LazyOwn

Red team framework and multi-operator C2 platform with AI agents, malleable implants, rootkits, phishing engine, and 741 CLI commands covering the full attack kill chain.

741 CLI commands. Multi-operator C2. 153 MCP tools for AI agents. The only OSS C2 with Linux BOF support + built-in YARA/Nuclei marketplaces.

More demos

Full walkthrough: QUICKSTART.md (5 min) · 80/20 guide: ESSENTIALS.md · HTB end-to-end: docs/examples/htb-lame-walkthrough.md · Honest comparison: COMPARISON.md

Why LazyOwn vs Sliver / Havoc / Mythic / Caldera / Metasploit

Full table: COMPARISON.md. Found an error? Open an issue, we fix it.

LazyOwn comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under the terms of the GNU General Public License v3. See the LICENSE file for details about using this software.

LazyOwn RedTeam Framework v0.2.161

LazyOwn is a professional red team framework and Command & Control (C2) platform built for penetration testers, red teams, and security researchers. It delivers 741 CLI commands, 126 aliases, 153 MCP tools for AI agents, a multi-operator web C2 dashboard, and 137 YAML/Lua plugin integrations covering the full kill chain across Linux, Windows, macOS, and BSD.

New in v0.2.161: integrated marketplace with YARA rules + Nuclei templates, auto_pwn autonomous exploitation, hunt command for threat-informed recon, post-command tips engine, automatic session data encryption, gamified ELO/badges, and 7 new APT playbooks.

Quickstart in three commands

New here? This is the whole on-ramp. Full walkthrough: QUICKSTART.md.

The default install is light; add --with-ml for the heavy torch/CUDA stack, --with-ollama for the local LLM runtime, --with-tools for the common external binaries. Dependencies are pinned in requirements.txt (cross-platform core) and requirements-ml.txt (optional ML); pyproject.toml is the single source of truth.

Docker

For isolated, reproducible engagements, see lazyown-docker/README.md.

Then, inside the (LazyOwn) > shell:

If doctor reports a blocking failure (red), fix it before going further — it tells you the exact pip install / apt install command for whatever is missing. Warnings (yellow) are optional features you can ignore for now.

Core Architecture

LazyOwn is built around a modular, command-driven architecture that provides flexibility and extensibility for security testing workflows.

LazyOwn integrates a command-line interface (CLI) built on cmd2 and a web-based GUI built on Flask. Parameters are scoped to payload.json, enabling consistent configuration across tools. The framework supports adversary simulation, task scheduling via the cron command, and persistent automated threat simulation workflows.

See CONTRIBUTING.md for details.

LazyOwn Skills — MCP Integration

Connect Claude Code to the LazyOwn framework via the Model Context Protocol (MCP). The MCP server exposes 153 tools covering the full engagement lifecycle.

Files

Quick Start (5 minutes to first shell)

Full guide: QUICKSTART.md

Multi-Operator Collaboration

LazyOwn's collab layer provides real-time team server functionality via Server-Sent Events (SSE). It activates automatically when lazyc2.py starts.

Browser dashboard — open in any browser on the team:

Terminal SSE stream:

Publish a finding to all operators:

Lock a target (prevents two operators running the same tool):

From the CLI: collab_join <handle> prints all URLs for a given operator.

MCP Quick Start

LazyOwn exposes its full framework via the Model Context Protocol (MCP). The same server works with Claude Code, Claude Desktop, Hermes Agent, and OpenCode — pick the integration that matches your environment.

Claude Code

Or copy .mcp.example.json to .mcp.json and set LAZYOWN_DIR to the absolute path of this checkout:

Install the slash command (optional):

After restarting Claude Code, all lazyown_* tools are available.

Hermes Agent

LazyOwn is Hermes-native. The skills/hermes-lazyown/ integration layer provides a compact, namespaced tool surface optimized for Hermes context windows with checkpoint resume, dynamic rule generation, and native delegation planning.

Register in ~/.hermes/config.yaml:

Then reload MCP tools in Hermes with /reload-mcp.

See skills/hermes-lazyown/README.md for the full Hermes integration guide.

OpenCode

LazyOwn is OpenCode-friendly via the LazyOwnOpenCodeAdapter:

The adapter bridges LazyOwn's MCP server into the OpenCode CLI, exposing the same lazyown_* tool surface with OpenCode-native prompts and workflows.

Full setup: https://github.com/grisuno/LazyOwnOpenCodeAdapter

Environment Variables

MCP Tool Groups (153 tools)

Full documentation: skills/README.md and skills/lazyown.md.

Audit-mode MCP improvements

Added in skills/lazyown_mcp_helpers.py to make autonomous audits more efficient and less error-prone. Logic lives in a pure-function module so it is unit-testable in isolation (tests/test_mcp_improvements.py).

Audit-mode CLI enhancements

A SOLID extension layer in cli/cli_enhancements.py plugs into the cmd2 shell via the existing CommandSet auto-discovery (cli/commands/audit.py). No edits to the 27k-line lazyown.py core were required beyond two small hooks (lazy alias loading, completedefault fallback).

The primitives are framework-agnostic and depend on small typing.Protocol interfaces (PayloadProvider, CommandLister, TerminalIO) so they can be unit-tested in isolation. See tests/test_cli_enhancements.py (36 tests).

Fuzzy dropdown autocomplete

The cmd2 shell installs a curses-driven fuzzy picker on top of GNU readline (cli/fuzzy_picker.py). On a single Tab press, when two or more completions are available, the picker opens a bordered dropdown anchored at the bottom of the terminal showing every match alongside its description. The scorer favours exact, prefix and subsequence matches over substring and similarity (the same ranking the standalone fz command uses), and the matched characters of the query are highlighted in each row so the operator can see why a candidate is in the list.

Navigation: ↑ / ↓ to move, Page Up / Page Down to jump, Home / End to seek, Backspace to edit the query in place, Tab or Enter to insert the highlighted command into the prompt, Esc or Ctrl-C to cancel. When only one candidate matches, readline's normal auto-insert behaviour is preserved so the picker never gets in the way of a fast operator. Geometry, colors and glyphs are driven by PickerConfig, and an optional fuzzy_picker block in payload.json can override any of its fields (e.g. "max_visible_rows": 8) without touching code.

Configurable Neon Box prompt — config_banner

The cmd2 shell renders a three-line Neon Box prompt assembled from a canonical set of segments (user_host, iface, lhost, rhost, domain, public_ip, cwd, git, venv, time, kernel, version, battery_load). The renderer is implemented in cli/banner_config.py as a small SOLID stack: one SegmentRenderer per piece of information, a SegmentRegistry, a BannerSettings value object, and a BannerRenderer that emits ANSI-colored output. Public IP, kernel release and the LazyOwn version are TTL-cached so the prompt stays sub-millisecond after the first render.

The config_banner shell command opens a Powerlevel10k-style curses wizard with three tabs — Segments, Colors, Glyphs — and a live preview of the resulting prompt anchored at the bottom of the panel. Tab / Shift+Tab cycle tabs; ↑ / ↓ move within the active tab; Enter saves to payload.json under the banner block; Escape cancels. Per-tab bindings:

The shell prompt refreshes immediately after save — no restart needed. Operators with no TTY (CI, scripts) can still drive the system with config_banner show and config_banner reset, or hand-edit the payload:

Color names are validated against ColorRegistry and glyph characters against GlyphRegistry; anything unknown silently falls back to the factory default so a malformed payload never breaks the prompt.

Graph-aware navigation — operator + agent UX from graphify

cli/graph_advisor.py loads the knowledge graph produced by /graphify over the LazyOwn source tree (graphify-out/graph_lazyown.json — ~1500 nodes, ~2900 edges, 14 communities) and exposes it to both the cmd2 shell and the MCP server. The advisor is a single-file SOLID stack — GraphLoader (mtime-cached file IO), GraphIndex (in-memory adjacency / degree / community indexes), GraphScorer (pure ranking primitive), GraphAdvisor (orchestrator) — with every constant kept on the GraphAdvisorConfig dataclass.

Operator commands (cmd2 shell)

The shell's default() hook now feeds unknown do_* commands through the same advisor + the existing FuzzyCommandIndex so an operator who types ddo_lazynmap instantly sees "Did you mean: do_lazynmap, do_lazynmap_quick, …?" before the toast.

MCP tools (Claude Code, Claude web, any MCP agent)

Every MCP graph tool trims list fields in place to fit budget_tokens (default 1500). When the graph is missing, every tool returns {"available": false, "reason": "..."} instead of crashing — the operator is told to run /graphify . once and everything starts working.

