan (hostPID, hostPath, docker socket)\n token_theft — Service account token theft across namespaces\n kubelet_abuse — Kubelet anonymous auth abuse\n etcd — etcd database exploitation\n helm — Helm Tiller abuse (v2+v3)\n persistence — K8s persistence techniques\n\nExamples:\n k8s_attack rbac_enum\n k8s_attack pod_escape\n k8s_attack persistence", "kind": "method", "line": 302, "name": "do_k8s_attack", "signature": "def do_k8s_attack(self, line)"}, {"doc": "Cross-cloud identity federation attacks.\n\nUsage: cross_cloud \n\nMethods:\n azure_to_aws — Azure AD SAML → AWS role assumption\n gcp_to_azure — GCP OIDC → Azure AD token exchange\n aws_to_gcp — AWS OIDC → GCP workload identity federation\n imds_harvest — Multi-cloud IMDS metadata harvesting (6 providers)\n detect_federation — Detect cross-cloud federation configurations\n\nExamples:\n cross_cloud azure_to_aws\n cross_cloud imds_harvest\n cross_cloud detect_federation", "kind": "method", "line": 387, "name": "do_cross_cloud", "signature": "def do_cross_cloud(self, line)"}, {"doc": "Enumerate SaaS platforms — M365, Google Workspace, Salesforce, Slack, ServiceNow.\n\nUsage: saas_enum \n\nPlatforms: m365, google_workspace, salesforce, servicenow, slack, all\n\nExamples:\n saas_enum m365\n saas_enum slack\n saas_enum all", "kind": "method", "line": 470, "name": "do_saas_enum", "signature": "def do_saas_enum(self, line)"}]}, {"doc": "Collaboration CLI commands — multi-operator teamwork from the shell. Exposes the real-time collaboration layer (target locks, operator presence, event sharing) that currently lives only in the C2 web dashboard.", "id": "cli/commands/collaboration.py", "kind": "module", "label": "collaboration.py", "language": "py", "sha256": "b1bfb064b9d48fc7", "symbol_count": 8, "symbols": [{"doc": "Multi-operator collaboration commands for the CLI.", "kind": "class", "line": 20, "name": "CollaborationCommandSet", "signature": "class CollaborationCommandSet(LazyOwnCommandSet)"}, {"doc": "Lazy-load collaboration singletons from modules.collab_bp.", "kind": "method", "line": 26, "name": "_get_collab", "signature": "def _get_collab(self)"}, {"doc": "Resolve a target argument: explicit IP or rhost from payload.", "kind": "method", "line": 38, "name": "_resolve_target", "signature": "def _resolve_target(self, target)"}, {"doc": "Acquire an advisory lock on a target to prevent tool collisions.\n\nUsage:\n lock_target [target_ip]\n lock_target 10.10.11.5\n\nWithout an argument, locks the current rhost from payload.json.\nActive locks are visible to all connected operators via 'team_status'.\nLocks auto-expire after 5 minutes unless refreshed.", "kind": "method", "line": 48, "name": "do_lock_target", "signature": "def do_lock_target(self, line)"}, {"doc": "Release an advisory lock on a target.\n\nUsage:\n unlock_target [target_ip]\n unlock_target 10.10.11.5", "kind": "method", "line": 89, "name": "do_unlock_target", "signature": "def do_unlock_target(self, line)"}, {"doc": "Show active operators and target locks.\n\nUsage:\n team_status\n\nDisplays who is online, which targets are locked, and by whom.\nRequires the C2 server to be running.", "kind": "method", "line": 114, "name": "do_team_status", "signature": "def do_team_status(self, line)"}, {"doc": "Send a message to all connected operators.\n\nUsage:\n team_chat \n team_chat Found SMB signing disabled on 10.10.11.5, starting relay\n\nMessages are broadcast in real-time via the C2 event bus.", "kind": "method", "line": 169, "name": "do_team_chat", "signature": "def do_team_chat(self, line)"}, {"doc": "Share a finding or credential discovery with the team.\n\nUsage:\n share_finding \n share_finding Default admin:admin credentials on port 8080\n\nBroadcasts via team event bus for real-time visibility.", "kind": "method", "line": 199, "name": "do_share_finding", "signature": "def do_share_finding(self, line)"}]}, {"doc": "Command & Control command set. Phase-scoped home for the C2 / beacon operator commands (category ``10. Command & Control``). This module is intentionally an empty, active ``CommandSet`` scaffold: migrate one ``do_*`` method at a time out of ``lazyown.py`` into this class. Migration rule -------------- When you paste a ``do_`` method here you MUST delete the original copy from ``lazyown.py`` in the same change. Registering the same command name on both the shell and an active ``CommandSet`` raises a duplicate-command error at startup. Decorate migrated methods with ``@cmd2.with_category(command_and_control_category)`` so they keep their help grouping, and rely on :class:`cli.commands._base.LazyOwnCommandSet` to forward ``self.params`` / ``self.cmd`` / other shell state once registered. Discovery is automatic: :func:`cli.registry.register_command_sets` finds this class at startup, so no wiring change is needed as commands are added.", "id": "cli/commands/command_and_control.py", "kind": "module", "label": "command_and_control.py", "language": "py", "sha256": "7f9f31ff4270b592", "symbol_count": 7, "symbols": [{"doc": "Command & Control phase commands (migrate ``do_*`` here one at a time).", "kind": "class", "line": 34, "name": "CommandAndControlCommandSet", "signature": "class CommandAndControlCommandSet(LazyOwnCommandSet)"}, {"doc": "Show consolidated C2 status: listeners, beacons, implants, and sessions.", "kind": "method", "line": 41, "name": "do_c2_status", "signature": "def do_c2_status(self, _line)"}, {"doc": "List all active beacon sessions with their last-seen timestamps.", "kind": "method", "line": 98, "name": "do_c2_beacons", "signature": "def do_c2_beacons(self, _line)"}, {"doc": "Generate a fresh AES-256 key for beacon encryption.", "kind": "method", "line": 134, "name": "do_c2_keygen", "signature": "def do_c2_keygen(self, _line)"}, {"doc": "Quick C2 setup: generate key, prepare implant dir, print beacon commands.\n\nOne-shot setup that prepares everything needed for a C2 session:\nAES key, implant staging directory, and ready-to-use beacon commands\nfor both Linux and Windows targets.", "kind": "method", "line": 151, "name": "do_c2_quickstart", "signature": "def do_c2_quickstart(self, _line)"}, {"doc": "Queue a command for execution on a connected beacon.\n\nUsage:\n c2_beacon_cmd \n c2_beacon_cmd abc123 id", "kind": "method", "line": 198, "name": "do_c2_beacon_cmd", "signature": "def do_c2_beacon_cmd(self, line)"}, {"doc": "Generate a compiled implant payload for the target platform.\n\nUsage:\n c2_implant [output_name]\n c2_implant linux mybeacon", "kind": "method", "line": 233, "name": "do_c2_implant", "signature": "def do_c2_implant(self, line)"}]}, {"doc": "command_and_control commands migrated from lazyown.py. Auto-generated by scripts/migrate_lazyown.py.", "id": "cli/commands/command_and_control_migrated.py", "kind": "module", "label": "command_and_control_migrated.py", "language": "py", "sha256": "c2f3daf673df8daa", "symbol_count": 31, "symbols": [{"kind": "class", "line": 39, "name": "CommandAndControlMigratedCommandSet", "signature": "class CommandAndControlMigratedCommandSet(LazyOwnCommandSet)"}, {"doc": "Automates various Metasploit tasks including scanning for vulnerabilities, setting up reverse shells, and creating payloads.