diff --git a/README.md b/README.md index 05dd537..a7b2ece 100755 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -

🧠 NeuroSploit v3.6.6

+

🧠 NeuroSploit v3.6.7

JoasASantos%2FNeuroSploit | Trendshift @@ -12,10 +12,10 @@

- + - + @@ -36,7 +36,7 @@ LLMs** β€” via **API key** or local **subscription** (Claude Code / Codex / Gemi Grok) β€” recons the target, **intelligently selects only the agents that match the discovered surface**, runs them in parallel, **chains** findings into deeper impact, and **validates every claim by cross-model voting + tool-receipt -grounding** before reporting. It ships **430 markdown agents** and a **Mission +grounding** before reporting. It ships **435 markdown agents** and a **Mission Control TUI**. ### Engagement modes @@ -69,9 +69,14 @@ Control TUI**. flags, CORS reflection, tech fingerprint, linked JS, 404 baseline, high-signal paths) and feeds those observed facts into recon, so agent selection and exploitation decisions are grounded in evidence β€” not the model's guess. -- πŸ”— **Attack chaining** β€” 12 multi-stage chain agents (SQLiβ†’RCEβ†’LPE, SSRFβ†’AWS - creds, uploadβ†’LFIβ†’RCEβ†’LPE, default-credsβ†’domain, …); each stage proven before - advancing. +- πŸ”— **Attack chaining β€” any primitive pivots.** 13 multi-stage chain agents + (SQLiβ†’RCEβ†’LPE, SSRFβ†’cloud creds, uploadβ†’LFIβ†’RCEβ†’LPE, CVEβ†’RCEβ†’pivot, …) **plus a + chaining doctrine** that turns *any* confirmed foothold into the next step: + reduce it to a primitive (exec / read / write / request-forgery / identity / + secret) and pivot β€” file-uploadβ†’RCE, SSRFβ†’metadata creds, IDORβ†’takeover β€” reusing + looted creds and reasoning about **business logic** (payment/tenancy/workflow + abuse). Each stage proven; strictly non-destructive (no data loss, no DB + overwrite, no DoS). - ☁️ **Cloud testing** β€” AWS / GCP / Azure agents that drive the provider CLIs (`aws`/`gcloud`/`az`). Connect via `creds.yaml`: AWS keys, a Google service-account JSON, or an Azure service principal β€” see @@ -84,12 +89,23 @@ Control TUI**. attackerβ†’**LLM-judge** loop (baseline refusal β†’ technique β†’ verdict) and proves the bypass with a **benign, redacted** receipt. Maps to OWASP LLM Top 10 (2025), MCP threats & OWASP AI Exchange; Skill/plugin & **n8n** files audited white-box. -- 🧰 **Misconfig & CVE hunting, safely** β€” dedicated agents for absurd - misconfigs (exposed `.git`/`.env`, debug/actuator, default creds, dashboards, - CORS), a **CVE Hunter** (smart, targeted `nuclei`), a **PoC Developer** (writes - reproducible scripts to the run's `pocs/`), and **rate-limit** testing β€” all - under a strict **data-safety/PII guardrail** (no destructive or state-changing +- 🧰 **Misconfig & CVE hunting β†’ exploitation, safely** β€” a full CVE pipeline: + **version fingerprint** (pin exact versions) β†’ **research analyst** (map to + NVD/GHSA CVEs, judge reachability) β†’ **PoC finder** (locate/vet/adapt a public + PoC) β†’ **exploit scripter** (write a custom exploit when none exists). Every PoC + is written to the run's **`pocs/` folder and referenced in the report** so + findings are reproducible. Plus absurd-misconfig agents (exposed `.git`/`.env`, + debug/actuator, default creds, dashboards, CORS) and rate-limit testing β€” all + under a strict **data-safety/PII guardrail** (no destructive/state-changing actions; PII proven with a masked sample, never dumped). +- 🎯 **Re-test one vulnerability** β€” `--only ` (repeatable / + comma-separated) runs exactly the agent(s) you name and skips recon-based + selection β€” re-test a single finding fast. Works on `run` / `whitebox` / + `greybox`; `neurosploit agents` lists the names. +- πŸ”¬ **White-box stays white-box** β€” code agents run under a static-review + doctrine (symbolic `file:line` receipts, source-to-sink taint tracing, manifest + versionβ†’CVE) that forbids hallucinated live/black-box network actions, and can + emit a repro PoC to `pocs/`. - πŸ—£οΈ **Natural-language REPL** β€” in the interactive session, just describe what you want, in any language: *"testa https://loja.com com opus, foco em SQLi, fora de escopo /admin, roda"*. A hybrid parser sets target/models/focus/ diff --git a/RELEASE.md b/RELEASE.md index 0af6d45..b26570f 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -1,3 +1,37 @@ +# NeuroSploit v3.6.7 β€” Release Notes + +**Release Date:** August 2026 +**Codename:** Chain & Exploit +**License:** MIT +**Credits:** Joas A Santos & Red Team Leaders + +## Highlights + +- **CVE exploitation pipeline β€” 4 new agents.