mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-08-19 07:57:15 +02:00
v3.5.5 — cloud infrastructure testing + REPL polish
Cloud testing: - +17 cloud agents (agents_md/infra/) for AWS/GCP/Azure: IAM/RBAC privesc, storage exposure (S3/GCS/Blob), compute & network exposure + IMDS, secrets (Secrets Manager / Secret Manager / Key Vault), SA/SP key abuse, Entra ID enum, and a multi-cloud footprint/identity recon agent. Library 348 -> 365. - creds.yaml gains aws:/gcp:/azure: blocks (Creds::cloud). The harness exports provider env vars (AWS_*, GOOGLE_APPLICATION_CREDENTIALS, AZURE_* SP) so aws/gcloud/az authenticate automatically, and injects a cloud directive. GCP inline JSON is written to a temp file. Best-practice auth per provider. REPL polish: - /chain <n> (attack-chain depth, wired to Session.chain_depth), /agents list (library category counts incl. infra/cloud); /show now shows chain-depth and enabled integrations. Tab-completion + help updated. Docs: README badges (365 agents / 14 providers), new "Cloud credentials" section; RELEASE notes. Version 3.5.4 -> 3.5.5.
This commit is contained in:
CyberSecurityUP
@@ -1,4 +1,4 @@
|
||||
//! POMDP belief-state world model (v3.5.4).
|
||||
//! POMDP belief-state world model (v3.5.5).
|
||||
//!
|
||||
//! The target is only partially observable, so we don't track booleans — we
|
||||
//! track a **belief**: a property graph whose nodes (host / service / vuln /
|
||||
|
||||
@@ -51,6 +51,35 @@ pub struct Win {
|
||||
pub hash: String, // NTLM hash for pass-the-hash (LM:NT or NT)
|
||||
}
|
||||
|
||||
/// Cloud provider credentials for cloud-infra testing (AWS / GCP / Azure).
|
||||
/// Secrets are read from `creds.yaml` and exported to the process environment so
|
||||
/// the `aws` / `gcloud` / `az` CLIs the agents use pick them up automatically.
|
||||
#[derive(Default, Debug, Clone)]
|
||||
pub struct Cloud {
|
||||
// AWS — static keys (access key + secret [+ session token]) OR a named profile.
|
||||
pub aws_access_key_id: String,
|
||||
pub aws_secret_access_key: String,
|
||||
pub aws_session_token: String,
|
||||
pub aws_region: String,
|
||||
pub aws_profile: String,
|
||||
// GCP — a service-account JSON (path, recommended) or inline single-line JSON.
|
||||
pub gcp_sa_json: String,
|
||||
pub gcp_project: String,
|
||||
// Azure — a service principal (recommended for non-interactive automation).
|
||||
pub azure_tenant_id: String,
|
||||
pub azure_client_id: String,
|
||||
pub azure_client_secret: String,
|
||||
pub azure_subscription_id: String,
|
||||
}
|
||||
|
||||
impl Cloud {
|
||||
fn is_empty(&self) -> bool {
|
||||
self.aws_access_key_id.is_empty() && self.aws_profile.is_empty()
|
||||
&& self.gcp_sa_json.is_empty()
|
||||
&& self.azure_client_id.is_empty()
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Default, Debug, Clone)]
|
||||
pub struct Creds {
|
||||
pub jwt: Option<String>,
|
||||
@@ -59,6 +88,7 @@ pub struct Creds {
|
||||
pub login: Option<Login>,
