Agent KB_modules_p6 - grisuno/LazyOwn GitHub Wiki

Subsystem: modules (page 6 of 14)

Previous: KB_modules_p5.md

modules/intelligence_engine.py

  • Doc: IntelligenceEngine — unified collection→analysis→intelligence pipeline.
  • Layer: utility
  • Language: py
  • Symbols:
    • IntelligenceConfig (class, line 57) class IntelligenceConfig
    • CollectedFact (class, line 78) class CollectedFact
    • IntelligenceAssessment (class, line 93) class IntelligenceAssessment
    • CounterIntelFinding (class, line 108) class CounterIntelFinding
    • IntelligenceEngine (class, line 119) class IntelligenceEngine
    • get_intelligence_engine (function, line 931) def get_intelligence_engine(config)
    • __init__ (method, line 142) def __init__(self, config)
    • collect_from_scan (method, line 153) def collect_from_scan(self, target)
    • collect_from_tool (method, line 255) def collect_from_tool(self, output, tool, host)
    • collect_from_estorides (method, line 292) def collect_from_estorides(self, target)
    • collect_from_nuclei (method, line 334) def collect_from_nuclei(self, target)
    • collect_from_yara (method, line 376) def collect_from_yara(self, target_path)
    • collect_from_factstore (method, line 415) def collect_from_factstore(self)
    • analyze (method, line 477) def analyze(self)
    • _correlate_services_to_vulns (method, line 494) def _correlate_services_to_vulns(self)
    • _match_known_vulns (method, line 537) def _match_known_vulns(fact)
    • _correlate_creds_to_hosts (method, line 565) def _correlate_creds_to_hosts(self)
    • _correlate_domains_to_infrastructure (method, line 588) def _correlate_domains_to_infrastructure(self)
    • _rank_targets (method, line 604) def _rank_targets(self)
    • _detect_killchain_gaps (method, line 644) def _detect_killchain_gaps(self)
    • produce_intelligence (method, line 685) def produce_intelligence(self)
    • _map_category_to_mitre (method, line 700) def _map_category_to_mitre(category)
    • produce_counter_intelligence (method, line 715) def produce_counter_intelligence(self)
    • disseminate (method, line 765) def disseminate(self)
    • run_full_cycle (method, line 845) def run_full_cycle(self, target)
    • get_intel_report (method, line 874) def get_intel_report(self)
    • _is_placeholder (method, line 925) def _is_placeholder(value)
  • Depends on: core/logging.py, modules/estorides_importer.py, modules/integrations/nuclei_bridge.py, modules/integrations/nuclei_parser.py, modules/obs_parser.py, modules/world_model.py, modules/yara_scanner.py
  • Imported by: cli/commands/mcp_bridge.py, cli/commands/recon.py, skills/lazyown_mcp.py, tests/test_intelligence_engine.py