The advisor caches by (path, mtime) so a fresh /graphify rebuild is picked up automatically on the next CLI command or MCP call without restarting the shell or the MCP server. See tests/test_graph_advisor.py for the 20 unit tests covering loader, index, scorer and the full advisor API.

Inline reactive hints — non-blocking next-step suggestions

cli/reactive_hints.py hooks into the cmd2 post-command pipeline via register_postcmd_hook and prints a single dim line below every command output, before the next prompt appears:

The suggestion comes from the graphify knowledge graph (same GraphAdvisor used by suggest_next), so it is structurally grounded — not a generic list. The hook is fully non-blocking: it returns before cmd2 renders the prompt, so the operator can start typing the next command immediately.

Control

Commands on the skip list (help, ?, exit, set, show, palette, dashboard, suggest_next, graph_search, neighbors, god_nodes) never produce a hint line — they are meta-commands where a suggestion adds noise.

When the graphify graph is absent the hook returns silently. Run /graphify . once to build the graph and hints start appearing on the very next command.

Operator TUI dashboard — dashboard

cli/dashboard_tui.py is a full-screen Textual dashboard launched from the shell with:

It blocks the shell while open (like htop or lazygit). Press Q or Ctrl-C to close and return to the cmd2 prompt.

Layout

Data sources (auto-refreshed every 5 seconds)

Requires pip install textual (added to install.sh).

Command palette and graph-aware discovery

The lazyown_palette MCP tool (also reachable as the palette CLI command and the /palette web view, with a global Ctrl+K / Cmd+K overlay on every C2 page) lets agents and operators browse the 422+ do_* commands without scrolling. Modes:

The detail view's calls / related lists come from graphify-out/graph_lazyown.json (re-generated by the graphify skill); when that file is absent the palette degrades silently to phase data only.

Telegram Hermes Bot

The telegram_hermes.py bot bridges Telegram to the full LazyOwn framework via the MCP layer and Hermes gateway. It supports direct shell command execution, autonomous agent delegation, cron scheduling, C2 beacon interaction, and cross-platform messaging.

Files

Quick Start

Bot Commands

Any plain text message not prefixed with / is treated as a direct LazyOwn command. Rate limiting (5 commands/minute) and session timeouts (30 minutes) are enforced.

Architecture

The bot uses the same PTY-based command execution as the MCP server (skills/lazyown_mcp.py), so every LazyOwn command, alias, and addon works without direct Python imports. Autonomous tasks (/agent, /delegate) spawn Groq or Ollama agents through the LazyOwn shell, and C2 commands (/c2, /clients) use the authenticated /api/command and /get_connected_clients endpoints.

Advanced AI Architecture (MoE + RL + SWAN + Hive Mind)

LazyOwn integrates a world-class multi-agent AI stack that adapts and improves through every engagement:

Mixture of Experts (MoE) — modules/moe_router.py

Five LLM experts are registered with capability tags, base weights, and cost tiers:

Routing uses temperature-scaled softmax (T = max(0.5, 1.5/(1+calls/50))) over adjusted weights. Weights self-adjust via exponential moving average of per-expert reward over time.

Reinforcement Learning from Models (RLM) — modules/rl_trainer.py

Tabular Q-learning trains the routing policy over engagement sessions:

Hyperparameters: α=0.10, γ=0.90, ε_start=0.20, ε_min=0.05, ε_decay=0.995. Epsilon-greedy exploration decays per update. Q-values persist to sessions/expert_qvalues.json across sessions.

SWAN Orchestrator — skills/swan_agent.py

The top-level integration layer wires MoE + RL + Detection Oracle + Hive Memory:

• swan_run: single-expert execution with RL-guided routing and post-execution Q-update
• swan_ensemble: N experts in parallel via ThreadPoolExecutor, synthesised by WeightedTextAggregator
• OutcomeEvaluator: reward = 0 when detection probability ≥ 70% (detection-aware reward shaping)
• Every result stored in Hive Memory (ChromaDB) for cross-session learning

Detection Oracle (Blue Team Mirror) — modules/detection_oracle.py

Predicts detection probability before execution using 17 Sigma-lite rules covering: credential access (LSASS, SAM, DCSync), lateral movement (PsExec, WMI, evil-winrm), privilege escalation (token impersonation, named pipes), exploitation, recon, C2, and brute force.

Probability aggregation: P(detect) = 1 - ∏(1 - P_i) across all triggered rules.

Purple Team Closed Loop — modules/auto_purple.py

Automated red-vs-blue measurement loop that executes offensive actions, queries LazyOwnBT for detection, and feeds results back to the Detection Oracle for calibration.

Detection methods:

Sigma rules detection engine (LazyOwnBT lazyownbt/detection.py):

Output files:

• sessions/purple_dataset.csv — ML training dataset
• sessions/purple_audit.jsonl — full audit log
• sessions/detection_feedback.jsonl — oracle calibration

Note: For production use, integrate with a real SIEM (Wazuh, Elastic SIEM, Splunk) via auditd log forwarding. The built-in Sigma rules are for offline testing only.

Hive Mind — skills/hive_mind.py

Multi-agent queen+drone architecture with shared memory:

• QueenBrain (Claude): high-level orchestration + ConsensusProtocol for high-risk actions
• DronePool (Groq/Ollama): parallel execution of recon/exploit/cred/lateral/privesc tasks
• HiveMemory: ChromaDB semantic + SQLite episodic + Parquet long-term storage
• EpisodeReflectionEngine: post-campaign lesson extraction stored as sessions/campaign_lessons.jsonl

Autonomous Campaign Intelligence (ACI) — skills/aci_planner.py

The first C2 framework that plans, executes, and learns autonomously.

ACI bridges the gap between a natural-language engagement goal and a fully autonomous execution loop. No competitor (Cobalt Strike, Sliver, Havoc, Metasploit) does this end-to-end:

Three MCP tools:

Quick-start:

What makes ACI unique vs. other tools:

• Cobalt Strike / Sliver / Havoc are C2 frameworks — the operator plans every step
• Metasploit has automation but no intelligence
• CALDERA emulates fixed ATT&CK procedures but can't adapt to novel environments
• ACI plans, executes, replans, and learns — continuously, across engagements

Persistence:

CLI usage (standalone):

Autonomous Daemon — skills/autonomous_daemon.py

Four asyncio roles in a single process — no Claude required between steps:

Enable SWAN in the daemon: export AUTO_USE_SWAN=1 before starting.

ACI feeds into the daemon: objectives injected by lazyown_aci_plan are picked up automatically by Role 1 (ObjectiveLoop) — no additional configuration needed.

Graph-Based Reasoning — modules/world_model.py

NetworkGraph tracks all discovered relationships (hosts, services, credentials, trust paths) and computes normalized degree centrality to surface pivot candidates. The top-3 candidates are injected into every to_context_string() call, ensuring the autonomous loop always knows the highest-value lateral movement targets.

Authorization Scope Guard

A red-team framework that reads its target from payload.json has a sharp edge: a stray rhost fires offensive commands at an unauthorized host. The scope guard is the safety net. Every interactive command flows through a single chokepoint that checks the active target against your authorized engagement scope before the command runs.

• Fail-open by design: dormant while the scope is empty or the mode is off, so existing campaigns are unaffected until you opt in. Any internal error allows the command rather than blocking the operator.
• warn annotates out-of-scope offensive commands; enforce blocks them pending explicit confirmation (and refuses in non-interactive sessions).
• Only offensive kill-chain categories are gated; reporting, configuration and local helpers always run. New offensive do_* commands are auto-classified.
• Stored in payload.json (scope, scope_enforcement); pure logic lives in cli/scope_guard.py with zero coupling to the shell.

Reproducible installs

Dependencies are declared once in pyproject.toml (single source of truth) and pinned for reproducible installs:

• requirements.txt — cross-platform core lock (no CUDA wheels).
• requirements-ml.txt — optional, heavy ML stack (torch/CUDA, scikit-learn).
• install.sh runs under strict mode and is idempotent. The default install is light; opt into extras with --with-ml (2 GB ML stack), --with-ollama (local LLM runtime) and --with-tools (common external binaries).
• Developers: pip install -e .[ml,dev].