\n\n1. If no arguments are provided:\n - Retrieves the target IP (`self.params['rhost']`) from parameters.\n - Checks if the IP is valid using `check_rhost()`. If invalid, exits the function.\n - Creates a Metasploit resource script (`/tmp/scan_vulnerabilities.rc`) that includes commands for scanning ports, enumerating services, and checking for known vulnerabilities.\n - Executes Metasploit with the created resource script and then deletes the temporary file.\n - Prints a shutdown message after running the scan.\n\n2. If the argument starts with \"rev\":\n - Sets up a reverse shell payload based on the specified platform and user choice (with or without meterpreter).\n - Creates a Metasploit resource script (`/tmp/handler.rc`) for handling incoming reverse shell connections.\n - Executes Metasploit with the created resource script and then deletes the temporary file.\n - Prints a shutdown message after setting up the handler.\n\n3. If the argument starts with \"lnk\":\n - Configures parameters (`self.params['lhost']`, `lport`) for creating a payload.\n - Uses `msfvenom` to generate a payload executable and saves it in the `sessions` directory.\n - Creates an XML file (`download_payload.xml`) that will be used to download and execute the payload on a target machine.\n - Creates a PowerShell script (`create_lnk.ps1`) to generate a shortcut file (`.lnk`) pointing to the payload.\n - Prints instructions and generates a command to copy to the clipboard for setting up the payload and files.\n\n4. If the argument starts with \"autoroute\":\n - Configures parameters for setting up a Metasploit session and autorouting.\n - Creates a Metasploit resource script (`/tmp/autoroute.rc`) to handle exploit sessions and assign up autorouting.\n - Executes Metasploit with the resource script and starts a SOCKS proxy for routing traffic.\n - Configures proxychains to use the Metasploit SOCKS proxy and prints instructions for using proxychains with tools.\n\n:param line: The command line input that determines which Metasploit task to automate.\n:type line: str\n:returns: None\n\nManual execution:\nTo manually run these tasks, you would need to:\n- For scanning: Create and run the resource script using `msfconsole -r /tmp/scan_vulnerabilities.rc`.\n- For reverse shells: Configure and run the resource script with the appropriate payload settings.\n- For payload generation and shortcuts: Use `msfvenom` and create XML and PowerShell scripts as specified.\n- For autorouting: Create and run the resource script for autorouting and configure proxychains.\n\nNote: Ensure all required parameters (`self.params['lhost']`, `lport`, etc.) are assign before running these tasks.", "kind": "method", "line": 44, "name": "do_msf", "signature": "def do_msf(self, line)"}, {"doc": "Handle C2 server setup and agent compilation.\n\nThis method manages the process of setting up a Command and Control (C2)\nserver and compiling a corresponding agent for various platforms.\n\nArgs:\n line (str): Specifies the victim ID and optional C2 server configurations.\n - Victim ID: The identifier for the target agent.\n - Tunnel Option (optional): Append '1' to use a Cloudflare tunnel.\n - Target Choice (optional): A number from '1' to '7' to specify the\n agent platform (default is '1' for Windows PowerShell).\n - '1': Windows PowerShell\n - '2': Linux Shell\n - '3': Windows Batch\n - '4': macOS Shell\n - '5': Android Shell\n - '6': iOS Shell\n - '7': WebAssembly Shell\n - Tunnel Toggle (optional): After the victim ID and target choice,\n you can append '1' to enable the Cloudflare tunnel or '0' to disable it.\n\nReturns:\n None\n\nRaises:\n None\n\nExample Usage:\n c2 victim-1 # Compiles a Windows PowerShell agent\n c2 victim-2 2 # Compiles a Linux Shell agent\n c2 victim-3 1 1 # Compiles a Windows PowerShell agent with Cloudflare tunnel\n\nNotes:\n - Ensure the 'self.params['lhost']' and 'self.params['c2_port']' parameters are correctly set in the\n `payload.json` config file before calling this method.\n - The `modules/run` file and files in `modules/backdoor/` and\n `modules/rootkit/` directories must exist for the agent compilation\n process.\n - The go artifactory is ofuscated by garble if is installed", "kind": "method", "line": 394, "name": "do_c2", "signature": "def do_c2(self, line)"}, {"doc": "Manage C2 listeners: list, add, start, stop, remove.\n\nUsage:\n listener list - Show all configured listeners\n listener add [ssl] - Add a new listener (ssl: true/false)\n listener start - Start a listener via C2 API\n listener stop - Stop a listener via C2 API\n listener remove - Remove a listener\n\nExamples:\n listener add 4445 true\n listener start listener-4445\n listener stop default", "kind": "method", "line": 516, "name": "do_listener", "signature": "def do_listener(self, line)"}, {"doc": "Toggle or query Docker sandbox mode.\n\nWhen ``sandboxed`` is ``true`` in ``payload.json``, the framework\nautomatically runs inside a Docker container on the next launch.\n\nUsage:\n sandbox - Show current sandbox status\n sandbox on - Enable sandbox mode\n sandbox off - Disable sandbox mode", "kind": "method", "line": 644, "name": "do_sandbox", "signature": "def do_sandbox(self, line)"}, {"doc": "Connects to the msfrpcd daemon and allows remote control of Metasploit.\n\nUsage:\n msfrpc -a -p -U -P [-S]\n\nThis command will prompt the user for necessary information to connect to msfrpcd.", "kind": "method", "line": 686, "name": "do_msfrpc", "signature": "def do_msfrpc(self, line)"}, {"doc": "Starts the Sliver server and generates a client configuration file for connecting clients.\nProvides options to download the Sliver client for Windows, Linux, or macOS.\n\nUsage:\n sliver-server [flags]\n sliver-client [command]\n\nThis function installs Sliver if it is not already installed, starts the Sliver server,\ngenerates the necessary certificates, and creates a client configuration file.\nIt also provides options to download the client for different operating systems.\n\nParameters:\n line (str): The command line input for the function (not used directly in the current implementation).\n\nReturns:\n None\n\nExample:\n To start the Sliver server, generate the necessary certificates, and download the client,\n run this function. Choose the appropriate client download option based on the operating system.", "kind": "method", "line": 710, "name": "do_sliver_server", "signature": "def do_sliver_server(self, line)"}, {"doc": "Generates payloads using PowerShell Empire with various options.\n\n:param line: Not used in this implementation but reserved for future use.