modules/intercept.py

  • Doc: User-configurable tool-call interception layer with human-in-loop approvals.
  • Layer: utility
  • Language: py
  • Symbols:
    • InterceptAction (class, line 21) class InterceptAction(str, Enum)
    • InterceptConfig (class, line 33) class InterceptConfig
    • InterceptRule (class, line 50) class InterceptRule
    • PendingApproval (class, line 77) class PendingApproval
    • InterceptVerdict (class, line 92) class InterceptVerdict
    • builtin_rules (function, line 101) def builtin_rules()
    • scope_blocked (function, line 131) def scope_blocked(target)
    • observe_post_tool (function, line 144) def observe_post_tool(output)
    • Interceptor (class, line 154) class Interceptor
    • Guard (class, line 255) class Guard
    • __post_init__ (method, line 61) def __post_init__(self)
    • matches (method, line 68) def matches(self, tool, command)
    • __init__ (method, line 157) def __init__(self, rules, ask_timeout_sec, timeout_action)
    • rules (method, line 172) def rules(self)
    • add_rule (method, line 177) def add_rule(self, rule)
    • remove_rule (method, line 183) def remove_rule(self, pattern)
    • evaluate (method, line 192) def evaluate(self, tool, command)
    • decide (method, line 220) def decide(self, approval_id, decision)
    • pending_approvals (method, line 234) def pending_approvals(self)
    • approval_status (method, line 249) def approval_status(self, approval_id)
    • __init__ (method, line 258) def __init__(self, interceptor)
    • interceptor (method, line 266) def interceptor(self)
    • check (method, line 270) def check(self, tool, command)
    • observe (method, line 282) def observe(self, output, source)
    • record_failure (method, line 291) def record_failure(self, source)
    • audit_log (method, line 296) def audit_log(self, limit)
    • attribution (method, line 301) def attribution(self)
  • Depends on: cli/commands/enum.py
  • Imported by: cli/commands/daemon_ctl.py, modules/lazy_loop.py, skills/autonomous_daemon.py, skills/lazyown_mcp.py, tests/test_engage_gates.py, tests/test_lazy_parity.py, tests/test_safety_gates.py

modules/internal_discover.sh

  • Layer: utility
  • Language: sh

modules/iptables_portforward.sh

  • Layer: utility
  • Language: sh
  • Symbols:
    • display_usage (function, line 29)

modules/jsonl_tail.py

  • Doc: Incremental JSONL reader shared by the monitor TUI and the loop runner.
  • Layer: utility
  • Language: py
  • Symbols:
    • JsonlTail (class, line 14) class JsonlTail
    • __init__ (method, line 17) def __init__(self, path)
    • read_new (method, line 22) def read_new(self, limit)
  • Imported by: cli/lazy_monitor.py, cli/lazy_orchestrator.py, modules/lazy_runner.py

modules/jwtexploit.py

  • Layer: utility
  • Language: py

modules/k8s_attacks.py

  • Doc: Kubernetes attack module — RBAC enumeration, pod escape, etcd access, Helm abuse.
  • Layer: utility
  • Language: py
  • Symbols:
    • K8sConfig (class, line 57) class K8sConfig
    • K8SAttackEngine (class, line 77) class K8SAttackEngine
    • __init__ (method, line 87) def __init__(self, config)
    • enumerate_rbac (method, line 90) def enumerate_rbac(self)
    • privileged_pod_escape (method, line 118) def privileged_pod_escape(self)
    • service_account_token_theft (method, line 173) def service_account_token_theft(self)
    • kubelet_anonymous_auth_abuse (method, line 198) def kubelet_anonymous_auth_abuse(self)
    • etcd_access_exploitation (method, line 222) def etcd_access_exploitation(self)
    • helm_tiller_abuse (method, line 250) def helm_tiller_abuse(self)
    • persistence_techniques (method, line 278) def persistence_techniques(self)
    • summary (method, line 318) def summary(self)
  • Imported by: cli/commands/cloud_attacks.py

modules/kerberoasting.py

  • Doc: Advanced Kerberoasting — targeted SPN enumeration, AES-only attacks, hashcat integration.
  • Layer: utility
  • Language: py
  • Symbols:
    • KerberoastTarget (class, line 38) class KerberoastTarget
    • KerberoastHash (class, line 59) class KerberoastHash
    • KerberoastingEngine (class, line 79) class KerberoastingEngine
    • __init__ (method, line 95) def __init__(self, domain, dc_ip, username, password, hash)
    • enumerate_spns (method, line 112) def enumerate_spns(self, ldap_output, bloodhound_data)
    • _prioritize_targets (method, line 169) def _prioritize_targets(self)
    • request_tgs_aes_only (method, line 187) def request_tgs_aes_only(self, user_spn)
    • request_tgs_rc4 (method, line 208) def request_tgs_rc4(self, user_spn)
    • request_tgs (method, line 219) def request_tgs(self, user_spn, etype)
    • _build_hash_string (method, line 248) def _build_hash_string(self, spn, etype)
    • _hashcat_command (method, line 268) def _hashcat_command(hash_str, mode)
    • targeted_kerberoast (method, line 271) def targeted_kerberoast(self, high_value_only)
    • asreproast_check (method, line 306) def asreproast_check(self, usernames)
    • extract_hashes_from_pcap (method, line 321) def extract_hashes_from_pcap(self, pcap_path)
    • detect_kerberoasting_activity (method, line 336) def detect_kerberoasting_activity(self, event_log)
    • build_hashcat_batch (method, line 379) def build_hashcat_batch(self, output_path)
    • summary (method, line 401) def summary(self)
    • priority (function, line 172) def priority(target)
  • Depends on: modules/kerberos_core.py
  • Imported by: cli/commands/active_directory.py