Key Features

1. 741 Attack Commands: Full kill-chain coverage across Linux, Windows, macOS, and BSD — recon, enum, exploit, privesc, lateral movement, credential access, C2, exfiltration, and reporting.
2. Interactive cmd2 CLI: Fuzzy autocomplete, neon-box configurable prompt, command palette (Ctrl+K), inline reactive hints after every command, and a Textual TUI dashboard.
3. Integrated Marketplace: yara_marketplace (10 built-in rules: ransomware, C2, webshells, obfuscation, privesc), nuclei_marketplace (500+ templates), marketplace for community plugins/addons — all browsable via curses TUI.
4. auto_pwn & hunt: Autonomous exploitation chaining and threat-informed recon — auto_pwn walks kill-chain phases automatically, hunt executes targeted discovery based on known TTPs.
5. Unified Post-Command Tips Engine: Smart suggestions (kill-chain hints, protips, curiosity, autosuggest) with ELO rating, badges (First Blood, Arsenal Master, Kill Chain Master), and VRI rewards — gamified operator experience.
6. Automatic Session Crypto: auto_crypto encrypts sensitive session files on exit and decrypts on startup (PBKDF2HMAC + Fernet), transparent to the operator.
7. AI-Native Architecture: MoE (Mixture of Experts) router, RL training, SWAN orchestrator, Hive Mind multi-agent system, ACI (Autonomous Campaign Intelligence) planner — the first C2 that plans, executes, and learns autonomously.
8. Multi-Stage Obfuscated Go Implants: Two-stage XOR-encoded beacon delivery with C stubs, AES-256 encrypted C2 channels, VM/sandbox/debugger evasion, polymorphism, and LOLBAS-based stagers. Tested on Kernel 6.12 and Windows 10.0.20348.
9. Linux BOF (Beacon Object Files): First open-source C2 framework with BOF support for Linux via ELF dlopen runtime. Source-compatible datap API with Windows BOF contract. Direct syscalls and io_uring support.
10. Decoy Blue Team Trap: Flask decoy website records video/audio and captures images of unauthorized visitors (blue team operators probing the C2), stored in sessions/captured_images.
11. Bloodhound Attack Surface: Upload Bloodhound ZIP data to render interactive attack surface graphs with filtering and search, augmented by lazynmap discovery data.
12. AI-Powered Phishing Engine: Groq/DeepSeek AI-generated email templates with dynamic URL generation, tracking pixels, URL shortening, and test endpoint creation.

3. Decoy: if the ip addres not match with 127.0.0.1 or lhost flask will show a decoy website this decoy site will record a video with audio and take pictures from the intruder (sessions/captured_images) like a small versión of storm breaker to know who is the blueteam operator

4. Adversary Simulation: Advanced capabilities for generating red team operation sessions, ensuring meticulous and effective simulations.

5. Task Scheduling: Utilize the cron command to schedule and automate tasks, enabling persistent threat simulations.
6. Real-Time Results: Obtain immediate feedback and results from security assessments, ensuring timely and accurate insights.
7. RAT and Botnet Capabilities: Includes features for remote access and control, allowing for the management of botnets and persistent threats.
8. C2 Framework IA Powered: Acts as a command and control (C2) framework, enabling covert communication and control over compromised systems. and many IA bots to improve your opsec, Developed in Flask, providing a user-friendly interface for seamless interaction. Now with network discovery capabilities, allowing us to see the attack surface on our client map clearly and intuitively with filters and a search panel. New functionalities are coming soon.

• C2 LazyAddon Creator: Guided /addons pages in the C2 dashboard to author lazyaddons/*.yaml integrations without touching YAML by hand. One form exposes every addon option (name, description, author, version, enabled, target OS, trigger services, category, module type, install type, parameters, tool block, C2 extras, environment variables) with tooltips, placeholders, and per-field help. Placeholder chips ({rhost}, {url}, declared params, and every payload.json key) are drag-and-drop into command boxes. Server-side validation rejects unsafe names, path traversal, unknown placeholders, and malformed URLs before the file is written; writes are atomic and secure (temp file created with restrictive permissions via mkstemp + fchmod, flushed and fsynced, then promoted with os.replace). The list and YAML preview pages complete the lifecycle. Every mutating route is CSRF-protected. Contract: lazyc2/addon_creator.py + lazyc2/blueprints/addons.py, covered by tests/test_addon_creator.py and the tests/run_mutation_addon_creator.py mutation gate.

9. Undetectable, Obfuscated, and Malleable GO Implants: The command with the payload comes obfuscated by default. Instead of directly downloading the beacon, it downloads a stub created in C to download the beacon, which is XOR-encoded with a key. It is then decoded in memory and executed in a temporary path with a unique name to evade detection, using svchost in Windows and lazyservice in Linux. This performs a two-stage implant, which has been tested on Kernel 6.12 and Windows [Version 10.0.20348.3807]. Additionally, an alternative Windows stub using LOLBAS PS1 and Csharp has been added, along with a version of ebird3 in LOLBAS that uses the same technologies. The Go beacon is a multi-platform, undetectable, and highly obfuscated implant tailored for advanced red teaming operations. It features polymorphism, operates in a configurable stealth mode, and secures communications with AES-256 encrypted channels. The beacon blends into environments by simulating legitimate network traffic and evades detection by identifying virtual machines, sandboxes, containers, and debuggers, dynamically adjusting its behavior. With a minimal footprint, it supports robust network discovery through ping-based host enumeration and port scanning of configured targets. The implant excels at exfiltrating sensitive data, including private keys, AWS credentials, browser credentials, and system logs. It offers dynamic TCP proxying for traffic redirection, privilege escalation attempts, and system log cleaning. Persistence is achieved across Windows, Linux, and macOS via scheduled tasks, systemd, crontab, and LaunchAgents. Additional capabilities include adversary emulation (MITRE ATT&CK), file timestamp obfuscation, and directory compression for exfiltration. Built with Go vet for code health, the implant integrates seamlessly with Dockerized environments and AWS Firecracker microVMs, making it a cornerstone of modern red team infrastructure, Built with Go vet for code integrity, the implant leverages Cloudflare for traffic obfuscation, routing communications through secure, high-performance redirectors to conceal C2 infrastructure. The Go binary is hardened with Garble obfuscation, thwarting reverse engineering and signature-based detection. On Windows, the implant employs extension camouflage to masquerade as benign files (e.g., .pdfx) and embeds custom icons via rsrc for convincing social engineering.

Available beacon commands:

• stealth_off stop being stealthy, Disables stealth mode, allowing normal operations.
• stealth_on enter ninja mode, Enables stealth mode, minimizing activity to avoid detection.
• download: download:[filename] Downloads a file from the C2 to the compromised host.
• upload: [filename]: Uploads a file from the compromised host to the C2.
• rev: Establishes a reverse shell to the C2 using the configured port.
• exfil: Exfiltrates sensitive data (e.g., SSH keys, AWS credentials, command histories).
• download_exec: download_exec:[url]: Downloads and executes a binary from a URL (Linux only, stored in /dev/shm).
• obfuscate: [filename]: Obfuscates file timestamps to hinder forensic analysis.
• cleanlogs: Clears system logs (e.g., /var/log/syslog on Linux, event logs on Windows).
• discover: Performs network discovery, identifying live hosts via ping.
• adversary:[id_atomic]: Executes an adversary emulation test (MITRE ATT&CK) using downloaded atomic redteam framework scripts.
• softenum: Enumerates useful software on the host (e.g., docker, nc, python).
• netconfig: Captures and exfiltrates network configuration (e.g., ipconfig on Windows, ifconfig on Linux).
• escalatelin: Attempts privilege escalation on Linux (e.g., via sudo -n or SUID binaries).
• proxy:[listenip]:[listenport]:[targetip]:[targetport] Starts a TCP proxy redirecting traffic from listenAddr to targetAddr.
• stop_proxy:[listenaddr] Stops a TCP proxy on the specified address.
• portscan: Scans ports on discovered hosts and the configured rhost.
• compressdir:[directory]: Compresses a directory into a .tar.gz file and exfiltrates it.
• sandbox: Get info about the system if it's a sandbox or not.
• isvm: Get info about the system if it's a virtual machine or not.
• debug: Get info about the system if the target is debugged or not.
• persist: Try to persist mechanism in the target system.

v0.2.161 Highlights

Unified kill-chain (single source of truth)

• modules/killchain.py computes the phase; every surface (CLI /killchain, /api/killchain, C2 /api/data+/api/dashboard, GUI2 panel) renders its snapshot().
• Beacon command history per implant: /api/beacon_results/<client_id>, backed by modules/beacon_history.py (JSONL, path-safe).
• CLI /killchain auto on|off|N live auto-refresh; flags killchain_auto_every / killchain_auto_on_phase_change.
• C2 decrypts session state on boot and re-encrypts on clean exit, so beacons and the kill-chain reflect real values while the server runs.