\n\n:returns: None", "kind": "method", "line": 827, "name": "do_empire", "signature": "def do_empire(self, line)"}, {"doc": "Try to check if Vulnerable using the module passed by argument of lazyown example automsf exploit/windows/iis/iis_webdav_upload_asp to use in metasploit\n:param line: Command line input that provides the LHOST and RHOST.\n:type line: str\n:returns: None", "kind": "method", "line": 877, "name": "do_automsf", "signature": "def do_automsf(self, line)"}, {"doc": "(CVE-2017-7269). Vulnerable using the module iis_webdav_upload_asp of metasploit\n:param line: Command line input that provides the LHOST and RHOST.\n:type line: str\n:returns: None", "kind": "method", "line": 922, "name": "do_iis_webdav_upload_asp", "signature": "def do_iis_webdav_upload_asp(self, line)"}, {"doc": "duckyspark Compiles and uploads an .ino sketch to a Digispark device using Arduino CLI and Micronucleus.\n\nduckyspark method checks if Arduino CLI and Micronucleus are installed on the system.\nIf they are not available, it installs them. It then compiles a Digispark sketch\nand uploads the generated .hex file to the Digispark device.\n\nThe method duckyspark performs the following actions:\n1. Checks for the presence of Arduino CLI and installs it if not available.\n2. Configures Arduino CLI for Digispark if not already configured.\n3. Generates a reverse shell payload and prepares the sketch for Digispark.\n4. Compiles the prepared Digispark sketch using Arduino CLI.\n5. Checks for the presence of Micronucleus and installs it if not available.\n6. Uploads the compiled .hex file to the Digispark device using Micronucleus.\n\nArgs:\n line (str): Command line input provided by the user, which may contain additional parameters.\n\nReturns:\n None: The function does not return any value but may modify the state of the system\n by executing commands.", "kind": "method", "line": 957, "name": "do_duckyspark", "signature": "def do_duckyspark(self, line)"}, {"doc": "Command emp3r0r Downloads and sets up the Emperor server for local exploitation.\n\nThis function performs the following tasks:\n1. Checks if Emperor is already downloaded.\n2. Downloads the Emperor tar.xz file if not already present.\n3. Extracts the contents into the sessions directory.\n4. Executes the Emperor server.\n5. Prepares the agent download command based on the OS Host and copies it to the clipboard.\n\nArgs:\n line (str): Optional arguments to specify port Relay\n\nReturns:\n None\n\nExample:\n emp3r0r 6666\n\nNotes:\n - Ensure that the required dependencies are installed.", "kind": "method", "line": 1158, "name": "do_emp3r0r", "signature": "def do_emp3r0r(self, line)"}, {"doc": "Stage an Atomic Red Team test by MITRE technique ID or GUID.\n\nAccepts human-friendly MITRE IDs (``T1078``, ``T1059.001``),\nraw GUIDs, or prefixes (``T1059``), with optional flags:\n\n atomic_tests T1078 --platform linux --non-interactive\n atomic_tests --platform windows\n atomic_tests --platform linux (lists, interactive only)\n\nNon-interactive mode (``--non-interactive`` or piped stdin,\nas used by MCP and the autonomous loop) stages the first\nmatching test to the clipboard without blocking on input.\nImplementation lives in :mod:`modules.atomic_cli`.", "kind": "method", "line": 1222, "name": "do_atomic_tests", "signature": "def do_atomic_tests(self, line)"}, {"doc": "Generate test + cleanup scripts for a MITRE ID or GUID.\n\nUsage:\n atomic_gen T1078 [--platform linux] [--non-interactive]\n atomic_gen \n\nScripts land in ``sessions/temp_uploads/`` with 0600 mode.\nImplementation lives in :mod:`modules.atomic_cli`.", "kind": "method", "line": 1243, "name": "do_atomic_gen", "signature": "def do_atomic_gen(self, line)"}, {"doc": "Open an interactive root shell on the target when possible.\n\nUsage:\n atomic_shell [target] [--interactive]\n\nWithout ``--interactive`` (the loop-safe default) it only\nverifies the multiplexed session and reports how to attach.\nWith ``--interactive`` in a foreground terminal it drops the\noperator into a live ``target#`` REPL until exit.", "kind": "method", "line": 1259, "name": "do_atomic_shell", "signature": "def do_atomic_shell(self, line)"}, {"doc": "Clean up engagement artefacts (soft) or tear down the gym (hard).\n\nUsage:\n atomic_clean [target] # soft: target artefacts + local staging\n atomic_clean --hard [target] # soft + stop and remove the gym container\n\nSoft removes the agent, drop files and test outputs from the\ntarget and clears local staging doubles. Loot, reports and logs\nare evidence and are always kept. Hard additionally destroys\nthe lab container (default lazyown-lab-metasploitable).", "kind": "method", "line": 1291, "name": "do_atomic_clean", "signature": "def do_atomic_clean(self, line)"}, {"doc": "Execute emulation tests on the target through a working shell.\n\nUsage:\n atomic_emulate --target 172.17.0.2 --playbook rocke [--platform linux]\n atomic_emulate --target 172.17.0.2 --techniques T1018,T1057\n atomic_emulate --target 172.17.0.2 --playbook rocke --dry-run\n atomic_emulate --target 172.17.0.2 --playbook rocke --manual\n\nOpens a one-shot remote shell (exec-capable exploits/*.yaml in\nrank order), runs each technique's first platform-compatible\nAtomic test, and stages sessions/atomic_emulate__.json\nwith per-test outputs. Lab and in-scope targets only.", "kind": "method", "line": 1328, "name": "do_atomic_emulate", "signature": "def do_atomic_emulate(self, line)"}, {"doc": "Generates and synchronizes atomic agent scripts.\n\nParameters:\nline (str): Command-line arguments (not used in this function).\n\nReturns:\nNone", "kind": "method", "line": 1385, "name": "do_atomic_agent", "signature": "def do_atomic_agent(self, line)"}, {"doc": "Execute a multi-step APT simulation plan.\n\nUsage:\n attack_plan [--platform linux] [--auto]\n\nThe platform filter is mandatory for correct emulation: without\nit the first indexed test wins regardless of OS (Windows scripts\nfor a Linux target). It defaults to the plan's own ``platforms:``\nentry (enriched playbooks) and must be passed explicitly for\nbare step lists. ``--auto`` executes generated scripts locally:\nonly use it when the target IS this host.", "kind": "method", "line": 1488, "name": "do_attack_plan", "signature": "def do_attack_plan(self, line)"}, {"doc": "Run a fully YAML-administered APT chain with one command.\n\nUsage:\n apt_chain [chain] [target] [--dry-run]\n apt_chain apt_rocke 172.17.0.2\n apt_chain rocke 172.17.0.2 (playbook shorthand)\n\nThe first token names a file in ``chains/`` (per-APT files like\n``apt_rocke.yaml`` inherit the base ``apt_chain.yaml`` and only\npin the playbook default). A bare playbook name falls back to\nits ``apt_`` chain; anything else runs the base chain with\nthat playbook. Target defaults to ``rhost``. Manage chains from\nthe orchestrator Chains tab or by editing the YAML directly -\nthis method only interprets.", "kind": "method", "line": 1647, "name": "do_apt_chain", "signature": "def do_apt_chain(self, line)"}, {"doc": "List, validate, and run APT playbooks based on public threat reports.