Agent API_p16 - grisuno/LazyOwn GitHub Wiki

API (page 16 of 23)

Previous: API_p15.md

modules/reflective_dll.py

modules/resource_script.py

Depends on: core/safe_exec.py Imported by: cli/commands/resource_scripting.py, tests/test_resource_script.py, tests/test_security_hardening_v3.py

modules/reverse-shell.c

  • reverse_shell_init (function) modules/reverse-shell.c:12 static int __init reverse_shell_init(void) -- call_usermodehelper function is used to create user mode processes from kernel space
  • reverse_shell_exit (function) modules/reverse-shell.c:16 static void __exit reverse_shell_exit(void)

modules/revshell.c

modules/rich_tui.py

Depends on: core/console.py, modules/dashboard_engine.py Imported by: cli/commands/pwn.py

  • RichDashboard.__init__ (method) modules/rich_tui.py:74 def __init__(self, dashboard_engine, refresh_interval, live) -- Initialize the Rich dashboard.
  • RichDashboard.run (method) modules/rich_tui.py:96 def run(self) -- Run the dashboard.
  • RichDashboard.stop (method) modules/rich_tui.py:132 def stop(self) -- Gracefully shut down the dashboard and restore terminal state.

modules/rl_trainer.py

Depends on: core/logging.py Imported by: modules/lesson_ingestor.py, modules/loop_ai_bridge.py, skills/autonomous_daemon.py, skills/swan_agent.py, tests/test_moe_rl_swan.py

modules/rootkit/mr.c

modules/rootkit/mrhyde.c

modules/rootkit/mrhyde2.c

modules/rootkit/mrhyde3.c

modules/rootkit/rootkit.c

Depends on: core/crypto.py, lazyown-docker/init.sh

  • regs_override_return (function) modules/rootkit/rootkit.c:43 static inline void regs_override_return(struct pt_regs *regs, long new_ret) -- Define regs_override_return function
  • hooked_getdents (function) modules/rootkit/rootkit.c:75 static int hooked_getdents(struct kretprobe_instance *ri, struct pt_regs *regs) -- Hooked getdents function
  • hooked_getdents64 (function) modules/rootkit/rootkit.c:101 static int hooked_getdents64(struct kretprobe_instance *ri, struct pt_regs *regs) -- Hooked getdents64 function
  • hooked_read (function) modules/rootkit/rootkit.c:127 static int hooked_read(struct kretprobe_instance *ri, struct pt_regs *regs) -- Hooked read function to create a backdoor
  • disable_module_signature_verification (function) modules/rootkit/rootkit.c:181 static void disable_module_signature_verification(void) -- Function to disable module signature verification
  • hook_syscalls (function) modules/rootkit/rootkit.c:195 static int __init hook_syscalls(void) -- Function to hook system calls
  • unhook_syscalls (function) modules/rootkit/rootkit.c:208 static void __exit unhook_syscalls(void) -- Function to unhook system calls

modules/saas_attacks.py

Imported by: cli/commands/cloud_attacks.py

  • SaaSEnumerationTools.microsoft365_commands (method) modules/saas_attacks.py:75 def microsoft365_commands()
  • SaaSEnumerationTools.google_workspace_commands (method) modules/saas_attacks.py:100 def google_workspace_commands()
  • SaaSEnumerationTools.salesforce_commands (method) modules/saas_attacks.py:118 def salesforce_commands()
  • SaaSEnumerationTools.servicenow_commands (method) modules/saas_attacks.py:135 def servicenow_commands()
  • SaaSAttackEngine.__init__ (method) modules/saas_attacks.py:163 def __init__(self, config)
  • SaaSAttackEngine.enumerate_all (method) modules/saas_attacks.py:166 def enumerate_all(self) -- Generate enumeration commands for all supported SaaS platforms.
  • SaaSAttackEngine.m365_ews_mail_search (method) modules/saas_attacks.py:179 def m365_ews_mail_search(self, search_term) -- Search mailboxes via Exchange Web Services (EWS).
  • SaaSAttackEngine.google_workspace_domain_wide_delegation (method) modules/saas_attacks.py:228 def google_workspace_domain_wide_delegation(self) -- Abuse Google Workspace Domain-Wide Delegation (DWD).
  • SaaSAttackEngine.salesforce_report_mining (method) modules/saas_attacks.py:257 def salesforce_report_mining(self) -- Mine Salesforce reports and dashboards for sensitive data.
  • SaaSAttackEngine.slack_data_mining (method) modules/saas_attacks.py:286 def slack_data_mining(self) -- Mine Slack Enterprise for sensitive conversations and files.
  • SaaSAttackEngine.detect_external_sharing (method) modules/saas_attacks.py:327 def detect_external_sharing(self) -- Detect external sharing configurations across SaaS platforms.
  • SaaSAttackEngine.summary (method) modules/saas_attacks.py:352 def summary(self)