modules/kerberos_core.py

  • Doc: Native Kerberos protocol library — AS-REQ, TGS-REQ, ticket parsing, encryption.
  • Layer: utility
  • Language: py
  • Symbols:
    • KerberosPrincipal (class, line 139) class KerberosPrincipal
    • EncryptedData (class, line 157) class EncryptedData
    • KerberosTicket (class, line 172) class KerberosTicket
    • PACSignature (class, line 213) class PACSignature
    • PACInfo (class, line 228) class PACInfo
    • TGSRequest (class, line 249) class TGSRequest
    • KerberosCrypto (class, line 271) class KerberosCrypto
    • KerberosCore (class, line 407) class KerberosCore
    • KerberosErrorParser (class, line 683) class KerberosErrorParser
    • TicketValidator (class, line 702) class TicketValidator
    • to_string (method, line 152) def to_string(self)
    • has_flag (method, line 207) def has_flag(self, flag_name)
    • __init__ (method, line 277) def __init__(self)
    • derive_aes_key (method, line 282) def derive_aes_key(password, salt, etype)
    • derive_rc4_key (method, line 318) def derive_rc4_key(password)
    • aes_encrypt (method, line 329) def aes_encrypt(self, key, plaintext, usage)
    • aes_decrypt (method, line 361) def aes_decrypt(self, key, ciphertext, usage)
    • compute_checksum (method, line 389) def compute_checksum(key, data, etype)
    • __init__ (method, line 421) def __init__(self, domain, dc_host, dc_ip)
    • get_supported_etypes (method, line 427) def get_supported_etypes(self)
    • build_as_req (method, line 435) def build_as_req(self, username, domain, password, etype)
    • build_tgs_req (method, line 489) def build_tgs_req(self, params)
    • parse_as_rep (method, line 534) def parse_as_rep(self, as_rep_data, key, etype)
    • parse_tgs_rep (method, line 550) def parse_tgs_rep(self, tgs_rep_data, session_key, etype)
    • decrypt_ticket (method, line 563) def decrypt_ticket(self, ticket_data, key, etype)
    • parse_pac (method, line 588) def parse_pac(self, pac_data)
    • _parse_pac_buffer (method, line 622) def _parse_pac_buffer(pac, buf_type, buf_data)
    • _build_pa_enc_timestamp (method, line 640) def _build_pa_enc_timestamp(self, key, etype, timestamp)
    • _parse_kdc_rep (method, line 653) def _parse_kdc_rep(self, data, key, etype, rep_type)
    • _rc4_encrypt (method, line 667) def _rc4_encrypt(key, data, usage)
    • _rc4_decrypt (method, line 676) def _rc4_decrypt(key, data, usage)
    • parse_error (method, line 687) def parse_error(error_data)
    • is_expired (method, line 706) def is_expired(endtime, grace_period)
    • validate_flags (method, line 719) def validate_flags(ticket, required_flags)
    • validate_pac_checksums (method, line 735) def validate_pac_checksums(pac)
  • Imported by: modules/kerberoasting.py, modules/kerberos_tickets.py