Marketplace (YARA + Nuclei)

Browse, search, and install from a unified marketplace TUI:

• yara_marketplace list|search|install|info -- 10 built-in rules (ransomware, C2, webshells, obfuscation, privesc)
• nuclei_marketplace list|search|install|info -- 500+ templates from ~/nuclei-templates
• marketplace list|search|install|update -- 137 YAML addons, 57 plugins, 69 tools

auto_pwn & hunt

• auto_pwn -- autonomous kill-chain walk from recon to exploitation
• hunt -- threat-informed recon: maps known TTPs to discovered services

Reactive Intelligence

• Post-command tips engine: kill-chain hints, protips, curiosity rewards
• ELO rating, badges (First Blood, Arsenal Master, Kill Chain Master)
• Inline reactive hints: "next command" suggestions after every action

Auto Crypto

Transparent session encryption on exit / decryption on startup via PBKDF2HMAC + Fernet.

New Playbooks

7 APT profiles: Azure Graph API, CICD Poisoning, Entra Connect, macOS TCC, OAuth Token Theft, SCCM/MECM, VDI Breakout.

Interactive Chain Mode

chainmode on starts a world-model-driven chaining flow: after every command the shell offers ranked next steps (Enter = top suggestion, 1..N = ranked alternative, any command = override, skip = manual, ESC/Ctrl+C/off = leave). Invalid picks re-prompt instead of silently skipping, and the flow auto-pauses after max_steps chained commands. State persists in sessions/chain_mode.json (atomic writes). Contract: cli/chain_mode.py + cli/command_chain.py.

Feature Polish (UX + security hardening)

• Evidence-backed inline hints: every suggestion carries verb, confidence ([0, 99], never a dishonest 100%), reason, and provenance. Contract: cli/reactive_hints.py + cli/recommendation_signals.py.
• Unified tips engine rendered entirely through rich (no raw ANSI escapes); registry tip text can never break markup rendering. Contract: cli/tips_engine.py.
• cli/noise_verbs.py is the single source of truth for the non-actionable verb lists shared by hints, tips, and chain mode.
• Tenant-bound API keys: core/api_authz.py now implements the documented rotation grace window, copies permissions from the rotated key (regression fixed), returns JSON 401/403 (safe with TRAP_HTTP_EXCEPTIONS), and the C2 /api/health/tenant endpoint is actually enforced. Mutation gate: tests/run_mutation_api_authz.py (7/7 killed).
• core/logging.py install_json_handler preserves pre-existing handlers and is idempotent.
• Structured ELO sync honours redirected user-store paths and tests are host-login independent.

Security Hardening (SDD+TDD+BDD)

Centralized security primitives in core/hardening.py with 48 BDD-style tests (tests/test_security_hardening_v3.py). Run with:

Key fixes applied:

• shell=True eliminated from anti_forensics.py, pivoting.py, icmp_server.py, resource_script.py, command_executor.py, postexp_migrated.py (22 instances)
• os.system() eliminated from persist_migrated.py, cloud.py, lazyown.py (4 instances), misc_migrated.py
• os.popen() eliminated from websocket_beacon.py, evasive_payload.py
• sshpass -p replaced with sshpass -e + env var across 4 files (C2, lateral, exfil, persist)
• Hardcoded encryption key removed from phishing_orchestrator.py (ENCRYPTION_KEY mandatory)
• XSS in C2 banner fixed with html.escape()
• Command injection via rhost in clipboard fixed with safe_clipboard_copy()
• cmd2 CMD_ATTR_HELP_CATEGORY renamed to COMMAND_ATTR_HELP_CATEGORY (cmd2 4.2.2 compat)

Command Capabilities

LazyOwn provides 741 commands across 13 kill-chain phases, available from both CLI and web C2 dashboard:

Core management: assign, show, doctor, wizard, scope, collab_join, config_banner, palette, fz.

See COMMANDS.md for the full 606-command reference and ESSENTIALS.md for the 18 commands that cover 80% of engagements.

Extending LazyOwnShell with Lua Plugins

This document explains how to use Lua scripting to extend the functionality of the LazyOwnShell application, which is built on top of the cmd2 framework in Python. Lua allows you to write custom plugins that can add new commands, modify existing behavior, or access application data.

Table of Contents

1. Introduction
2. Setting Up Lua Plugins
3. Writing Lua Plugins
4. Registering New Commands
5. Accessing Application Data
6. Error Handling
7. Example Plugins
8. Best Practices

1. Introduction

The LazyOwnShell application supports Lua scripting to allow users to extend its functionality without modifying the core Python code. Lua scripts (plugins) are stored in the plugins/ directory and are automatically loaded when the application starts.

Lua plugins can:

• Add new commands to the shell.
• Modify existing commands or behaviors.
• Access and manipulate application data exposed by Python.

2. Setting Up Lua Plugins

To use Lua plugins, ensure the following:

1. Install the lupa library in your Python environment:

   root@kitploit:~

   pip install lupa
   

   root@kitploit:~

   plugins/
        init_plugins.lua
        hello.lua
        goodbye.lua
   

   When the application starts, it will execute init_plugins.lua, which loads all other .lua files in the plugins/ directory.

2. Writing Lua Plugins A Lua plugin is a script file with the .lua extension placed in the plugins/ directory. Each plugin can define functions and register them as commands in the shell.

Structure of a Lua Plugin

Key Functions

• register_command(command_name, lua_function):
• Registers a new command in the shell.
• command_name: The name of the command (e.g., hello).
• lua_function: The Lua function to execute when the command is called.

3. Registering New Commands

   To add a new command to the shell, follow these steps:

• Define a Lua function that implements the command logic.

• Use register_command to register the function as a command.

• Example: Adding a hello Command

• Create a file plugins/hello.lua with the following content:

  root@kitploit:~

   function hello(arg)
       local name = arg or "world"
       print("Hello, " .. name .. "!")
   end
  
   register_command("hello", hello)
  

Now, you can run the hello command in the shell: bash hello Lua Hello, Lua! 4. Best Practices

• Keep Plugins Modular : Each plugin should focus on a single feature or functionality.
• Document Your Plugins : Provide clear documentation for each plugin, including usage examples.
• Test Thoroughly : Test your plugins in isolation before integrating them into the main application.
• Handle Errors Gracefully : Use pcall to handle errors in Lua plugins and prevent crashes.

By leveraging Lua scripting, you can extend the functionality of LazyOwnShell without modifying the core Python code. This allows for greater flexibility and customization, enabling users to write their own plugins to meet specific needs. Happy coding!

LazyAddons YAML System

Extending the LazyOwn RedTeam Framework's capabilities has never been so easy, even for non-programmers, thanks to the LazyAddons system that allows for extending functionalities using YAML files.

Declarative command creation through YAML configuration files.

File Structure

lazyaddons/ ├── addon1.yaml ├── addon2.yaml └── example.yaml

🛠️ Addon Definition

Minimal Example

Advanced Configuration

Features Auto-Installation Tools clone from Git when missing:

Parameter Substitution Replaces {param} in commands with values from:

• Command arguments

• Default values

• self.params

• Help Integration

help displays the YAML description.

Template

▶️ Usage Place YAML files in lazyaddons/

Start your CLI application

Execute registered commands:

🚨 Troubleshooting Missing parameters: Verify required fields in YAML

Install failures: Check network/git access

Command errors: Validate execute_command syntax

Key features:

• Clean GitHub-flavored markdown
• Focused only on YAML addons
• Includes ready-to-use templates
• Documents the parameter substitution system
• Provides troubleshooting tips

Would you like me to add any specific examples or usage scenarios?

LazyOwn on Reddit

Revolutionize Your Pentesting with LazyOwn: Automate the intrusion on Linux, MAC OSX, and Windows VICTIMS

https://www.reddit.com/r/LazyOwn/

https://github.com/grisuno/LazyOwn/assets/1097185/eec9dbcc-88cb-4e47-924d-6dce2d42f79a

Discover LazyOwn, the ultimate solution for automating the pentesting workflow to attack Linux, MacOSX and Windows systems. Our powerful tool simplifies pentesting, making it more efficient and effective. Watch this video to learn how LazyOwn can streamline your security assessments and enhance your cybersecurity toolkit.

LazyOwn is ideal for cybersecurity professionals seeking a centralized and automated solution for their pentesting needs, saving time and enhancing efficiency in identifying and exploiting vulnerabilities.