modules/security_sanitizers.py

Imported by: lazyc2.py, lazyc2/blueprints/phishing.py, modules/lazyown_bprfuzzer.py, pwntomate.py, tests/test_security_sanitizers.py

modules/selfupdate.py

Imported by: cli/commands/lazyops.py, modules/lazy_loop.py, tests/test_autonomous_ops.py, tests/test_lazy_loop.py

  • Updater.__init__ (method) modules/selfupdate.py:47 def __init__(self, live_path) -- Bind the updater to the binary that may be replaced.
  • Updater.verify (method) modules/selfupdate.py:52 def verify(self, artifact) -- Return True when the payload matches its recorded digest.
  • Updater.stage (method) modules/selfupdate.py:57 def stage(self, artifact, directory) -- Write a verified payload into directory.
  • Updater.rollback (method) modules/selfupdate.py:77 def rollback(self) -- Restore the <name>.old snapshot over the live binary.
  • current_branch (function) modules/selfupdate.py:96 def current_branch(runner) -- Return the checked-out branch name (empty on failure).
  • dirty (function) modules/selfupdate.py:102 def dirty(runner) -- Return True when the working tree has uncommitted changes.
  • check (function) modules/selfupdate.py:108 def check(branch, runner) -- Fetch the branch and report ahead/behind counts.
  • apply (function) modules/selfupdate.py:140 def apply(branch, confirm, runner) -- Fast-forward the tree to origin/ when safe.

modules/session_cleanup.py

Imported by: lazyown.py, tests/test_infra_disposable.py

  • find_cloudflared_pids (function) modules/session_cleanup.py:28 def find_cloudflared_pids(ps_output) -- Extract PIDs of cloudflared tunnel processes from ps output.
  • stop_cloudflared_processes (function) modules/session_cleanup.py:94 def stop_cloudflared_processes() -- Terminate stray cloudflared tunnel host processes.
  • cleanup_ephemeral_infra (function) modules/session_cleanup.py:120 def cleanup_ephemeral_infra() -- Stop all disposable infrastructure owned by this checkout.

modules/session_rag.py

Depends on: core/logging.py Imported by: cli/commands/mcp_bridge.py, modules/reactive_engine.py, skills/lazyown_groq_agents.py, skills/lazyown_mcp.py, tests/integration_autonomous_flow.py, tests/test_core_modules.py

modules/session_reader.py

Imported by: skills/lazyown_groq_agents.py, skills/lazyown_mcp.py, tests/test_core_modules.py

modules/session_state.py

Imported by: modules/recommender.py, skills/heartbeat.py, skills/lazyown_daemon.py, skills/lazyown_mcp.py

modules/sidequestion.py

Imported by: cli/commands/ai.py, tests/test_autonomous_ops.py

  • SideQuestionService.__init__ (method) modules/sidequestion.py:55 def __init__(self, answer_fn, config) -- Initialize registries with an optional answer function.
  • SideQuestionService.capture (method) modules/sidequestion.py:66 def capture(self, task_id, text) -- Freeze main-loop context into an immutable snapshot.
  • SideQuestionService.ask (method) modules/sidequestion.py:75 def ask(self, snapshot_id, question) -- Answer from a snapshot without touching main state.
  • SideQuestionService.cancel (method) modules/sidequestion.py:104 def cancel(self, request_id) -- Mark a pending request cancelled.
  • SideQuestionService.history (method) modules/sidequestion.py:113 def history(self, limit, before) -- Page request history newest first.

modules/sleep_obfuscation.py

Depends on: cli/commands/enum.py, core/logging.py Imported by: cli/commands/sleep_obfuscation.py, modules/beacon_config_builder.py, tests/test_sleep_obfuscation.py

modules/socks_proxy.py

Depends on: cli/commands/enum.py, core/logging.py Imported by: cli/commands/socks_proxy.py, modules/beacon_config_builder.py, tests/test_socks_proxy.py