modules/kerberos_tickets.py

  • Doc: Kerberos ticket forgery attacks — silver, golden, diamond, sapphire tickets.
  • Layer: utility
  • Language: py
  • Symbols:
    • SilverTicketConfig (class, line 36) class SilverTicketConfig
    • GoldenTicketConfig (class, line 65) class GoldenTicketConfig
    • DiamondTicketConfig (class, line 94) class DiamondTicketConfig
    • SilverTicketForger (class, line 124) class SilverTicketForger
    • GoldenTicketForger (class, line 265) class GoldenTicketForger
    • DiamondTicketForger (class, line 397) class DiamondTicketForger
    • SapphireTicketForger (class, line 462) class SapphireTicketForger
    • SkeletonKeyInjector (class, line 567) class SkeletonKeyInjector
    • __init__ (method, line 131) def __init__(self)
    • forge (method, line 134) def forge(self, config)
    • _resolve_key (method, line 190) def _resolve_key(self, config)
    • _build_silver_pac (method, line 200) def _build_silver_pac(self, config, start, end)
    • _build_enc_ticket_part (method, line 206) def _build_enc_ticket_part(self, config, start, end, flags, key, etype)
    • _build_ticket_structure (method, line 225) def _build_ticket_structure(self, config, flags, enc_part)
    • _build_kirbi (method, line 235) def _build_kirbi(self, ticket, enc_part, etype)
    • _mimikatz_inject_command (method, line 244) def _mimikatz_inject_command(self, config)
    • _impacket_command (method, line 254) def _impacket_command(self, config)
    • __init__ (method, line 272) def __init__(self)
    • forge (method, line 275) def forge(self, config)
    • _resolve_krbtgt_key (method, line 324) def _resolve_krbtgt_key(self, config)
    • _build_golden_pac (method, line 339) def _build_golden_pac(self, config)
    • _build_golden_enc_part (method, line 346) def _build_golden_enc_part(self, config, start, end, flags, key)
    • _assemble_tgt (method, line 368) def _assemble_tgt(self, config, flags, enc_part)
    • _mimikatz_command (method, line 379) def _mimikatz_command(self, config)
    • _impacket_command (method, line 388) def _impacket_command(self, config)
    • __init__ (method, line 405) def __init__(self)
    • forge (method, line 408) def forge(self, config)
    • _build_diamond_pac (method, line 446) def _build_diamond_pac(self, config)
    • __init__ (method, line 469) def __init__(self, kerberos_core)
    • forge_s4u2self (method, line 472) def forge_s4u2self(self, tgt, session_key, target_user, target_service, domain)
    • forge_rbcd (method, line 530) def forge_rbcd(self, machine_account_hash, target_service, domain, username)
    • detect_skeleton_key (method, line 578) def detect_skeleton_key(target_host, domain, dc_ip)
    • inject_command (method, line 600) def inject_command(target_host)
    • cleanup_command (method, line 612) def cleanup_command()
  • Depends on: modules/kerberos_core.py
  • Imported by: cli/commands/active_directory.py

modules/kill_chain_viz.py

  • Doc: SVG / HTML kill-chain visualizer — generates standalone HTML with embedded SVG.
  • Layer: utility
  • Language: py
  • Symbols:
    • _load_phases (function, line 20) def _load_phases(sessions)
    • _read_target (function, line 27) def _read_target()
    • _build_svg (function, line 34) def _build_svg(phases)
    • generate_html (function, line 69) def generate_html(target, sessions)
    • generate_svg (function, line 102) def generate_svg(target, sessions)
  • Depends on: modules/killchain.py
  • Imported by: lazyc2.py

modules/killchain.py

modules/kivi.py

  • Layer: utility
  • Language: py
  • Symbols:
    • ReverseShellApp (class, line 11) class ReverseShellApp(App)
    • build (method, line 12) def build(self)
    • connect_to_server (method, line 27) def connect_to_server(self, instance)