|
||||
pub ssh: Option<Ssh>,
|
||||
pub win: Option<Win>,
|
||||
pub cloud: Option<Cloud>,
|
||||
}
|
||||
|
||||
impl Creds {
|
||||
@@ -68,8 +98,9 @@ impl Creds {
|
||||
let mut login = Login { method: "POST".into(), ..Default::default() };
|
||||
let mut ssh = Ssh { port: "22".into(), ..Default::default() };
|
||||
let mut win = Win::default();
|
||||
let mut cloud = Cloud::default();
|
||||
let (mut have_login, mut have_ssh, mut have_win) = (false, false, false);
|
||||
let mut block = ""; // "", "login", "ssh", "windows"
|
||||
let mut block = ""; // "", "login", "ssh", "windows", "aws", "gcp", "azure"
|
||||
for raw in text.lines() {
|
||||
let line = raw.split('#').next().unwrap_or("");
|
||||
if line.trim().is_empty() {
|
||||
@@ -86,6 +117,9 @@ impl Creds {
|
||||
"login" => { have_login = true; "login" }
|
||||
"ssh" => { have_ssh = true; "ssh" }
|
||||
"windows" | "win" | "ad" => { have_win = true; "windows" }
|
||||
"aws" => "aws",
|
||||
"gcp" | "google" | "gcloud" => "gcp",
|
||||
"azure" | "az" => "azure",
|
||||
_ => "",
|
||||
};
|
||||
continue;
|
||||
@@ -118,6 +152,26 @@ impl Creds {
|
||||
"hash" | "ntlm" => win.hash = v,
|
||||
_ => {}
|
||||
},
|
||||
"aws" => match k.as_str() {
|
||||
"access_key_id" | "access_key" | "key" => cloud.aws_access_key_id = v,
|
||||
"secret_access_key" | "secret" => cloud.aws_secret_access_key = v,
|
||||
"session_token" | "token" => cloud.aws_session_token = v,
|
||||
"region" => cloud.aws_region = v,
|
||||
"profile" => cloud.aws_profile = v,
|
||||
_ => {}
|
||||
},
|
||||
"gcp" => match k.as_str() {
|
||||
"service_account_json" | "sa_json" | "key" | "keyfile" | "credentials" => cloud.gcp_sa_json = v,
|
||||
"project" | "project_id" => cloud.gcp_project = v,
|
||||
_ => {}
|
||||
},
|
||||
"azure" => match k.as_str() {
|
||||
"tenant_id" | "tenant" => cloud.azure_tenant_id = v,
|
||||
"client_id" | "app_id" => cloud.azure_client_id = v,
|
||||
"client_secret" | "secret" | "password" => cloud.azure_client_secret = v,
|
||||
"subscription_id" | "subscription" => cloud.azure_subscription_id = v,
|
||||
_ => {}
|
||||
},
|
||||
_ => {}
|
||||
}
|
||||
continue;
|
||||
@@ -133,13 +187,81 @@ impl Creds {
|
||||
if have_login && !login.url.is_empty() { c.login = Some(login); }
|
||||
if have_ssh && !ssh.host.is_empty() { c.ssh = Some(ssh); }
|
||||
if have_win && !win.host.is_empty() { c.win = Some(win); }
|
||||
if !cloud.is_empty() { c.cloud = Some(cloud); }
|
||||
if c.jwt.is_none() && c.header.is_none() && c.cookie.is_none()
|
||||
&& c.login.is_none() && c.ssh.is_none() && c.win.is_none() {
|
||||
&& c.login.is_none() && c.ssh.is_none() && c.win.is_none() && c.cloud.is_none() {
|
||||
return None;
|
||||
}
|
||||
Some(c)
|
||||
}
|
||||
|
||||
/// Environment variables to export so the `aws`/`gcloud`/`az` CLIs the agents
|
||||
/// run pick up the cloud credentials automatically. For inline GCP JSON the
|
||||
/// content is written to a temp file and that path is returned.