  • SocksReply.message (method) modules/socks_proxy.py:103 def message(self) -- Return a human-readable message for this reply code.
  • SocksSession.elapsed_seconds (method) modules/socks_proxy.py:144 def elapsed_seconds(self) -- Return seconds since session creation.
  • SocksSession.to_dict (method) modules/socks_proxy.py:150 def to_dict(self) -- Serialize session to dictionary.
  • SocksProxyConfig.to_dict (method) modules/socks_proxy.py:199 def to_dict(self) -- Serialize config to dictionary.
  • SocksProxyConfig.from_dict (method) modules/socks_proxy.py:218 def from_dict(cls, raw) -- Build config from dictionary.
  • SocksValidator.validate_config (method) modules/socks_proxy.py:253 def validate_config(config) -- Validate a SocksProxyConfig and return error messages.
  • SocksValidator.validate_request (method) modules/socks_proxy.py:300 def validate_request(command, address_type, host, port, config) -- Validate a SOCKS5 request against the proxy configuration.
  • SocksProxyEngine.__init__ (method) modules/socks_proxy.py:381 def __init__(self, config)
  • SocksProxyEngine.config (method) modules/socks_proxy.py:387 def config(self) -- Return the current proxy configuration.
  • SocksProxyEngine.sessions (method) modules/socks_proxy.py:392 def sessions(self) -- Return active proxied sessions.
  • SocksProxyEngine.session_count (method) modules/socks_proxy.py:397 def session_count(self) -- Return the number of active sessions.
  • SocksProxyEngine.validate (method) modules/socks_proxy.py:401 def validate(self, config) -- Validate the configuration.
  • SocksProxyEngine.build_spec (method) modules/socks_proxy.py:413 def build_spec(self) -- Build a JSON-serializable proxy specification for beacon delivery.
  • SocksProxyEngine.create_session (method) modules/socks_proxy.py:436 def create_session(self, session_id, target_host, target_port, beacon_client_id) -- Create and track a new proxied session.
  • SocksProxyEngine.remove_session (method) modules/socks_proxy.py:475 def remove_session(self, session_id) -- Remove a session by ID.
  • SocksProxyEngine.get_session (method) modules/socks_proxy.py:482 def get_session(self, session_id) -- Return a session by ID, or None.
  • SocksProxyEngine.add_bytes (method) modules/socks_proxy.py:486 def add_bytes(self, session_id, sent, received) -- Update byte counters for a session.
  • SocksProxyEngine.cleanup_expired (method) modules/socks_proxy.py:497 def cleanup_expired(self) -- Remove sessions that have exceeded the timeout.
  • SocksProxyEngine.list_sessions (method) modules/socks_proxy.py:511 def list_sessions(self) -- Return a list of all active sessions as dictionaries.
  • SocksProxyEngine.from_dict (method) modules/socks_proxy.py:522 def from_dict(cls, raw) -- Build a SocksProxyEngine from a configuration dictionary.
  • SocksProxyEngine.from_payload (method) modules/socks_proxy.py:528 def from_payload(cls, payload) -- Build a SocksProxyEngine from a LazyOwn payload configuration.

modules/staged_delivery.py

Imported by: cli/commands/payload_arsenal.py

  • StagedDeliveryFactory.__init__ (method) modules/staged_delivery.py:83 def __init__(self, config, output_dir)
  • StagedDeliveryFactory.generate_hta (method) modules/staged_delivery.py:134 def generate_hta(self) -- Generate an HTA (HTML Application) dropper.
  • StagedDeliveryFactory.generate_vba_macro (method) modules/staged_delivery.py:171 def generate_vba_macro(self) -- Generate a VBA macro for Office documents (Word/Excel).
  • StagedDeliveryFactory.generate_xlm_macro (method) modules/staged_delivery.py:219 def generate_xlm_macro(self) -- Generate an Excel 4.0 (XLM) macro for legacy macro execution.
  • StagedDeliveryFactory.generate_lnk (method) modules/staged_delivery.py:237 def generate_lnk(self) -- Generate a Windows .lnk shortcut file with embedded command execution.
  • StagedDeliveryFactory.generate_iso (method) modules/staged_delivery.py:301 def generate_iso(self, inner_files) -- Generate an ISO 9660 image with an embedded payload autorun.
  • StagedDeliveryFactory.generate_vhd (method) modules/staged_delivery.py:370 def generate_vhd(self, inner_files) -- Generate a VHD (Virtual Hard Disk) image with embedded payloads.
  • StagedDeliveryFactory.generate_all (method) modules/staged_delivery.py:420 def generate_all(self) -- Generate all delivery formats for the current configuration.
  • StagedDeliveryFactory.generate_phishing_page (method) modules/staged_delivery.py:460 def generate_phishing_page(self, template) -- Generate a credential harvesting HTML page.