\n\nUsage:\n apt_playbook list - Show available APT playbooks\n apt_playbook info - Show phases and techniques\n apt_playbook validate - Check atomic tests availability\n apt_playbook run - Generate attack_plan.yaml\n apt_playbook report - Write JSON report to sessions/\n\nExamples:\n apt_playbook list\n apt_playbook info apt29\n apt_playbook run apt28", "kind": "method", "line": 1781, "name": "do_apt_playbook", "signature": "def do_apt_playbook(self, line)"}, {"doc": "Interacts with the MITRE ATT&CK framework using the STIX 2.0 format.\n\nThis function connects to a locally cached or downloaded ATT&CK dataset in STIX 2.0 format.\nIt allows the user to explore tactics, techniques, and procedures (TTPs) and filter them\nbased on specific criteria, such as platform or tactic.\n\nParameters:\n line (str): User input, which may specify filters or actions, such as a tactic name or technique ID.\n\nUsage:\n mitre_test list # Lists all tactics and techniques\n mitre_test tactic # Lists techniques for a specific tactic\n mitre_test technique # Shows details of a specific technique", "kind": "method", "line": 1901, "name": "do_mitre_test", "signature": "def do_mitre_test(self, line)"}, {"doc": "Generates a playbook that integrates Atomic Red Team tests and MITRE ATT&CK techniques.\n\nThis function creates a playbook by combining tests from the Atomic Red Team repository\nand techniques from the MITRE ATT&CK framework. The playbook includes detailed information\nabout each test and technique, making it a comprehensive resource for emulating adversary\nbehaviors.\n\nParameters:\nline (str): Command-line arguments for specifying the playbook name and optional filters.\n The filters can be applied to various attributes of the tests and techniques,\n including but not limited to:\n - name: Filter by the name of the test or technique.\n - description: Filter by keywords in the description of the test or technique.\n - mitre_id: Filter by the MITRE ATT&CK technique ID.\n - platforms: Filter by the supported platforms (e.g., windows, linux, macos).\n - tactic: Filter by the MITRE ATT&CK tactic associated with the technique.\n - data_sources: Filter by the data sources mentioned in the technique.\n - defensive_measures: Filter by the defensive measures mentioned in the technique.\n - examples: Filter by examples mentioned in the technique.\n - references: Filter by references or URLs mentioned in the technique.\n - related_techniques: Filter by related techniques mentioned in the technique.\n - mitigations: Filter by mitigations mentioned in the technique.\n\nReturns:\nNone\n\nExample Usage:\ndo_generate_playbook(\"ExamplePlaybook persistence lateral_movement windows\")\nThis command will generate a playbook named \"ExamplePlaybook\" that includes tests and\ntechniques related to \"persistence\", \"lateral_movement\", and the \"windows\" platform.", "kind": "method", "line": 2004, "name": "do_generate_playbook", "signature": "def do_generate_playbook(self, line)"}, {"doc": "Generates a playbook from your custom technique database.\nUsage: my_playbook [filter]\nExample: my_playbook KerberosAttack password spray", "kind": "method", "line": 2183, "name": "do_my_playbook", "signature": "def do_my_playbook(self, line)"}, {"doc": "Installs and starts the Caldera server.\n\nThis function:\n - Clones the Caldera repository recursively.\n - Installs the required dependencies.\n - Optionally installs GoLang (1.19+).\n - Starts the Caldera server with the provided parameters.\n\nBehavior:\n - Requires `git`, `python3`, and `pip3` to be installed.\n - Uses parameters from `self.params` for version/release.\n\nUsage:\n caldera", "kind": "method", "line": 2240, "name": "do_caldera", "signature": "def do_caldera(self, line)"}, {"doc": "Import CALDERA abilities into LazyOwn playbooks.\n\nUsage:\n caldera_import [playbook_name]\n caldera_import all\n\nExamples:\n caldera_import 4e97e699-93d7-4046-b5b3-94968bf4ac1e\n caldera_import all", "kind": "method", "line": 2289, "name": "do_caldera_import", "signature": "def do_caldera_import(self, line)"}, {"doc": "Export a LazyOwn playbook to CALDERA ability YAML.\n\nUsage:\n caldera_export [ability_id_prefix]\n\nExamples:\n caldera_export apt29\n caldera_export fin7 lazyown-", "kind": "method", "line": 2381, "name": "do_caldera_export", "signature": "def do_caldera_export(self, line)"}, {"kind": "function", "line": 543, "name": "_api", "signature": "def _api(method, endpoint, payload)"}, {"doc": "True when chains/.yaml exists, even if disabled.", "kind": "function", "line": 1667, "name": "_chain_file_exists", "signature": "def _chain_file_exists(name)"}, {"kind": "function", "line": 2313, "name": "_load_ability", "signature": "def _load_ability(ability_file)"}, {"kind": "function", "line": 2320, "name": "_ability_to_step", "signature": "def _ability_to_step(ability)"}]}, {"doc": "Container and Kubernetes attack command set. Commands for Docker enumeration, Kubernetes cluster reconnaissance, pod escape detection, and container privilege escalation.", "id": "cli/commands/containers.py", "kind": "module", "label": "containers.py", "language": "py", "sha256": "ef58bc006525f6aa", "symbol_count": 7, "symbols": [{"doc": "Container and Kubernetes attack commands.", "kind": "class", "line": 30, "name": "ContainerCommandSet", "signature": "class ContainerCommandSet(LazyOwnCommandSet)"}, {"doc": "Enumerate Docker host: containers, images, privileges, mounts.\n\nChecks for:\n- Privileged containers\n- Docker socket mounts (escape vector)\n- Sensitive host path mounts\n- Dangerous Linux capabilities\n\nUsage: docker_enum", "kind": "method", "line": 37, "name": "do_docker_enum", "signature": "def do_docker_enum(self, _line)"}, {"doc": "Enumerate Kubernetes cluster: pods, secrets, SAs, RBAC.\n\nChecks for:\n- All namespaces and pods\n- Secrets (kubeconfig, tokens, credentials)\n- Service accounts with cluster-admin\n- Pod escape vectors (hostPID, privileged, mounts)\n\nUsage: k8s_enum", "kind": "method", "line": 101, "name": "do_k8s_enum", "signature": "def do_k8s_enum(self, _line)"}, {"doc": "Check current container for known escape vectors.\n\nDetects:\n- Docker socket mounted\n- Privileged mode\n- Host PID namespace shared\n- Dangerous capabilities (SYS_ADMIN, SYS_PTRACE)\n- Service account tokens (K8s)\n- Sensitive host mounts\n\nUsage: container_escape", "kind": "method", "line": 169, "name": "do_container_escape", "signature": "def do_container_escape(self, _line)"}, {"doc": "List Kubernetes pods with security-relevant details.\n\nShows pod status, hostNetwork, hostPID, privileged status,\nand namespace for each pod.\n\nUsage:\n k8s_pods\n k8s_pods ", "kind": "method", "line": 239, "name": "do_k8s_pods", "signature": "def do_k8s_pods(self, line)"}, {"doc": "List and decode Kubernetes secrets.\n\nExtracts and decodes all secrets from the cluster, writing\ncredentials and tokens to sessions/k8s_secrets_*.txt files.