|
||||
pub fn cloud_env(&self) -> Vec<(String, String)> {
|
||||
let mut e: Vec<(String, String)> = Vec::new();
|
||||
let Some(c) = &self.cloud else { return e };
|
||||
// AWS
|
||||
if !c.aws_access_key_id.is_empty() {
|
||||
e.push(("AWS_ACCESS_KEY_ID".into(), c.aws_access_key_id.clone()));
|
||||
e.push(("AWS_SECRET_ACCESS_KEY".into(), c.aws_secret_access_key.clone()));
|
||||
if !c.aws_session_token.is_empty() {
|
||||
e.push(("AWS_SESSION_TOKEN".into(), c.aws_session_token.clone()));
|
||||
}
|
||||
}
|
||||
if !c.aws_profile.is_empty() { e.push(("AWS_PROFILE".into(), c.aws_profile.clone())); }
|
||||
if !c.aws_region.is_empty() {
|
||||
e.push(("AWS_DEFAULT_REGION".into(), c.aws_region.clone()));
|
||||
e.push(("AWS_REGION".into(), c.aws_region.clone()));
|
||||
}
|
||||
// GCP — path (recommended) or inline JSON written to a temp file.
|
||||
if !c.gcp_sa_json.is_empty() {
|
||||
let path = if c.gcp_sa_json.trim_start().starts_with('{') {
|
||||
let p = std::env::temp_dir().join("neurosploit-gcp-sa.json");
|
||||
let _ = std::fs::write(&p, c.gcp_sa_json.as_bytes());
|
||||
p.display().to_string()
|
||||
} else {
|
||||
c.gcp_sa_json.clone()
|
||||
};
|
||||
e.push(("GOOGLE_APPLICATION_CREDENTIALS".into(), path));
|
||||
}
|
||||
if !c.gcp_project.is_empty() {
|
||||
e.push(("GOOGLE_CLOUD_PROJECT".into(), c.gcp_project.clone()));
|
||||
e.push(("CLOUDSDK_CORE_PROJECT".into(), c.gcp_project.clone()));
|
||||
}
|
||||
// Azure — service principal env (consumed by `az login --service-principal`).
|
||||
if !c.azure_tenant_id.is_empty() { e.push(("AZURE_TENANT_ID".into(), c.azure_tenant_id.clone())); }
|
||||
if !c.azure_client_id.is_empty() { e.push(("AZURE_CLIENT_ID".into(), c.azure_client_id.clone())); }
|
||||
if !c.azure_client_secret.is_empty() { e.push(("AZURE_CLIENT_SECRET".into(), c.azure_client_secret.clone())); }
|
||||
if !c.azure_subscription_id.is_empty() {
|
||||
e.push(("AZURE_SUBSCRIPTION_ID".into(), c.azure_subscription_id.clone()));
|
||||
e.push(("ARM_SUBSCRIPTION_ID".into(), c.azure_subscription_id.clone()));
|
||||
}
|
||||
e
|
||||
}
|
||||
|
||||
/// A directive telling the agents which cloud creds are available and how to
|
||||
/// authenticate the provider CLI, so they enumerate/test the cloud account.
|
||||
pub fn cloud_instruction(&self) -> Option<String> {
|
||||
let c = self.cloud.as_ref()?;
|
||||
let mut s = String::new();
|
||||
if !c.aws_access_key_id.is_empty() || !c.aws_profile.is_empty() {
|
||||
s.push_str(&format!(
|
||||
"AWS ACCESS: credentials are set in the environment{}. Use the `aws` CLI to enumerate and test the account — start with `aws sts get-caller-identity`, then IAM (users/roles/policies, privilege escalation paths), S3 (public/misconfigured buckets), EC2/SG, Lambda, Secrets Manager. Read-only enumeration first; never destructive.\n",
|
||||
if c.aws_region.is_empty() { String::new() } else { format!(" (region {})", c.aws_region) }));
|
||||
}
|
||||
if !c.gcp_sa_json.is_empty() {
|
||||
s.push_str(&format!(
|
||||
"GCP ACCESS: a service account is available via $GOOGLE_APPLICATION_CREDENTIALS{}. Run `gcloud auth activate-service-account --key-file=$GOOGLE_APPLICATION_CREDENTIALS` first, then enumerate with `gcloud`/`gsutil` — IAM bindings & privilege escalation, buckets, compute, service accounts/keys, Cloud Functions.\n",
|
||||
if c.gcp_project.is_empty() { String::new() } else { format!(" (project {})", c.gcp_project) }));
|
||||
}
|
||||
if !c.azure_client_id.is_empty() {
|
||||
s.push_str(
|
||||
"AZURE ACCESS: a service principal is set in the environment. Authenticate with `az login --service-principal -u $AZURE_CLIENT_ID -p $AZURE_CLIENT_SECRET --tenant $AZURE_TENANT_ID`, then enumerate with `az` — role assignments (RBAC) & escalation, storage accounts/containers, VMs, Key Vaults, managed identities.\n");
|
||||
}
|
||||
if s.is_empty() { None } else { Some(s) }
|
||||
}
|
||||
|
||||
/// A directive describing the host credentials available to the agents, so
|
||||
/// they can authenticate to Linux (SSH) / Windows (AD) hosts.