Requisitos

• Python 3.x

• Módulos de Python:

  • requests
  • python-libnmap
  • pwncat-cs
  • pwn
  • groq
  • PyPDF2
  • docx
  • python-docx
  • olefile
  • exifread
  • pycryptodome
  • impacket
  • pandas
  • colorama
  • tabulate
  • pyarrow
  • keyboard
  • flask-unsign
  • name-that-hash
  • certipy-ad
  • ast
  • pykeepass
  • cmd2
  • Pillow
  • netaddr
  • stix2
  • pyautogui

• subprocess (incluido en la biblioteca estándar de Python)

• platform (incluido en la biblioteca estándar de Python)

• tkinter (Opcional para el GUI)

• numpy (Opcional para el GUI)

Instalación

1. Clona el repositorio:

2. Instala las dependencias de Python:

Uso

Tag in youtube

https://www.youtube.com/hashtag/lazyown

Podcast

https://www.youtube.com/watch?v=m4FtlhownvM&list=PLW9Qe5HJK5CFXyIsF9b0NB6n9EY8Am3YZ

DeepWiki

https://deepwiki.com/grisuno/LazyOwn/

For searching within the scraped database obtained from GTFOBins.

Searches with GUI

Additional Features and Enhancements: AutocompleteEntry:

A filter has been added to remove None values from the autocomplete list. New Attack Vector:

A "New Attack Vector" button has been added to the main interface. Functionality has been implemented to add a new attack vector and save the updated data in Parquet files. Export to CSV:

A "Export to CSV" button has been added to the main interface. Functionality has been implemented to export DataFrame data to a user-selected CSV file. Usage:

Add a New Attack Vector: Click the "New Attack Vector" button, fill in the fields, and save. Export to CSV: Click the "Export to CSV" button and select the location to save the CSV file. New Function scan_system_for_binaries:

Implements system-wide binary searches using the file command to determine if a file is binary. Uses os.walk to traverse the file system. Results are displayed in a new window within the GUI. Button to Search for Binaries:

A "Search System for Binaries" button has been added to the main interface, which calls the scan_system_for_binaries function. Note:

The is_binary function uses the Unix file command to determine if a file is a binary executable. If you are on a different operating system, you will need to adjust this method for compatibility. This implementation can be resource-intensive as it traverses the entire file system. You may consider adding additional options to limit the search to specific directories or filter for certain file types.

If you want to update, we proceed as follows:

Use mode LazyOwn WebShells

LazyOwn Webshell Collection is a collection of webshells for our framework, which allows us to establish a webshell on the machine where we run LazyOwn using various programming languages. Essentially, LazyOwn Webshell raises a web server within the modules directory, making it accessible via a web browser. This allows us to both make the modules available separately through the web and access the cgi-bin directory, where there are four shells: one in Bash, another in Perl, another in Python, and one in ASP, in case the target is a Windows machine.

y listo ya podemos acceder a cualquiera de estas url:

http://localhost:8080/cgi-bin/lazywebshell.sh

http://localhost:8080/cgi-bin/lazywebshell.py

http://localhost:8080/cgi-bin/lazywebshell.asp

http://localhost:8080/cgi-bin/lazywebshell.cgi

Use Lazy MSFVenom to Reverse Shell

Command & Control System

The Command & Control (C2) system enables remote operations through a server-client architecture with encrypted communications.

Use Lazy PATH Hijacking

A file will be created in /tmp with the name binary_name set in the payload, initialized with gzip in memory, and using bash in the payload. To set the payload from the JSON, use the payload command to execute. Use:

Use mode LazyOwn RAT

LazyOwn RAT is a simple yet powerful Remote Administration Tool. It features a screenshot function that captures the server's screen, an upload command that allows us to upload files to the compromised machine, and a C&C mode where commands can be sent to the server. It operates in two modes: client mode and server mode. There is no obfuscation, and the RAT is based on BasicRat. You can find it on GitHub at https://github.com/awesome-security/basicRAT and at https://github.com/hash3liZer/SillyRAT. Although the latter is much more comprehensive, I just wanted to implement screenshot capture, file uploads, and command sending. Perhaps in the future, I will add webcam viewing functionality, but that will come later.

Use mode Lazy Meta Extract0r

LazyMeta Extract0r is a tool designed to extract metadata from various types of files, including PDF, DOCX, OLE files (such as DOC and XLS), and several image formats (JPG, JPEG, TIFF). This tool will traverse a specified directory, search for files with compatible extensions, extract the metadata, and save it to an output file.

[*] Iniciando: LazyMeta extract0r [;,;]

usage: lazyown_metaextract0r.py [-h] --path PATH lazyown_metaextract0r.py: error: the following arguments are required: --path

Use mode decrypt encrypt

A encryption method that allows us to both encrypt files and decrypt them if we have the key, of course.

Uso modo LazyNmap

The use of Lazynmap provides us with an automated script for a target, in this case, 127.0.0.1, using Nmap. The script requires administrative permissions via sudo. It also includes a network discovery module to identify what is present in the IP segment you are in. Additionally, the script can now be called without parameters using the alias nmap or with the command run lazynmap.

Usage of LazyOwn GPT One Liner CLI Assistant and Researcher

Discover the revolution in automating pentesting tasks with the LazyOwn GPT One Liner CLI Assistant! This incredible script is part of the LazyOwn tool suite, designed to make your life as a pentester more efficient and productive.

Key Features:

Intelligent Automation: Leverages the power of Groq and advanced natural language models to generate precise and efficient commands based on your specific needs. User-Friendly Interface: With a simple prompt, the assistant generates and executes one-liner scripts, drastically reducing the time and effort involved in creating complex commands. Continuous Improvement: Continuously transforms and optimizes its knowledge base to provide you with the best solutions, adapting to each situation. Simplified Debugging: Enable debug mode to obtain detailed information at every step, facilitating the identification and correction of errors. Seamless Integration: Works effortlessly within your workspace, harnessing the power of the Groq API to deliver quick and accurate responses. Security and Control:

Safe Error Handling: Intelligently detects and responds to execution errors, ensuring you maintain full control over each generated command. Controlled Execution: Before executing any command, it requests your confirmation, giving you peace of mind knowing exactly what is being executed on your system. Easy Configuration:

Set up your API key in seconds and start enjoying all the benefits offered by the LazyOwn GPT One Liner CLI Assistant. A quick start guide is available to help you configure and maximize the potential of this powerful tool.

Ideal for Pentesters and Developers:

Optimize Your Processes: Simplify and accelerate command generation in your security audits. Continuous Learning: The knowledge base is constantly updated and improved, always providing you with the latest best practices and solutions. With the LazyOwn GPT One Liner CLI Assistant, transform the way you work, making it faster, more efficient, and secure. Stop wasting time on repetitive and complex tasks, and focus on what truly matters: discovering and resolving vulnerabilities!

Join the pentesting revolution with LazyOwn and take your productivity to the next level!

[?] Usage: python lazygptcli.py --prompt "" [--debug]

[?] Options:

--prompt "The prompt for the programming task (required)." --debug, -d "Enables debug mode to display debug messages." --transform "Transforms the original knowledge base into an enhanced base using Groq." [?] Ensure you configure your API key before running the script: export GROQ_API_KEY=<your_api_key> [->] Visit: https://console.groq.com/docs/quickstart (not a sponsored link)

Requirements:

Python 3.x A valid Groq API key Steps to Obtain the Groq API Key: Visit Groq Console (https://console.groq.com/docs/quickstart) to register and obtain an API key.

Usage of lazyown_bprfuzzer.py

Provide the arguments as specified by the script's requests: The script will require the following arguments:

usage: lazyown_bprfuzzer.py [-h] --url URL [--method METHOD] [--headers HEADERS] [--params PARAMS] [--data DATA] [--json_data JSON_DATA] [--proxy_port PROXY_PORT] [-w WORDLIST] [-hc HIDE_CODE] --url: The URL to which the request will be sent (required). --method: The HTTP method to use, such as GET or POST (optional, default: GET). --headers: The request headers in JSON format (optional, default: {}). --params: The URL parameters in JSON format (optional, default: {}). --data: The form data in JSON format (optional, default: {}). --json_data: The JSON data for the request in JSON format (optional, default: {}). --proxy_port: The port for the internal proxy (optional, default: 8080). -w, --wordlist: The path to the wordlist for fuzzing mode (optional). -hc, --hide_code: The HTTP status code to hide in the output (optional). Make sure to provide the required arguments to ensure the script runs correctly.