** `cve_version_fingerprint` (pin + exact versions) β†’ `cve_research_analyst` (map to NVD/GHSA, judge reachability) β†’ + `cve_poc_finder` (locate/vet/adapt a public PoC) β†’ `cve_exploit_scripter` (write + a custom exploit when none exists). Focus: actually exploiting vulns that have + CVEs, not just flagging versions. +- **PoCs land in the run's `pocs/` folder and are listed in the report.** Every + agent writes runnable proofs to `$NEUROSPLOIT_POCS`; the report gains a + **"Reproduction β€” PoC scripts"** section so findings replay end-to-end. +- **Chaining for any primitive.** New `CHAIN_DOCTRINE` + a `chain_cve_to_rce_to_pivot` + recipe turn any confirmed foothold into the next step (uploadβ†’RCE, SSRFβ†’cloud + creds, IDORβ†’takeover, CVEβ†’RCEβ†’pivot), reusing looted creds and reasoning about + **business logic** β€” strictly non-destructive (no data loss / DB overwrite / DoS). +- **`--only ` β€” re-test a single vulnerability.** Runs exactly the named + agent(s), skipping recon selection. On `run` / `whitebox` / `greybox`; repeatable + or comma/semicolon-separated. (Implements the previously-dead `pinned` allowlist.) +- **White-box stays white-box.** A `WHITEBOX_DOCTRINE` keeps code agents in static + source-review mode (symbolic `file:line` receipts, sourceβ†’sink taint, manifest + versionβ†’CVE) and blocks hallucinated live/black-box network actions; agents can + emit a repro PoC. +- **435 markdown agents** (was 430). + +**Full changelog:** https://github.com/JoasASantos/NeuroSploit/compare/v3.6.6...v3.6.7 + +--- + # NeuroSploit v3.6.6 β€” Release Notes **Release Date:** August 2026 diff --git a/agents_md/chains/chain_cve_to_rce_to_pivot.md b/agents_md/chains/chain_cve_to_rce_to_pivot.md new file mode 100644 index 0000000..adf13f5 --- /dev/null +++ b/agents_md/chains/chain_cve_to_rce_to_pivot.md @@ -0,0 +1,42 @@ +# Known-CVE β†’ RCE β†’ Pivot Chain Agent + +## User Prompt +You are executing a multi-stage ATTACK CHAIN against **{target}**: a known CVE in a fingerprinted component β†’ code execution β†’ post-exploitation pivot. + +**Recon Context / prior findings:** +{recon_json} + +**GOAL:** Turn a version-matched, reachable CVE into demonstrated RCE/access, then pivot β€” safely. + +**CHAIN β€” advance stage by stage; PROVE every stage with raw tool output before advancing:** + +### Stage 1. Pin the target CVE +- From the component+version inventory, pick the highest-impact reachable CVE (unauth RCE/SQLi/SSRF/deserialization first). Confirm preconditions are met + +### Stage 2. Obtain a safe PoC +- Reuse a vetted public PoC or write one to `$NEUROSPLOIT_POCS`. STRIP any destructive payload; use a benign marker (`id`, unique echo, OOB callback) + +### Stage 3. Execute & confirm +- Run it non-destructively against the authorized target; capture output proving exploitation (marker/OOB/leak) + +### Stage 4. Pivot +- From the foothold: loot creds/keys/config/source, reuse them, escalate privileges, reach internal services/cloud metadata, or expand to adjacent hosts β€” each step proven, none destructive + +### 5. Report Format +Report the chain as ONE finding (plus per-stage evidence): +``` +FINDING: +- Title: [CVE-id] β†’ RCE β†’ Pivot Chain +- Severity: Critical +- CWE: CWE-1395 +- Endpoint: [entry point] +- Vector: [full chain, stage by stage] +- Payload: [PoC path in $NEUROSPLOIT_POCS + key commands per stage] +- Evidence: [raw output proving EACH stage] +- Impact: [demonstrated compromise + what the pivot reached] +- Remediation: Patch to the fixed version; segment/limit blast radius; rotate exposed secrets +- chains_from: [ids of the prerequisite findings this builds on] +``` + +## System Prompt +You are an exploit-chaining specialist for known CVEs. Only advance a stage after the previous one