modules/lazy_agent.py

  • Doc: Agentic tool-calling bridge for the loop and the main agent.
  • Layer: utility
  • Language: py
  • Symbols:
    • model_timeout_sec (function, line 41) def model_timeout_sec()
    • tool_calling_enabled (function, line 57) def tool_calling_enabled()
    • max_iterations (function, line 72) def max_iterations()
    • resolve_agentic_model (function, line 83) def resolve_agentic_model(exclude)
    • _enable_streaming (function, line 123) def _enable_streaming(runner, on_event)
    • ObservableAgentRunner (class, line 145) class ObservableAgentRunner(AgentRunner)
    • _json_default (function, line 221) def _json_default(value)
    • _deep_clean (function, line 237) def _deep_clean(value, _depth)
    • _json_safe (function, line 253) def _json_safe(messages)
    • ConversationStore (class, line 261) class ConversationStore
    • register_tools (function, line 322) def register_tools(runner, specs)
    • run_worker_session (function, line 335) def run_worker_session(model, task_id, intent_id, system_prompt, launch_prompt, tools, on_event)
    • run_main_session (function, line 374) def run_main_session(model, session_id, system_prompt, prompt, tools, on_event)
    • run_external_opencode (function, line 396) def run_external_opencode(prompt, session_id, agent, cwd, timeout_sec)
    • run_external_hermes (function, line 472) def run_external_hermes(prompt, session_id, cwd, timeout_sec, max_turns, run_budget)
    • _session_from_line (function, line 556) def _session_from_line(line)
    • _process_watchdog (function, line 578) def _process_watchdog(timeout_sec, process)
    • __init__ (method, line 148) def __init__(self, model, system_prompt, max_iterations, on_event)
    • _process_tool_call (method, line 159) def _process_tool_call(self, tool_call)
    • run (method, line 168) def run(self, user_input)
    • _call_model (method, line 174) def _call_model(self)
    • __init__ (method, line 264) def __init__(self, task_id)
    • _load (method, line 269) def _load(self)
    • intent_messages (method, line 273) def intent_messages(self, intent_id)
    • save_intent (method, line 278) def save_intent(self, intent_id, messages)
    • session (method, line 287) def session(self, session_id)
    • sessions (method, line 291) def sessions(self)
    • save_session (method, line 305) def save_session(self, session_id, messages, title)
    • reset_intents (method, line 315) def reset_intents(self)
    • _kill (function, line 583) def _kill()
    • _invoke (function, line 190) def _invoke()
    • _tick (function, line 196) def _tick()
  • Depends on: core/config.py, modules/__init__.py, modules/agent_runner.py, modules/auto_registry.py, modules/lazy_loop.py, modules/llm_factory.py, modules/loop_ai_bridge.py
  • Imported by: cli/commands/lazyops.py, tests/conftest.py, tests/test_lazy_agent.py

modules/lazy_bridge.py

  • Doc: Bidirectional LAZY <-> LazyOwn bridge.
  • Layer: utility
  • Language: py
  • Symbols:
    • _data_dir (function, line 35) def _data_dir()
    • _read_json (function, line 47) def _read_json(path, default)
    • _read_jsonl (function, line 64) def _read_jsonl(path)
    • lazy_tasks (function, line 88) def lazy_tasks()
    • lazy_assets (function, line 99) def lazy_assets()
    • lazy_graph (function, line 110) def lazy_graph(task_id)
    • lazy_activity (function, line 123) def lazy_activity(task_id)
    • lazy_traffic (function, line 135) def lazy_traffic(task_id)
    • lazy_guard_audit (function, line 147) def lazy_guard_audit(task_id)
    • bridge_status (function, line 159) def bridge_status()
    • _extract_hosts_from_graph (function, line 180) def _extract_hosts_from_graph(graph)
    • pull_to_world_model (function, line 206) def pull_to_world_model()
    • pull_to_objectives (function, line 251) def pull_to_objectives()
    • pull_findings_to_lifecycle (function, line 286) def pull_findings_to_lifecycle()
    • pull_traffic_to_recorder (function, line 314) def pull_traffic_to_recorder()
    • push_objective_to_lazy (function, line 344) def push_objective_to_lazy(goal, scope)
    • push_tasks_to_c2 (function, line 369) def push_tasks_to_c2(only)
    • sync_all (function, line 434) def sync_all()
    • _record_sync (function, line 449) def _record_sync(action, summary)
  • Depends on: modules/finding_lifecycle.py, modules/traffic_recorder.py, modules/world_model.py
  • Imported by: cli/commands/lazyloop.py, modules/lazy_loop.py, skills/lazyown_mcp.py, tests/conftest.py, tests/test_lazy_loop.py