Form 2: Advanced Usage

If you wish to take advantage of the advanced features of the script, such as request replay or fuzzing, follow these steps:

Request Replay:

To utilize the request replay functionality, provide the arguments as indicated earlier. During execution, the script will ask if you want to repeat the request. Enter 'y' to repeat or 'n' to terminate the repeater. Fuzzing:

To use the fuzzing functionality, make sure to provide a wordlist with the -w or --wordlist argument. The script will replace the word LAZYFUZZ in the URL and other data with the words from the provided wordlist. During execution, the script will display the results of each fuzzing iteration. These are the basic and advanced ways to use the lazyburp.py script. Depending on your needs, you can choose the method that best fits your specific situation.

Note: To use the dictionary, run the following command within /usr/share/seclists:

Usage of LazyOwn FTP Sniff Mode

This module is used to search for passwords on FTP servers across the network. Some may say that FTP is no longer used, but you would be surprised at the critical infrastructure environments I've seen with massive FTP services running on their servers. :)

Uso modo LazyReverseShell

Listen

para luego en la maquina victima

Usage of Lazy Curl to Recon Mode

The module is located in the modules directory and is used as follows:

and then

Usage.

GET:

POST:

TRACE:

wordlist bruteforce mode:

Make sure to adjust the parameters according to your needs and that the values you provide for the options are valid for each case.

Usage of ARPSpoofing Mode

The script provides an ARP spoofing attack using Scapy. In the payload, you must set the lhost, rhost, and the device that you will use to perform the ARP spoofing.

Usage of LazyGathering Mode

This script provides an X-ray view of the system in question where the tool is being executed, offering insights into its configuration and state.

Usage of Lazy Own LFI RFI 2 RCE Mode

The LFI RFI 2 RCE mode is designed to test some of the more well-known payloads against the parameters specified in payload.json. This allows for a comprehensive assessment of Local File Inclusion (LFI), Remote File Inclusion (RFI), and Remote Code Execution (RCE) vulnerabilities in the target system.

Usage of LazyOwn Sniffer Mode

https://www.youtube.com/watch?v=_-DDiiMrIlE

The sniffer mode allows capturing network traffic through interfaces using the -i option, which is mandatory. There are many other optional settings that can be adjusted as needed.

Usage

Experimental Obfuscation Using PyInstaller

This feature is in experimental mode and does not work fully due to a path issue. Soon, it will support obfuscation using PyInstaller.

Experimental NetBIOS Exploit

This feature is in experimental mode as it is not functioning yet... (coming soon, possibly an implementation of EternalBlue among other things...)

Experimental LazyBotNet with Keylogger for Windows and Linux

This feature is in experimental mode, and the decryption of the keylogger logs is not functioning xD. Here we see for the first time in action the payload command, which sets all the configuration in our payload.json, allowing us to preload the configuration before starting the framework.

Interactive Menus

The script features interactive menus to select actions to be performed. In server mode, it displays relevant options for the victim machine, while in client mode, it shows options relevant to the attacking machine.

Clean Interruption

The script handles the SIGINT signal (usually generated by Control + C) to exit cleanly.

License

This project is licensed under the GPL v3 License. The information contained in GTFOBins is owned by its authors, to whom we are immensely grateful for the information provided.

Acknowledgments ✌

A special thanks to GTFOBins for the valuable information they provide and to you for using this project. Also, thanks for your support Tito S4vitar! who does an extraordinary job of outreach. Of course, I use the extractPorts function in my .zshrc :D, thanks to deepwiki to help us with doc. ( https://deepwiki.com/grisuno/LazyOwn/ ), thanks to plaintext who does an extraordinary job of outreach and we adopted PTMultiTools it's very impresive

Thanks to pwntomate 🍅

An excellent tool that I adapted a bit to work with the project; all credits go to its author honze-net Andreas Hontzia. Visit and show love to the project: https://github.com/honze-net/pwntomate

Thanks to Sicat 🐈

An excellent tool for CVE detection, I implemented only the keyword search as I had to change some libraries. Soon also for XML generated by nmap :) Total thanks to justakazh. https://github.com/justakazh/sicat/

Thanks to josefcohernandez

For identifying and reporting the Docker build failures caused by the repo.charm.sh outage and the Python version incompatibility. His report led to the fixes in lazyown-docker/Dockerfile.

Thanks to EQSTLab (via yym8538)

For two critical security advisories that helped us harden the framework and fix serious vulnerabilities. Their responsible disclosure makes LazyOwn safer for the entire community.

BlackSandBeacon — Linux BOF

BlackSandBeacon brings Beacon Object File (BOF) extensibility to Linux for the first time in an open-source C2 framework. No commercial C2 (including Cobalt Strike) offers Linux BOF support.

What is Linux BOF?

On Windows, BOFs are position-independent PE COFF objects loaded by the beacon at runtime, giving operators an in-memory plugin system without spawning new processes. BlackSandBeacon ports this model to Linux:

• BOFs compile as position-independent ELF shared objects (.so) with GCC (-shared -fPIC -nostartfiles).
• The beacon loads them at runtime via dlopen — no disk writes after delivery, no new process, no shell.
• The datap API (BeaconDataParse, BeaconDataInt, BeaconDataExtract, BeaconPrintf, BeaconOutput) is source-compatible with the Windows BOF contract, so existing BOF authors can port by replacing Win32 calls with Linux syscalls or libc equivalents.
• Advanced BOFs can use direct syscalls via inline assembly or io_uring for kernel interaction without libc linking.

Deployment via LazyOwn

Porting a Windows BOF to Linux

Compile: gcc -shared -fPIC -nostartfiles -o mybof.so mybof.c

Adoption gap this closes

Related Projects

LazyOwn ships as the "all-in-one" front of a small ecosystem of focused red-team tools. Each project below stands on its own and can be wired into LazyOwn through lazyaddons/*.yaml, the C2 implant pipeline, or the MCP lazyown_palette --info view (which exposes the graphify-derived calls and related neighbours of every command).

Lightweight beacons (C / ASM)

Drop-in replacements for the bundled Go beacon when you need a smaller footprint or per-architecture artefacts:

• beacon — minimalist Windows beacon in C with BOF support via Early Bird APC injection and NT Native API calls. Pairs with LazyOwn's malleable C2 profile. Wired in via lazyaddons/beacon.yaml.
• blacksandbeacon — Linux-native beacon in C with first-class Linux BOF (Beacon Object File) support via ELF shared-object injection and direct syscalls. BOFs are loaded at runtime through a dlopen runtime — the same extensibility model as Windows BOF but targeting Linux kernel internals. No commercial C2 framework (including Cobalt Strike) offers Linux BOF support. Wired in via lazyaddons/blacksandbeacon.yaml; BOF loader via lazyaddons/blacksandbeacon_bof.yaml.
• blackzincbeacon — ARM build of the same family, for embedded / IoT engagements.

Lightweight C2 frameworks

Alternative C2 surfaces that speak the same beacon protocol as lazyc2.py or that can serve as a teamserver back-end:

• BlackObsidianC2 — small, fast Go C2 server intended as a stripped-down companion to lazyc2.py.
• LazyOwnBT — Bluetooth / proximity-aware C2 PoC; useful when the engagement scope explicitly covers RF.

AI / orchestration

Drop into LazyOwn through MCP, the toposwarm lazyaddon, or directly:

• toposwarm — natural-language router on top of the LazyOwn command catalogue; ships as both a lazyaddon and a Claude Code skill.
• LazyOwnOpenCodeAdapter — bridge between LazyOwn and OpenCode-style coding agents.

Loaders, shellcode runners and post-exploitation

Used both by humans through pwntomate .tool files and by the autonomous daemon when the reactive selector recommends an in-memory technique:

• gomulti_loader — multi-platform Go shellcode loader (Linux + Windows). Wired in via lazyaddons/gomulti_loader_linux.yaml and gomulti_loader_windows.yaml.
• win_shellcode — collection of Windows shellcode templates ready to be linked from a beacon stub.
• ejecutarShellcode — minimal "execute-this-shellcode" loaders for quick PoCs.
• ShellcodeFluctuation_crosscompile — cross-compilable port of the ShellcodeFluctuation memory-encryption trick.
• LazyLoader — generic loader scaffold designed to be extended per engagement.
• OverRide — DLL hijack / DLL search-order-override toolkit for Windows persistence.
• ShadowLink — link-time / symbol-rewrite tooling for Linux ELF stagers.
• netsh_helper_dll — netsh helper-DLL persistence template for Windows.