\n\nUsage:\n k8s_secrets\n k8s_secrets ", "kind": "method", "line": 283, "name": "do_k8s_secrets", "signature": "def do_k8s_secrets(self, line)"}, {"doc": "Auto-detect container runtime and escape primitives.\n\nDetects the container runtime (Docker, containerd, CRI-O, Podman,\nLXC, Kubernetes, systemd-nspawn), then enumerates dangerous mounts,\ncapabilities, and applicable escape techniques.\n\nUsage: container_detect", "kind": "method", "line": 334, "name": "do_container_detect", "signature": "def do_container_detect(self, _line)"}]}, {"doc": "Credential Access command set (pending). Phase 07 — commands for credential access: password cracking, hash manipulation, dictionary generation, and credential harvesting. Pending status: inherits from :class:`PendingCommandSet`. Promote to :class:`LazyOwnCommandSet` once originals are deleted from ``lazyown.py``.", "id": "cli/commands/cred.py", "kind": "module", "label": "cred.py", "language": "py", "sha256": "940a3774eaa05241", "symbol_count": 10, "symbols": [{"doc": "Credential Access phase commands (pending).", "kind": "class", "line": 23, "name": "CredentialAccessCommandSet", "signature": "class CredentialAccessCommandSet(LazyOwnCommandSet)"}, {"doc": "Run hashcat password cracking.", "kind": "method", "line": 30, "name": "do_hashcat", "signature": "def do_hashcat(self, line)"}, {"doc": "Convert a hash to John the Ripper format.", "kind": "method", "line": 39, "name": "do_john2hash", "signature": "def do_john2hash(self, line)"}, {"doc": "Run Hydra for online password attacks.", "kind": "method", "line": 47, "name": "do_hydra", "signature": "def do_hydra(self, line)"}, {"doc": "Run Medusa for online password attacks.", "kind": "method", "line": 59, "name": "do_medusa", "signature": "def do_medusa(self, line)"}, {"doc": "Generate wordlists with crunch.", "kind": "method", "line": 67, "name": "do_crunch", "signature": "def do_crunch(self, line)"}, {"doc": "Generate a wordlist from a website with cewl.", "kind": "method", "line": 75, "name": "do_cewl", "signature": "def do_cewl(self, line)"}, {"doc": "Generate an SSH key pair.", "kind": "method", "line": 87, "name": "do_sshkey", "signature": "def do_sshkey(self, line)"}, {"doc": "Extract credentials from a file or command output.", "kind": "method", "line": 93, "name": "do_creds_py", "signature": "def do_creds_py(self, line)"}, {"doc": "Run SprayKatz for credential spraying.", "kind": "method", "line": 98, "name": "do_spraykatz", "signature": "def do_spraykatz(self, line)"}]}, {"doc": "cred commands migrated from lazyown.py. Auto-generated by scripts/migrate_lazyown.py.", "id": "cli/commands/cred_migrated.py", "kind": "module", "label": "cred_migrated.py", "language": "py", "sha256": "5a67045e80c31e77", "symbol_count": 33, "symbols": [{"kind": "class", "line": 30, "name": "CredMigratedCommandSet", "signature": "class CredMigratedCommandSet(LazyOwnCommandSet)"}, {"doc": "Back up an existing credentials file before it is overwritten.\n\nArgs:\n credentials_file_path: Path to the active credentials file.\n\nReturns:\n The backup path when a rotation happened, otherwise ``None``.", "kind": "method", "line": 34, "name": "_rotate_existing_credentials", "signature": "def _rotate_existing_credentials(self, credentials_file_path)"}, {"doc": "Creates a `hash.txt` file in the `sessions` directory with the specified hash value and analyzes it using `Name-the-hash`.\n\nThis function performs the following actions:\n1. Validates the input line to ensure it is not empty.\n2. Backs up the existing `hash.txt` file if it exists, renaming it to `hash_{timestamp}.txt` based on the current timestamp.\n3. Writes the provided hash value to `sessions/hash.txt`.\n4. Analyzes the hash value using `Name-the-hash`.\n\nUsage:\n createhash \n\n:param line: The hash value to be written to `hash.txt` and analyzed.\n:type line: str\n:returns: None\n\nManual execution:\n1. Creates or overwrites the file `sessions/hash.txt` with the specified hash value.\n2. Analyzes the hash value using the `nth` command.\n\nDependencies:\n- `sessions/hash.txt` will be created in the `sessions` directory.\n- `Name-the-hash` must be installed and accessible via the command `nth`.\n\nExample:\n createhash 5f4dcc3b5aa765d61d8327deb882cf99\n\nNote:\n - Ensure the hash value is correct before running the analysis.\n - The hash value should be provided as a single argument without extra characters or spaces.", "kind": "method", "line": 62, "name": "do_createhash", "signature": "def do_createhash(self, line)"}, {"doc": "Creates a `credentials.txt` file in the `sessions` directory with the specified username and password.\n\nThis function performs the following actions:\n1. Validates the input line to ensure it contains a colon (`:`), indicating the presence of both a username and password.\n2. Backs up the existing `credentials.txt` file if it exists, renaming it to `credentials_{username}.txt` based on the existing username.\n3. Writes the valid input to `sessions/credentials.txt`.\n\nUsage:\n createcredentials user:password\n\n:param line: The input line containing the username and password in the format `user:password`.\n:type line: str\n:returns: None\n\nManual execution:\n1. Creates or overwrites the file `sessions/credentials.txt` with the specified username and password.\n\nDependencies:\n- `sessions/credentials.txt` will be created in the `sessions` directory.\n\nExample:\n createcredentials administrator:passwordadministrator123&!\n\nNote:\n - Ensure the input format is correct: `user:password`.\n - The credentials should be properly formatted with a colon separating the username and password.", "kind": "method", "line": 116, "name": "do_createcredentials", "signature": "def do_createcredentials(self, line)"}, {"doc": "Display the credentials stored in the `credentials.txt` file and copy the password to the clipboard.\n\nThis function reads the stored credentials from a file named `credentials.txt` located in the `sessions` directory.\nThe file should be in the format `username:password`. If the file does not exist, an error message will be printed\ninstructing the user to create the credentials file first. The function extracts the username and password from the file,\nprints them, and copies the password to the clipboard using `xclip`.\n\n:param line: A string parameter that is not used in this function. It is included for compatibility with command-line\n interface functions.\n\n:returns: None\n\nManual execution:\nTo manually perform the equivalent actions, follow these steps:\n\n 1. Ensure the file `sessions/credentials.txt` exists and contains credentials in the format `username:password`.\n 2. Read the file and extract the username and password.\n 3. Print the username and password to the console.\n 4. Use the `xclip` tool to copy the password to the clipboard. Example command:\n\n echo '' | xclip -sel clip\n\nExample:\nIf `sessions/credentials.txt` contains `admin:password123`, the function will print:\n\n User : admin\n Pass : password123\n\nThe password `password123` will be copied to the clipboard.