modules/state_manager.py

Depends on: core/logging.py, modules/db.py, modules/event_bus.py, modules/world_model.py Imported by: cli/commands/automation.py, lazyc2.py, lazyc2/blueprints/beacon.py, lazyown.py, modules/conditional_hooks.py, modules/event_consumers.py, modules/unified_bridge.py

modules/sudo_tiocsti.py

Depends on: core/logging.py

  • get_controlling_tty (function) modules/sudo_tiocsti.py:52 def get_controlling_tty() -- Return (file_descriptor, tty_path) for the controlling terminal.
  • inject_byte (function) modules/sudo_tiocsti.py:64 def inject_byte(fd, byte_char) -- Inject a single byte via TIOCSTI; return success status.
  • inject_payload (function) modules/sudo_tiocsti.py:79 def inject_payload(fd, payload, char_delay) -- Inject a multi‑character payload.
  • get_sudo_pids_on_tty (function) modules/sudo_tiocsti.py:102 def get_sudo_pids_on_tty(tty_path) -- Return a list of PIDs that are running 'sudo' and have the same controlling terminal as the given tty_path.
  • sudo_cache_valid (function) modules/sudo_tiocsti.py:139 def sudo_cache_valid() -- Return True if sudo credentials are cached (i.e., sudo -n succeeds).
  • mode_poll (function) modules/sudo_tiocsti.py:149 def mode_poll(fd, tty_path) -- Poll for sudo processes; inject payload when sudo exits.
  • mode_prefill (function) modules/sudo_tiocsti.py:175 def mode_prefill(fd) -- Inject payload repeatedly, regardless of sudo state.
  • mode_cache (function) modules/sudo_tiocsti.py:185 def mode_cache(fd) -- Check sudo cache; if valid, inject sudo -i once.
  • main (function) modules/sudo_tiocsti.py:198 def main()

modules/surface_ops.py

Imported by: cli/commands/surface.py, tests/test_estorides_fusion.py

  • is_ipv4 (function) modules/surface_ops.py:18 def is_ipv4(value) -- Return True for dotted-quad IPv4 literals with 0-255 octets.
  • parse_confirm (function) modules/surface_ops.py:26 def parse_confirm(answer) -- Return True for an affirmative scan confirmation answer.
  • discovery_targets (function) modules/surface_ops.py:31 def discovery_targets(sessions_dir) -- List every discovery IP across the sessions discovery files.
  • write_world_model_hosts (function) modules/surface_ops.py:50 def write_world_model_hosts(document, sessions) -- Append unknown estorides host IPs to world_model.json hosts.

modules/tel.py

  • get_machine_id (function) modules/tel.py:10 def get_machine_id()
  • get_version (function) modules/tel.py:24 def get_version()
  • to_numbers (function) modules/tel.py:36 def to_numbers(hex_str) -- Simula la función toNumbers de JavaScript
  • to_hex (function) modules/tel.py:41 def to_hex(byte_list) -- Simula la función toHex de JavaScript
  • decrypt_cookie (function) modules/tel.py:46 def decrypt_cookie(encrypted, key, iv) -- Descifra usando AES en modo CBC (como slowAES.decrypt(c,2,a,b))
  • main (function) modules/tel.py:53 def main() -- Sistema de telemetría de uso por instalación no invasiva.

modules/threat_model.py

Depends on: core/logging.py Imported by: cli/commands/mcp_bridge.py, skills/lazyown_groq_agents.py, skills/lazyown_mcp.py, tests/test_core_modules.py

modules/timeline_narrator.py

Depends on: modules/ai_fallback.py Imported by: skills/heartbeat.py, skills/lazyown_daemon.py, skills/lazyown_mcp.py