Defensive bypass / instrumentation

• amsi — AMSI bypass research and PoCs; invoked from LazyOwn payloads when AV/EDR is the limiting factor.

Exploits and CVE PoCs

LazyOwn already vendors several recent kernel-class PoCs through the addon system (lazyaddons/copyfail.yaml, lazyaddons/dirtyfrag.yaml, lazyaddons/CVE-2022-22077.yaml, lazyaddons/CVE_2025_24071_PoC.yaml, lazyaddons/ebird3.yaml). The original repositories are listed here for auditability and citation:

• CVE-2022-22077 — RTCore64.sys arbitrary R/W IOCTL — used by the LazyOwn BYOVD chain.
• copy-fail-CVE-2026-31431 — next-gen Dirty Pipe variant. Backed by the copyfail lazyaddon.
• ebird3 — Early-Bird APC injection + NT Native API loader; produces stealthy in-memory Windows payloads.

Want to add yours? Drop a lazyaddons/<name>.yaml describing repo_url, install_command and execute_command; LazyOwn will pick it up automatically and surface it through the MCP lazyown_palette view.

Abstract

LazyOwn is a framework that streamlines its workflow and automates many tasks and tests through aliases and various tools, functioning like a Swiss army knife with multipurpose blades for hacking xD.

Lazyducky_digispark

Star History

Documentation by readmeneitor.py

Documentation automatically created by the script readmeneitor.py created for this project; maybe one day it will have its own repo, but for now, I don't see it as necessary.

ReadMenator now have a repository

https://github.com/grisuno/ReadMenator

Legal disclaimer:

Usage of LazyOwn RedTeam Framework for attacking targets without prior mutual consent is illegal. It's the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. Only use for educational purposes.

LazyOwn Command Reference

Auto-generated by readmeneitor.py from source docstrings and cli/command_index.json.

Table of Contents

• 01. Reconnaissance (38 commands)
• 02. Scanning & Enumeration (74 commands)
• 03. Exploitation (66 commands)
• 04. Post-Exploitation (45 commands)
• 05. Persistence (33 commands)
• 06. Privilege Escalation (16 commands)
• 07. Credential Access (31 commands)
• 08. Lateral Movement (30 commands)
• 09. Data Exfiltration (35 commands)
• 10. Command & Control (28 commands)
• 11. Reporting (26 commands)
• 12. Miscellaneous (169 commands)
• 13. Diagnostics (2 commands)
• Uncategorized (135 commands)

01. Reconnaissance

alterx

Phase: recon | Source: cli/commands/recon_migrated.py

Executes the 'alterx' command for subdomain enumeration on the provided self.params['domain']. If 'alterx'

apache_users

Phase: recon | Source: cli/commands/recon_migrated.py

Performs enumeration of users from a target system using apache-users.

binarycheck

Phase: recon | Source: cli/commands/recon_migrated.py

Performs various checks on a selected binary to gather information and protections.

cve

Phase: recon | Source: cli/commands/recon_migrated.py

Search for a CVE using the CIRCL API.

dig

Phase: recon | Source: cli/commands/recon.py

Executes the dig command to query DNS information.

dnschef

Phase: recon | Source: cli/commands/recon_migrated.py

Executes the DNSChef tool to monitor DNS queries and intercept responses.

dnsenum

Phase: recon | Source: cli/commands/recon.py

Performs DNS enumeration using dnsenum to identify subdomains for a given domain.

dnsmap

Phase: recon | Source: cli/commands/recon.py

Performs DNS enumeration using dnsmap to discover subdomains for a specified domain.

dnstool_py

Phase: recon | Source: cli/commands/recon_migrated.py

Executes the dnstool.py tool to modify Active Directory-integrated DNS records.

estorides_import

Phase: recon | Source: cli/commands/estorides.py

Import Estorides-discovered entities into LazyOwn database and scope.

estorides_loop

Phase: recon | Source: cli/commands/estorides.py

Run the bidirectional Estorides <-> LazyOwn feedback loop.

estorides_seed

Phase: recon | Source: cli/commands/estorides.py

Feed LazyOwn hosts/domains into Estorides for passive OSINT discovery.

estorides_surface

Phase: recon | Source: cli/commands/estorides.py

Show the combined active + passive attack surface.

finalrecon

Phase: recon | Source: cli/commands/recon.py

Runs the finalrecon tool to perform a web server vulnerability scan against the specified target host.

getcap

Phase: recon | Source: cli/commands/recon_migrated.py

Retrieve and display file capabilities on the system.

gospider

Phase: recon | Source: cli/commands/recon_migrated.py

Try gospider for web spidering.

graudit

Phase: recon | Source: cli/commands/recon_migrated.py

Executes the graudit command to perform a static code analysis with the specified options.

httprobe

Phase: recon | Source: cli/commands/recon_migrated.py

Executes the httprobe tool to probe domains for working HTTP and HTTPS servers.

ipinfo

Phase: recon | Source: cli/commands/recon_migrated.py

Retrieves detailed information about an IP address using the ARIN API.

launchpad

Phase: recon | Source: cli/commands/recon_migrated.py

Searches for packages on Launchpad based on the provided search term and extracts codenames from the results. The distribution is extracted from the search term.

metabigor

Phase: recon | Source: cli/commands/recon_migrated.py

Executes Metabigor commands for OSINT and scanning tasks with guided input or predefined arguments.

openssl_sclient

Phase: recon | Source: cli/commands/recon.py

Uses openssl s_client to connect to a specified host and port, allowing for testing and debugging of SSL/TLS connections.

ping

Phase: recon | Source: cli/commands/recon_migrated.py

Perform a ping to check host availability and infer the operating system based on TTL values.

ports

Phase: recon | Source: cli/commands/recon_migrated.py

Lists all open TCP and UDP ports on the local system.

proxy

Phase: recon | Source: cli/commands/recon_migrated.py

Runs a small proxy server to modify HTTP requests on the fly.

recon

Phase: recon | Source: cli/commands/recon_migrated.py

Performs reconnaissance on a specified self.params['domain'] using crt.sh (the target must be visible on internet), pup, httprobe, and EyeWitness.

serveralive2

Phase: recon | Source: cli/commands/recon_migrated.py

Command serveralive2: Uses Impacket to connect to a remote MSRPC interface and retrieves the server bindings.

sherlock

Phase: recon | Source: cli/commands/recon_migrated.py

Executes the Sherlock tool to find usernames across social networks.

sslscan

Phase: recon | Source: cli/commands/recon_migrated.py

Run an SSL scan on the specified remote host.

surface

Phase: recon | Source: cli/commands/recon_migrated.py

Render the network surface graph in the terminal.

tcpdump_capture

Phase: recon | Source: cli/commands/recon_migrated.py

Starts packet capture using tcpdump on the specified interface.

tcpdump_icmp

Phase: recon | Source: cli/commands/recon_migrated.py

Starts tcpdump to capture ICMP traffic on the specified interface.

trace

Phase: recon | Source: cli/commands/recon_migrated.py

Traces the DNS information for a given self.params['domain'] using the FreeDNS service. (using freedns IP Not your IP)

trufflehog

Phase: recon | Source: cli/commands/recon_migrated.py

Executes trufflehog to search for secrets in a given Git repository URL.

tshark_analyze

Phase: recon | Source: cli/commands/recon_migrated.py

Analyzes a packet capture file using tshark based on the provided remote host IP.

waybackmachine

Phase: recon | Source: cli/commands/recon_migrated.py

Fetch URLs from the Wayback Machine for a given website.

whatweb

Phase: recon | Source: cli/commands/recon.py

Performs a web technology fingerprinting scan using whatweb.

windapsearchscrapeusers

Phase: recon | Source: cli/commands/recon_migrated.py

Extracts usernames from a JSON output generated by go-windapsearch and appends them

02. Scanning & Enumeration

ad_ldap_enum

Phase: enum | Source: cli/commands/scan_migrated.py

Executes ad-ldap-enum to enumerate Active Directory objects (users, groups, computers)

allin

Phase: enum | Source: cli/commands/scan_migrated.py

Execute the AlliN.py tool with various scan modes and parameters.

amass

Phase: enum | Source: cli/commands/scan.py

Executes Amass to perform a passive enumeration on a given domain.

arjun

Phase: enum | Source: cli/commands/scan_migrated.py

Executes an Arjun scan on the specified URL for parameter discovery.

arpscan

Phase: enum | Source: cli/commands/scan.py

Executes an ARP scan using arp-scan.