\n\nNote:\nEnsure `xclip` is installed on your system for copying to the clipboard. The function assumes that `xclip` is available\nand correctly configured.", "kind": "method", "line": 164, "name": "do_cred", "signature": "def do_cred(self, line)"}, {"doc": "Helps to find hash types in Hashcat by searching through its help output.\n\n1. Checks if an argument is provided:\n- If no argument is given, displays an error message indicating the need to pass a hash type.\n\n2. Executes a command to search for hash types:\n- Runs `hashcat -h` to display Hashcat help information and pipes it to `grep` to search for the provided argument.\n- Prints a message with the command being executed and provides further instructions for running Hashcat.\n\n3. Prints a message suggesting the next step:\n- Provides a suggestion for running Hashcat with the found hash types.\n\n:param line: The hash type or keyword to search for in the Hashcat help output.\n:type line: str\n:returns: None\n\nManual execution:\nTo manually run these tasks, you would need to:\n- Run `hashcat -h` to display the help information.\n- Use `grep` to search for the specific hash type or keyword within the help output.\n- Run Hashcat with the appropriate parameters based on the search results.\n\nNote: Ensure that `hashcat` is installed and accessible in the system's PATH.", "kind": "method", "line": 217, "name": "do_searchhash", "signature": "def do_searchhash(self, line)"}, {"doc": "Handles the creation of temporary files for users and passwords based on a small dictionary.\n\nThis function prompts the user to decide whether to use a small dictionary for generating\nuser and password lists. If the user agrees, it loads the credentials from a JSON file and\nwrites them into temporary files. If the user declines, the process is aborted.\n\nParameters:\nlist (str): Not used in this function, but kept for compatibility with cmd command input.\n\nReturns:\nNone", "kind": "method", "line": 253, "name": "do_smalldic", "signature": "def do_smalldic(self, list)"}, {"doc": "Execute the dacledit.py command for a specific user or all users listed in the users.txt file.\n\nThis function interacts with the DACL editor to modify access control lists in an Active Directory environment.\nIt allows the user to select a specific user from the list or execute the command for all users.\nInstall impacket suit to get this script in the examples\nArgs:\n line (str): The organizational unit (OU) in the format 'OU=EXAMPLE,DC=DOMAIN,DC=EXT'. If not provided, the user is prompted to enter it.\n\nReturns:\n None\n\nWorkflow:\n 1. Extract parameters and assign up paths.\n 2. Check the reachability of the remote host.\n 3. Prompt the user for an OU if not provided.\n 4. Check if the users.txt file exists and read the list of users.\n 5. Display the list of users and prompt the user to select a specific user.\n 6. Execute the dacledit.py command for the selected user or all users.\n\nRaises:\n FileNotFoundError: If the users.txt file does not exist.\n\nExample:\n To execute the command for a specific user:\n >>> do_dacledit(\"MARKETING DIGITAL\")\n\n To execute the command for all users:\n >>> do_dacledit(\"\")", "kind": "method", "line": 291, "name": "do_dacledit", "signature": "def do_dacledit(self, line)"}, {"doc": "Generates a wordlist based on a target name and a list of characters, with various combinations.\n\nThis function prompts the user for a target name and a wordlist name, then generates various combinations\nof the target name with a given list of characters. The combinations include single, double, triple, fourth,\nfifth, sixth, and intercalated character variations. The generated passwords are saved to the specified\nwordlist file.\n\n:param line: Not used in this function.\n\n:returns: None\n\nManual execution:\nTo manually generate a wordlist, run the script and follow the prompts to enter the target name,\nwordlist name, and additional characters if desired.\n\nFor example:\n Enter target name(Ex. john) ::: john\n Enter wordlist name ::: my_wordlist.txt\n Char List ::: 1 2 3 4 5 6 7 8 9 0 ! @ # $\n Do you want to add more characters in char List[y/n] ::: y\n Enter characters by commas(Ex. : ^,&,*,) ::: ^,&,*", "kind": "method", "line": 361, "name": "do_generatedic", "signature": "def do_generatedic(self, line)"}, {"doc": "Generate email permutations based on a full name and self.params['domain'], then save them to a file.\n\nThis function prompts the user for a full name and self.params['domain'], generates various email\npermutations based on that information, and saves the results in a text file located\nin the `sessions` directory.\n\nParameters:\nline (str): used as Fullname.\n\nInternal Variables:\nfull_name (str): The full name entered by the user, defaulting to 'John Doe'.\nself.params['domain'] (str): The self.params['domain'] entered by the user, defaulting to 'example.com'.\n\nReturns:\nNone\n\nExample Usage:\n- To generate emails using default values: `createmail`\n- To specify a full name and self.params['domain']: `createmail`\n\nNote:\n- The generated emails will be stored in a file named `emails_{full_name}_{self.params['domain']}.txt`\n within the `sessions` directory.", "kind": "method", "line": 626, "name": "do_createmail", "signature": "def do_createmail(self, line)"}, {"doc": "Perform password spraying using crackmapexec with the provided parameters.\n\n:param line: This parameter is not used in the function but can be reserved for future use.\n\n:returns: None\n\nManual execution:\nTo manually run `crackmapexec` for password spraying, use the following command:\n\n crackmapexec smb -u -p --continue-on-success\n\nThis function prompts the user for IP address, user file, and password.", "kind": "method", "line": 674, "name": "do_passwordspray", "signature": "def do_passwordspray(self, line)"}, {"doc": "Opens or creates the users.txt file in the sessions directory for editing using nano.\n\n:param line: Not used directly but reserved for future use.\n\n:returns: None", "kind": "method", "line": 706, "name": "do_addusers", "signature": "def do_addusers(self, line)"}, {"doc": "Decrypts TightVNC passwords using Metasploit.\n\nThis function demonstrates how TightVNC passwords can be decrypted using the known hardcoded DES key\nfrom the program and Metasploit's `Rex::Proto::RFB::Cipher.decrypt` function.\n\nSteps:\n- Receives the password in hexadecimal format from the command line input.\n- Creates a Metasploit resource script that includes commands to decrypt the TightVNC password.\n- Executes Metasploit with the created resource script and then deletes the temporary file.\n- Prints the decrypted password.\n\n:param line: The TightVNC password in hexadecimal format.\n:type line: str\n:returns: None\n\nManual execution:\nTo manually decrypt a TightVNC password, you would need to:\n- Use Metasploit's `Rex::Proto::RFB::Cipher.decrypt` function with the hardcoded DES key and the hexadecimal password.