|
||||
pub fn host_instruction(&self) -> Option<String> {
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
//! Verification / grounding engine (v3.5.4).
|
||||
//! Verification / grounding engine (v3.5.5).
|
||||
//!
|
||||
//! Hard rule: **no claim enters the world model without a tool receipt** — raw
|
||||
//! tool output, not the LLM's paraphrase. This is the empirical anti-hallucination
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
//! NeuroSploit v3.5.4 harness — a robust multi-model runtime for the
|
||||
//! NeuroSploit v3.5.5 harness — a robust multi-model runtime for the
|
||||
//! markdown-driven autonomous pentest engine.
|
||||
//!
|
||||
//! The harness loads the `agents_md/` library, drives a *pool* of LLM models
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
//! POMDP decision layer (v3.5.4): value-of-information planning + the
|
||||
//! POMDP decision layer (v3.5.5): value-of-information planning + the
|
||||
//! anti-hallucination gate.
|
||||
//!
|
||||
//! The choice "scan more vs exploit now" is **not** a heuristic here — it falls
|
||||
|
||||
@@ -97,9 +97,9 @@ pub fn html(target: &str, findings: &[Finding]) -> String {
|
||||
h4{{margin:12px 0 3px;font-size:12px;text-transform:uppercase;letter-spacing:.5px;color:#8b5cf6}}\
|
||||
.b{{color:#8b5cf6;font-weight:800}}</style></head><body>\
|
||||
<h1><span class=b>NeuroSploit</span> Penetration Test Report</h1>\
|
||||
<div class=meta>Target: <b>{t}</b> · v3.5.4 Rust harness · multi-model validated</div>\
|
||||
<div class=meta>Target: <b>{t}</b> · v3.5.5 Rust harness · multi-model validated</div>\
|
||||
<div>{chips}</div>{graph_block}<h2>Findings ({n})</h2>{body}\
|
||||
<p class=meta>Authorized testing only. Findings confirmed by multi-model adversarial voting.<br>NeuroSploit v3.5.4 · by <b>Joas A Santos</b> & <b>Red Team Leaders</b></p></body></html>",
|
||||
<p class=meta>Authorized testing only. Findings confirmed by multi-model adversarial voting.<br>NeuroSploit v3.5.5 · by <b>Joas A Santos</b> & <b>Red Team Leaders</b></p></body></html>",
|
||||
t = esc(target), chips = chips, n = sorted.len(), body = body, graph_block = graph_block,
|
||||
)
|
||||
}
|
||||
@@ -135,7 +135,7 @@ pub fn typst_report(target: &str, findings: &[Finding], dir: &Path) -> std::io::
|
||||
let mut data = String::new();
|
||||
data.push_str(&format!(
|
||||
"#let meta = (target: {}, run_id: {}, generated: {}, model: {})\n",
|
||||
tq(target), tq(&run_id), tq("NeuroSploit v3.5.4"), tq("multi-model")
|
||||
tq(target), tq(&run_id), tq("NeuroSploit v3.5.5"), tq("multi-model")
|
||||
));
|
||||
data.push_str("#let findings = (\n");
|
||||
for f in sorted_findings(findings) {
|
||||
|
||||
Reference in New Issue
Block a user