batchnmap

Phase: enum | Source: cli/commands/recon.py

Runs the internal module modules/lazynmap.sh for multiple Nmap scans.

bbot

Phase: enum | Source: cli/commands/scan.py

Executes a BBOT scan to perform various reconnaissance tasks.

blazy

Phase: enum | Source: cli/commands/scan_migrated.py

Command blazy: Installs and runs blazy for multi-vulnerability web application scanning.

bloodhound

Phase: enum | Source: cli/commands/scan_migrated.py

Perform LDAP enumeration using bloodhound-python with credentials from a file.

breacher

Phase: enum | Source: cli/commands/scan_migrated.py

Command breacher: Installs and runs Breacher for finding admin login pages and EAR vulnerabilities.

certipy

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the Certipy tool to interact with Active Directory Certificate Services.

certipy_ad

Phase: enum | Source: cli/commands/scan_migrated.py

Run certipy-ad against Active Directory Certificate Services.

changeme

Phase: enum | Source: cli/commands/scan_migrated.py

Executes a changeme scan on a specified target URL or host.

cme

Phase: enum | Source: cli/commands/scan_migrated.py

Execute CrackMapExec (CME) for SMB enumeration and authentication attempts against a target.

davtest

Phase: enum | Source: cli/commands/scan_migrated.py

Tests WebDAV server configurations using davtest.

dirsearch

Phase: enum | Source: cli/commands/scan.py

Runs the dirsearch tool to perform directory and file enumeration on a specified URL.

dmitry

Phase: enum | Source: cli/commands/scan.py

This function constructs and executes a command for the 'dmitry' tool.

enum4linux

Phase: enum | Source: cli/commands/enum.py

Performs enumeration of information from a target Linux/Unix system using enum4linux.

enum4linux_ng

Phase: enum | Source: cli/commands/scan_migrated.py

Performs enumeration of information from a target system using enum4linux-ng.

evil_ssdp

Phase: enum | Source: cli/commands/scan_migrated.py

Runs evil-ssdp with various options and user-selected templates.

feroxbuster

Phase: enum | Source: cli/commands/scan.py

Command feroxbuster: Installs and runs Feroxbuster for performing forced browsing and directory brute-forcing.

finger_user_enum

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the finger-user-enum tool for enumerating users on the target host.

fuzz

Phase: enum | Source: cli/commands/scan_migrated.py

Executes a web server fuzzing script with user-provided parameters.

getnpusers

Phase: enum | Source: cli/commands/enum.py

sudo impacket-GetNPUsers mist.htb/ -no-pass -usersfile sessions/users.txt

gobuster

Phase: enum | Source: cli/commands/scan.py

Uses gobuster for directory and virtual host fuzzing based on provided parameters. Supports directory enumeration and virtual host discovery.

hostdiscover

Phase: enum | Source: cli/commands/scan.py

Discover active hosts in a subnet by performing a ping sweep.

hound

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the hound tool for Hound is a simple and light tool for information gathering and capture exact GPS coordinates

kerbrute

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the Kerbrute tool to enumerate user accounts against a specified target self.params['domain'] controller.

lazynmap

Phase: enum | Source: cli/commands/recon.py

Runs the internal module modules/lazynmap.sh with target mode.

ldapdomaindump

Phase: enum | Source: cli/commands/scan_migrated.py

Dumps LDAP information using ldapdomaindump with credentials from a file.

ldapsearch

Phase: enum | Source: cli/commands/scan_migrated.py

Executes an LDAP search against a target remote host (self.params['rhost']) and saves the results.

lookupsid

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the Impacket lookupsid tool to enumerate SIDs on a target system.

lookupsid_py

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the LookupSID tool to perform SID enumeration on a target system.

loxs

Phase: enum | Source: cli/commands/scan_migrated.py

Command loxs: Installs and runs Loxs for multi-vulnerability web application scanning.

lynis

Phase: enum | Source: cli/commands/scan_migrated.py

Performs a Lynis audit on the specified remote system.

magicrecon

Phase: enum | Source: cli/commands/scan.py

Command magicrecon: Automates the setup and usage of MagicRecon to perform various types of reconnaissance and vulnerability scanning on specified targets.

mqtt_check_py

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the MQTT check tool to verify credentials on a target system with optional SSL.

nbtscan

Phase: enum | Source: cli/commands/recon.py

Performs network scanning using nbtscan to discover NetBIOS names and addresses in a specified range.

net_rpc_addmem

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the net rpc group addmem command to add a user to a specified group in Active Directory.

netexec

Phase: enum | Source: cli/commands/scan_migrated.py

Executes netexec with various options for network protocol operations.

netview

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the Impacket netview tool to list network shares on a specified target.

nikto

Phase: enum | Source: cli/commands/recon.py

Runs the nikto tool to perform a web server vulnerability scan against the specified target host.

nmapscript

Phase: enum | Source: cli/commands/scan.py

Perform an Nmap scan using a specified script and port.

nuclei

Phase: enum | Source: cli/commands/scan.py

Executes a Nuclei scan on a specified target URL or host.

odat

Phase: enum | Source: cli/commands/scan_migrated.py

Command odat: Runs the ODAT sidguesser module to guess Oracle SIDs on a target Oracle database.

openredirex

Phase: enum | Source: cli/commands/scan_migrated.py

Command openredirex: Clones, installs, and runs OpenRedirex for testing open redirection vulnerabilities.

osmedeus

Phase: enum | Source: cli/commands/scan.py

Executes Osmedeus scans with guided input for various scanning scenarios.

parsero

Phase: enum | Source: cli/commands/scan_migrated.py

Executes a parsero scan on a specified target URL or host.

parth

Phase: enum | Source: cli/commands/scan_migrated.py

Command parth: Installs and runs Parth for discovering vulnerable URLs and parameters.

portdiscover

Phase: enum | Source: cli/commands/scan.py

Scan all ports on a specified host to identify open ports.

portservicediscover

Phase: enum | Source: cli/commands/scan.py

Scan all ports on a specified host to identify open ports and associated services.

pre2k

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the pre2k tool to query the self.params['domain'] for pre-Windows 2000 machine accounts or to pass a list of hostnames to test authentication.

pykerbrute

Phase: enum | Source: cli/commands/scan_migrated.py

Command pykerbrute: Automates the installation and execution of PyKerbrute for bruteforcing Active Directory accounts using Kerberos pre-authentication.

rdp_check_py

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the RDP check tool to verify credentials or hash-based authentication on a target system.

rpcclient

Phase: enum | Source: cli/commands/enum.py

Executes the rpcclient command to interact with a remote Windows system over RPC (Remote Procedure Call) using anonymous credentials.

rpcdump

Phase: enum | Source: cli/commands/enum.py

Executes the rpcdump.py script to dump RPC services from a target host.

rpcmap_py

Phase: enum | Source: cli/commands/scan_migrated.py

Command rpcmap_py: Executes rpcmap.py commands to enumerate MSRPC interfaces.

samrdump

Phase: enum | Source: cli/commands/scan_migrated.py

Run impacket-samrdump to dump SAM data from specified ports.

sawks

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the Swaks (Swiss Army Knife for SMTP) tool to send test emails for phishing simulations.

sessionssh

Phase: enum | Source: cli/commands/scan_migrated.py

Execute a command to list active SSH connections.

skipfish

Phase: enum | Source: cli/commands/scan.py

This function executes the web security scanning tool Skipfish

smbattack

Phase: enum | Source: cli/commands/scan_migrated.py

Scans for hosts with SMB service open on port 445 in the specified target network.

smbclient

Phase: enum | Source: cli/commands/enum.py

Interacts with SMB shares using the smbclient command to perform the following operations:

smbclient_impacket

Phase: enum | Source: cli/commands/enum.py

Interacts with SMB shares using the smbclient command to perform the following operations:

smbclient_py

Phase: enum | Source: cli/commands/enum.py

Interacts with SMB shares using the smbclient.py command to perform the following operations:

smbmap

Phase: enum | Source: cli/commands/enum.py

smbmap -H 10.10.10.3 [OPTIONS]

smtpuserenum

Phase: enum | Source: cli/commands/scan_migrated.py

Enumerates SMTP users using the smtp-user-enum tool with the VRFY method.

snmpcheck

Phase: enum | Source: cli/commands/scan_migrated.py

Performs an SNMP check on the specified target host.

snmpwalk

Phase: enum | Source: cli/commands/scan_migrated.py

Performs an SNMP check on the specified target host.

swaks

Phase: enum | Source: cli/commands/scan_migrated.py