\n\nExample:\npasstightvnc D7A514D8C556AADE", "kind": "method", "line": 728, "name": "do_passtightvnc", "signature": "def do_passtightvnc(self, line)"}, {"doc": "Transforms the input string based on user-defined casing style.\n\nThis command asks the user for a casing style (e.g., lower, upper, camel, pascal)\nand transforms the input string accordingly.\n\nParameters:\n line (str): Input string to be transformed.", "kind": "method", "line": 775, "name": "do_transform", "signature": "def do_transform(self, line)"}, {"doc": "Generate usernames using the username-anarchy tool based on user input.\n\nThis function prompts the user to either provide names directly or select\noptions such as auto-generation based on country datasets, input files, and\nspecific username formats. It then constructs the command for `username-anarchy`\nand executes it.\n\n:param line: is optional you can pass the name and lastname as an argument example: username_anarchy firstname lastname\n:returns: None", "kind": "method", "line": 803, "name": "do_username_anarchy", "signature": "def do_username_anarchy(self, line)"}, {"doc": "List all .kdbx files in the 'sessions' directory, let the user select one, and run the\ncommand `sudo keepass2john {user_file} > sessions/hash.txt`.\nIf 'sessions/hash.txt' already exists, it will be backed up with a timestamp to avoid overwriting.\n\nParameters:\nline (str): An optional string parameter. This can be used for any additional input,\n though it's not needed in this specific command.\n\nReturns:\nNone", "kind": "method", "line": 904, "name": "do_john2keepas", "signature": "def do_john2keepas(self, line)"}, {"doc": "Open a .kdbx file and print the titles and contents of all entries. The password can be provided through\nthe 'line' parameter, via user input, or from a 'credentials.txt' file in the 'sessions' directory.\n\nIf the file 'credentials.txt' exists in the 'sessions' directory, the first password from it\nwill be used automatically.\n\nParameters:\nline (str): An optional string parameter to pass the password. If not provided, the user will\n be prompted to input the password.\n\nReturns:\nNone", "kind": "method", "line": 953, "name": "do_keepass", "signature": "def do_keepass(self, line)"}, {"doc": "Crack a Cisco Type 7 password hash and display the plaintext.\n\nThis command takes an encrypted Cisco Type 7 password hash as input,\nprocesses it to recover the original plaintext password, and prints the\nresult to the console.\n\nArgs:\n line (str): The encrypted password hash in Cisco Type 7 format.\n\nReturns:\n None: The function prints the plaintext password directly to the console.", "kind": "method", "line": 1017, "name": "do_crack_cisco_7_password", "signature": "def do_crack_cisco_7_password(self, line)"}, {"doc": "Command cubespraying: Automates the installation and usage of CubeSpraying for performing credential spraying attacks.\n\nThis function performs the following tasks:\n1. Clones and installs CubeSpraying if not already installed.\n2. Prompts the user for the target URL, username file, password file, and optional parameters like verbosity and timeout.\n3. Executes CubeSpraying for credential spraying attacks against the target URL.\n\nArgs:\n line (str): Optional argument for specifying the target URL, username file, password file, and additional CubeSpraying options.\n\nReturns:\n None\n\nExample:\n cubespraying --url http://example.com --usernames users.txt --passwords passwords.txt --verbose --timeout 5", "kind": "method", "line": 1039, "name": "do_cubespraying", "signature": "def do_cubespraying(self, line)"}, {"doc": "List all .zip files in the 'sessions' directory, let the user select one, and run the command\n`zip2john {selected_file} > sessions/hash.txt`.\nThen, run John the Ripper to crack the hash using the RockYou wordlist with multiple forks.\n\nParameters:\nline (str): An optional string parameter. This can be used for any additional input, though\n it's not needed in this specific command.\n\nReturns:\nNone", "kind": "method", "line": 1101, "name": "do_john2zip", "signature": "def do_john2zip(self, line)"}, {"doc": "Command createusers_and_hashs: Extracts usernames and hashes from a dump file.\n\nThis function opens a nano editor for the user to input the contents of a\nfile in the format:\n\n username:UID:LM_HASH:NT_HASH:::\n\nOnce the data is entered and saved, the function generates:\n1. A file named `usernames_{self.params['rhost']}.txt` containing all usernames.\n2. Individual files named `hash_{username}.txt` for each user, containing\nthe user's LM and NT hash in the format `LM_HASH:NT_HASH`.\n\nArgs:\n line (str): Unused parameter, kept for consistency.\n\nReturns:\n None", "kind": "method", "line": 1162, "name": "do_createusers_and_hashs", "signature": "def do_createusers_and_hashs(self, line)"}, {"doc": "Generate a list of possible passwords by filling each asterisk in the input with user-specified characters.\n\n:param line: A string containing asterisks (e.g., WebAO***7) for generating variations.\n\n:returns: None\n\nProcess:\nPrompts the user to enter characters to replace each asterisk, creates all possible combinations,\nand saves them to 'sessions/passwords_refilled.txt'. If this file exists, the previous version is\nrenamed with a timestamp suffix.", "kind": "method", "line": 1205, "name": "do_refill_password", "signature": "def do_refill_password(self, line)"}, {"doc": "Reduces a wordlist based on the specified password length.\n\nThis function filters the provided wordlist to only include passwords\nthat match the specified length. If no length is provided, it defaults\nto 4. The function constructs a grep command to achieve this and executes\nit.\n\nUsage:\n do_rocky(line: str)\n\n:param line: The length of the passwords to filter in the wordlist.\n This parameter should be a string representing a positive integer.\n If not provided, the function prompts the user for input.\n:type line: str\n:raises ValueError: If the provided length is not a valid positive integer.\n\nExample:\n do_rocky('8')\n # Executes: grep '^.\\{8\\}$' /usr/share/wordlists/rockyou.txt > sessions/lazypass_mini_rocky.txt", "kind": "method", "line": 1241, "name": "do_rocky", "signature": "def do_rocky(self, line)"}, {"doc": "Performs a password spray attack on Azure Active Directory Seamless Single Sign-On (SSO) using a specified list of users.\n\nThis function automates the process of spraying a given password across multiple user accounts in a target self.params['domain']. It utilizes\na user list in the form of a text file, targeting Azure AD Seamless SSO endpoints. The results are processed and saved to\na specified output file, providing insights into which accounts were successful or failed during the attack.