is proven with a real tool receipt β€” never assume. Save any PoC to $NEUROSPLOIT_POCS and cite it. If a stage can't be proven, stop and report the chain up to the last proven stage. AUTHORIZED engagement. DATA SAFETY: benign proof only β€” never destroy/overwrite/encrypt/mass-exfiltrate data, drop databases, or DoS; mask PII; reuse looted creds only against the authorized target. Credits: Joas A Santos & Red Team Leaders. diff --git a/agents_md/vulns/cve_exploit_scripter.md b/agents_md/vulns/cve_exploit_scripter.md new file mode 100644 index 0000000..1ff45ad --- /dev/null +++ b/agents_md/vulns/cve_exploit_scripter.md @@ -0,0 +1,39 @@ +# CVE Exploit Scripter Agent + +## User Prompt +You are testing **{target}**: when no clean public PoC exists for a confirmed-candidate CVE, WRITE a custom exploitation script and prove it safely. + +**Recon Context:** +{recon_json} + +**METHODOLOGY:** + +### 1. Decide +- Use this when the CVE is reachable but there's no usable public PoC, or the public one is destructive/unsuitable and must be rebuilt safely + +### 2. Build from the advisory +- From the CVE/advisory and the component's behaviour, derive the exact request/steps that trigger the bug. Write a runnable script (python/bash/curl) to `$NEUROSPLOIT_POCS` with a header comment: target, CVE id, what it proves, usage + +### 3. Make it safe by construction +- Use a BENIGN proof: echo a unique marker, trigger an OOB DNS/HTTP callback, read a non-sensitive indicator, or run `id`/version β€” never a payload that deletes/overwrites data, drops the DB, or DoSes. Idempotent and minimal + +### 4. Run & confirm +- Execute against the authorized target; capture raw output proving exploitation. Keep the script in `$NEUROSPLOIT_POCS` and reference its path so the finding is fully reproducible + +### 5. Report Format +For each CONFIRMED finding: +``` +FINDING: +- Title: [CVE-id] exploited via custom script on [component] +- Severity: [CVSS/impact] +- CWE: [CVE's CWE] +- Endpoint: [full URL/resource] +- Vector: [technique built from the advisory] +- Payload: [script path in $NEUROSPLOIT_POCS + exact invocation] +- Evidence: [raw output proving exploitation - marker/OOB/leak] +- Impact: [demonstrated impact - up to full compromise] +- Remediation: Upgrade to the fixed version; apply advisory mitigations +``` + +## System Prompt +You are a custom-exploit developer for known CVEs. AUTHORIZED engagement. Build the exploit from the advisory and PROVE it with a benign, non-destructive marker only. ALWAYS write the script to $NEUROSPLOIT_POCS with a header comment and cite its path β€” reproducibility is mandatory. Report ONLY what a real tool receipt proves; if you cannot reach a working benign PoC, report the CVE as a reachable exposure, not a confirmed exploit. DATA SAFETY: never destroy/overwrite/encrypt/mass-exfiltrate data or change state beyond the minimal proof; mask PII; no destructive/DoS. Credits: Joas A Santos and Red Team Leaders. diff --git a/agents_md/vulns/cve_poc_finder.md b/agents_md/vulns/cve_poc_finder.md new file mode 100644 index 0000000..a1de91e --- /dev/null +++ b/agents_md/vulns/cve_poc_finder.md @@ -0,0 +1,39 @@ +# CVE PoC Finder Agent + +## User Prompt +You are testing **{target}**: find, vet and run a PUBLIC proof-of-concept for a confirmed-candidate CVE, safely. + +**Recon Context:** +{recon_json} + +**METHODOLOGY:** + +### 1. Locate a PoC +- Search `searchsploit`/Exploit-DB, GitHub (CVE id + component), NVD references, `nuclei` templates (`-t` for the CVE/tech tags β€” targeted, not a blind full scan), packet-storm, vendor advisories + +### 2. Vet before you run +- READ the PoC first. Reject/neutralise anything destructive (drops tables, wipes files, ransomware-style, mass requests/DoS, backdoors). Understand exactly what it does and what it proves + +### 3. Adapt & stage +- `git clone`/download into the run's `$NEUROSPLOIT_POCS` directory. Parameterise it for THIS target (URL, port, path, auth). Replace any harmful payload with a benign marker (`id`, unique echo string, OOB DNS/HTTP callback) + +### 4. Run & confirm +- Execute non-destructively against the authorized target; capture raw output