modules/timestomper.py

Imported by: cli/commands/opsec_cleanup.py

  • Timestomper.__init__ (method) modules/timestomper.py:106 def __init__(self, config)
  • Timestomper.windows_timestomp_powershell (method) modules/timestomper.py:110 def windows_timestomp_powershell(self) -- Generate PowerShell commands for Windows file timestomping.
  • Timestomper.windows_timestomp_c (method) modules/timestomper.py:152 def windows_timestomp_c(self) -- Generate C code for Windows timestomping via SetFileTime API.
  • Timestomper.linux_timestomp_commands (method) modules/timestomper.py:200 def linux_timestomp_commands(self) -- Generate Linux commands for file timestomping.
  • Timestomper.macos_timestomp_commands (method) modules/timestomper.py:241 def macos_timestomp_commands(self) -- Generate macOS commands for file timestomping.
  • Timestomper.generate_random_timestamps (method) modules/timestomper.py:280 def generate_random_timestamps(self, reference_ts, window_days) -- Generate randomized timestamps within a window around the reference.
  • Timestomper.verify_timestamps (method) modules/timestomper.py:300 def verify_timestamps(self, target_paths) -- Verify timestamps on target files after modification.
  • Timestomper.summary (method) modules/timestomper.py:326 def summary(self) -- Return a summary of available timestomping capabilities.

modules/tools/loop_smoke.py

Depends on: modules/lazy_engine.py, modules/lazy_loop.py, modules/lazy_runner.py

modules/tools/monitor_smoke.py

Depends on: cli/lazy_monitor.py, modules/lazy_engine.py, modules/lazy_loop.py

modules/toolset.py

Imported by: skills/autonomous_daemon.py

  • builtin_seeds (function) modules/toolset.py:35 def builtin_seeds() -- Return the default graph-tool catalog (handlers stay in code).
  • resolve (function) modules/toolset.py:72 def resolve(agent, tool_key) -- Return the seed when bound to agent, else None (LAZY ToolResolve).
  • extract_tool (function) modules/toolset.py:105 def extract_tool(command) -- Split tool name with shlex; flag shell metacharacters.
  • validate_shell (function) modules/toolset.py:128 def validate_shell(role, command) -- Check a shell command against the role allowlist.

modules/toposwarm_bridge.py

Depends on: core/logging.py Imported by: modules/ai_fallback.py, modules/hive_invoke.py, modules/llm_factory.py, modules/moe_router.py, modules/unified_bridge.py, skills/toposwarm_autonomous.py

modules/traffic_morpher.py

Imported by: cli/commands/persist_migrated.py

  • TrafficMorpher.__init__ (method) modules/traffic_morpher.py:77 def __init__(self)
  • TrafficMorpher.get_random_http_headers (method) modules/traffic_morpher.py:81 def get_random_http_headers(self) -- Return a randomized set of HTTP headers mimicking a real browser.
  • TrafficMorpher.get_cdn_fronting_hosts (method) modules/traffic_morpher.py:91 def get_cdn_fronting_hosts(self, provider, count) -- Return CDN domains suitable for domain fronting.
  • TrafficMorpher.generate_traffic_padding (method) modules/traffic_morpher.py:108 def generate_traffic_padding(self, min_bytes, max_bytes) -- Generate random padding bytes to normalize packet sizes.
  • TrafficMorpher.generate_jitter (method) modules/traffic_morpher.py:125 def generate_jitter(self, base_delay, jitter_pct) -- Calculate a sleep delay with jitter.
  • TrafficMorpher.generate_dns_tunnel_payload (method) modules/traffic_morpher.py:138 def generate_dns_tunnel_payload(self, data, domain) -- Encode data as DNS query subdomains for tunneling.
  • TrafficMorpher.generate_icmp_exfil_payload (method) modules/traffic_morpher.py:164 def generate_icmp_exfil_payload(self, data, chunk_size) -- Generate ICMP echo payloads for data exfiltration.
  • TrafficMorpher.generate_websocket_masking (method) modules/traffic_morpher.py:190 def generate_websocket_masking(self, data) -- Apply WebSocket frame masking with random key.
  • TrafficMorpher.generate_cloudflare_worker_proxy_config (method) modules/traffic_morpher.py:205 def generate_cloudflare_worker_proxy_config(self, c2_host, c2_port, auth_token) -- Generate a Cloudflare Worker script that proxies C2 traffic.
  • TrafficMorpher.generate_beacon_profile (method) modules/traffic_morpher.py:270 def generate_beacon_profile(self, name, protocol, jitter_pct, user_agent) -- Generate a complete C2 beacon profile configuration.

Next: API_p17.md

⚠️ **GitHub.com Fallback** ⚠️