\n\nRequirements:\n - A valid self.params['domain'] and URL for the target Azure AD instance. (assing url https://url.com)\n - A user dictionary file containing usernames (without the self.params['domain']) to be sprayed.\n\nParameters:\n line (str): Command-line input passed to the function (not currently used in the function).\n\nBehavior:\n - Loads the self.params['domain'] and URL from the configuration stored in `self.params`.\n - Reads the user list from a file specified in `get_users_dic`.\n - Sprays the specified password to all users and processes the results.\n - Saves the successful and failed attempts to the output file.\n\nExample:\n - Perform a password spray attack with the password \"admin\" and save the results:\n >>> adsso_spray\n - Customize the password or user list by modifying `self.params` before invoking the function.", "kind": "method", "line": 1277, "name": "do_adsso_spray", "signature": "def do_adsso_spray(self, line)"}, {"doc": "Generates single character combinations with the target name.\n\n:param name: Target name to use in the combinations.\n:param characters: List of characters to combine with the target name.\n:param file: File object to write the combinations to.\n:param total: Running total of passwords generated.\n:param flag: If True, generate combinations with the target name at both the beginning and the end of the string.\n\n:returns: Updated total of passwords generated.", "kind": "function", "line": 386, "name": "single_combo", "signature": "def single_combo(name, characters, file, total, flag)"}, {"doc": "Generates double character combinations with the target name.\n\n:param name: Target name to use in the combinations.\n:param characters: List of characters to combine with the target name.\n:param file: File object to write the combinations to.\n:param total: Running total of passwords generated.\n:param flag: If True, generate combinations with the target name at both the beginning and the end of the string.\n\n:returns: Updated total of passwords generated.", "kind": "function", "line": 409, "name": "double_combo", "signature": "def double_combo(name, characters, file, total, flag)"}, {"doc": "Generates triple character combinations with the target name.\n\n:param name: Target name to use in the combinations.\n:param characters: List of characters to combine with the target name.\n:param file: File object to write the combinations to.\n:param total: Running total of passwords generated.\n:param flag: If True, generate combinations with the target name at both the beginning and the end of the string.\n\n:returns: Updated total of passwords generated.", "kind": "function", "line": 433, "name": "triple_combo", "signature": "def triple_combo(name, characters, file, total, flag)"}, {"doc": "Generates fourth character combinations with the target name.\n\n:param name: Target name to use in the combinations.\n:param characters: List of characters to combine with the target name.\n:param file: File object to write the combinations to.\n:param total: Running total of passwords generated.\n:param flag: If True, generate combinations with the target name at both the beginning and the end of the string.\n\n:returns: Updated total of passwords generated.", "kind": "function", "line": 458, "name": "fourth_combo", "signature": "def fourth_combo(name, characters, file, total, flag)"}, {"doc": "Generates fifth character combinations with the target name.\n\n:param name: Target name to use in the combinations.\n:param characters: List of characters to combine with the target name.\n:param file: File object to write the combinations to.\n:param total: Running total of passwords generated.\n:param flag: If True, generate combinations with the target name at both the beginning and the end of the string.\n\n:returns: Updated total of passwords generated.", "kind": "function", "line": 484, "name": "fifth_combo", "signature": "def fifth_combo(name, characters, file, total, flag)"}, {"doc": "Generates sixth character combinations with the target name, adding uppercase characters.\n\n:param name: Target name to use in the combinations.\n:param characters: List of characters to combine with the target name.\n:param file: File object to write the combinations to.\n:param total: Running total of passwords generated.\n:param flag: If True, generate combinations with the target name at both the beginning and the end of the string.\n\n:returns: Updated total of passwords generated.", "kind": "function", "line": 511, "name": "sixth_combo", "signature": "def sixth_combo(name, characters, file, total, flag)"}, {"doc": "Generates combinations of the target name and character list, intercalating uppercase and lowercase characters.\n\nThis function generates combinations where each character in the string alternates between uppercase and\nlowercase. It also allows for the addition of the target name at the beginning or the end of the string.\n\n:param name: Target name to use in the combinations.\n:param characters: List of characters to intercalate with the target name.\n:param file: File object to write the combinations to.\n:param total: Running total of passwords generated.\n:param flag: If True, generate combinations with the target name at both the beginning and the end of the string.\n\n:returns: Updated total of passwords generated.", "kind": "function", "line": 536, "name": "intercalate_combo", "signature": "def intercalate_combo(name, characters, file, total, flag)"}, {"doc": "Expands a regular expression into a list of characters.\n\n:param regex: Regular expression string to expand.\n:returns: List of characters matching the regular expression.", "kind": "function", "line": 568, "name": "expand_regex", "signature": "def expand_regex(regex)"}, {"doc": "Helper function to alternate the case of characters in a string.", "kind": "function", "line": 552, "name": "alternate_case", "signature": "def alternate_case(s)"}]}, {"doc": "Crystal Ball CLI command set — privilege escalation vector prediction. Parses linpeas/winpeas output and suggests ranked privesc vectors with exact commands, CVE references, and MITRE ATT&CK mapping.", "id": "cli/commands/crystal_ball.py", "kind": "module", "label": "crystal_ball.py", "language": "py", "sha256": "2cf280eba745c085", "symbol_count": 5, "symbols": [{"doc": "Crystal Ball — privesc vector prediction and ranking.", "kind": "class", "line": 20, "name": "CrystalBallCommandSet", "signature": "class CrystalBallCommandSet(LazyOwnCommandSet)"}, {"doc": "Find linpeas or winpeas output in sessions/.\n\nReturns:\n Absolute path to the most recent enumeration file, or None.", "kind": "function", "line": 119, "name": "_auto_detect_enum_file", "signature": "def _auto_detect_enum_file()"}, {"doc": "Sanitise a string for use as a filename component.", "kind": "function", "line": 151, "name": "_safe_filename", "signature": "def _safe_filename(name)"}, {"doc": "Analyze linpeas/winpeas output and rank privesc vectors with exact commands.\n\nUsage:\n crystal_ball Analyse enumeration output file\n crystal_ball --text \"