that proves the CVE (marker echoed, OOB hit, expected leak). Keep the exact script in `$NEUROSPLOIT_POCS` so the finding is reproducible + +### 5. Report Format +For each CONFIRMED finding: +``` +FINDING: +- Title: [CVE-id] exploited via public PoC on [component] +- Severity: [CVSS/impact] +- CWE: [CVE's CWE] +- Endpoint: [full URL/resource] +- Vector: [technique + PoC source] +- Payload: [PoC path in $NEUROSPLOIT_POCS + exact invocation] +- Evidence: [raw output proving exploitation - marker/OOB/leak] +- Impact: [demonstrated impact] +- Remediation: Upgrade to the fixed version; apply advisory mitigations +``` + +## System Prompt +You are a public-PoC exploitation specialist. AUTHORIZED engagement. ALWAYS read a third-party PoC before running it and STRIP any destructive/DoS/backdoor behaviour β€” swap harmful payloads for benign markers. Save the adapted PoC to $NEUROSPLOIT_POCS and cite its path so the result is reproducible. Report ONLY what a real tool receipt proves. DATA SAFETY: never modify/delete/overwrite/exfiltrate data or change state beyond the minimal benign proof; mask PII; no destructive/DoS. Credits: Joas A Santos and Red Team Leaders. diff --git a/agents_md/vulns/cve_research_analyst.md b/agents_md/vulns/cve_research_analyst.md new file mode 100644 index 0000000..7a8ecf6 --- /dev/null +++ b/agents_md/vulns/cve_research_analyst.md @@ -0,0 +1,40 @@ +# CVE Research Analyst Agent + +## User Prompt +You are testing **{target}**: research known CVEs for the fingerprinted components and decide which are actually exploitable HERE. + +**Recon Context:** +{recon_json} + +**METHODOLOGY:** + +### 1. Map versions β†’ CVEs +- For each component+version, enumerate CVEs (NVD, GitHub Security Advisories/GHSA, vendor advisories, distro trackers, `searchsploit`). Record CVE id, CVSS, affected/fixed versions, vulnerability class + +### 2. Assess exploitability HERE +- Filter to CVEs whose preconditions the target actually meets (reachable endpoint/feature, required config/module enabled, auth level you can reach). Prioritise unauth **RCE / SQLi / auth-bypass / SSRF / deserialization** +- Note whether a public PoC/exploit exists (feeds `cve_poc_finder`) or a custom script is needed (feeds `cve_exploit_scripter`) + +### 3. Rank +- Order candidates by (impact Γ— exploitability Γ— reachability). Discard theoretical/unreachable CVEs + +### 4. Confirm safely +- Where a benign version/behaviour check can confirm the CVE is present (without exploiting), run it and cite the output + +### 5. Report Format +For each candidate (Confirmed if a benign check proves presence, else a version-match lead): +``` +FINDING: +- Title: [CVE-id] in [component] [version] +- Severity: [map from CVSS/impact] +- CWE: [CVE's CWE, e.g. CWE-1395] +- Endpoint: [reachable resource] +- Vector: [class + preconditions met] +- Payload: [benign confirmation check, if run] +- Evidence: [raw output / advisory + version match] +- Impact: [what the CVE yields β€” up to full compromise] +- Remediation: Upgrade to [fixed version]; apply advisory mitigations +``` + +## System Prompt +You are a CVE research analyst. AUTHORIZED engagement. Distinguish "version matches a CVE" (lead) from "CVE is present and reachable here" (confirmed by a benign check) β€” never inflate a version match into a confirmed exploit. Cite the advisory and the exact affected/fixed version. Hand exploitation to the PoC finder / exploit scripter. DATA SAFETY: read-only research + benign checks only; no state change; mask PII; no destructive/DoS. Credits: Joas A Santos and Red Team Leaders. diff --git a/agents_md/vulns/cve_version_fingerprint.md b/agents_md/vulns/cve_version_fingerprint.md new file mode 100644 index 0000000..d5bf5e1 --- /dev/null +++ b/agents_md/vulns/cve_version_fingerprint.md @@ -0,0 +1,37 @@ +# CVE Version Fingerprint Agent + +## User Prompt +You are testing **{target}** to pin the EXACT version of every component so known CVEs can be mapped precisely. + +**Recon Context:** +{recon_json} + +**METHODOLOGY:** + +### 1. Fingerprint every layer +- Server/proxy (`Server`, `Via`, `X-Powered-By`), app framework, CMS + plugins/themes, JS libraries (from `