modules/lazy_cli_bridge.py

  • Doc: Full CLI catalog for the Lazy autonomous loop.
  • Layer: utility
  • Language: py
  • Symbols:
    • _source_files (function, line 74) def _source_files()
    • _source_mtimes (function, line 82) def _source_mtimes()
    • _discover (function, line 93) def _discover()
    • cli_verbs (function, line 106) def cli_verbs()
    • is_cli_verb (function, line 125) def is_cli_verb(name)
    • phase_for (function, line 131) def phase_for(verb)
    • risk_for (function, line 140) def risk_for(verb)
    • needs_target_for (function, line 150) def needs_target_for(verb)
    • build_cli_command (function, line 158) def build_cli_command(verb, target)
    • search_cli_verbs (function, line 185) def search_cli_verbs(query, phase, limit)
    • cli_catalog_for_phase (function, line 211) def cli_catalog_for_phase(phase, limit)
    • full_cli_enabled (function, line 219) def full_cli_enabled()
    • set_full_cli (function, line 242) def set_full_cli(enabled)
  • Depends on: core/config.py
  • Imported by: cli/commands/lazyops.py, modules/auto_registry.py, modules/lazy_intel.py, modules/lazy_orchestrator_feedback.py

modules/lazy_engine.py

modules/lazy_installer.py

  • Doc: Capability installer for the Lazy autonomous loop.
  • Layer: utility
  • Language: py
  • Symbols:
    • installer_enabled (function, line 41) def installer_enabled()
    • set_installer_enabled (function, line 58) def set_installer_enabled(enabled)
    • install_command_for (function, line 70) def install_command_for(tool)
    • intent_for (function, line 75) def intent_for(tool)
    • tool_from_intent (function, line 80) def tool_from_intent(text)
    • steps_for_install (function, line 88) def steps_for_install(text)
  • Depends on: core/config.py, modules/auto_registry.py
  • Imported by: cli/commands/lazyops.py, modules/auto_registry.py, modules/lazy_loop.py

modules/lazy_intel.py

  • Doc: Intel feed from the Lazy autonomous loop.
  • Layer: utility
  • Language: py
  • Symbols:
    • _now (function, line 30) def _now()
    • _log_path (function, line 35) def _log_path()
    • _mask (function, line 41) def _mask(text)
    • _append (function, line 70) def _append(record)
    • infer_source (function, line 79) def infer_source(command, intent_text)
    • describe_command (function, line 105) def describe_command(command)
    • record_routing_decision (function, line 120) def record_routing_decision(task_id, intent_id, command, intent_text, target, stack)
    • record_routing_outcome (function, line 160) def record_routing_outcome(task_id, intent_id, command, state, facts, findings, stack)
    • read_decisions (function, line 202) def read_decisions(task_id, limit)
    • mask_configured (function, line 228) def mask_configured(text)
    • stack_signature (function, line 254) def stack_signature(assets)
    • _is_ip_literal (function, line 274) def _is_ip_literal(value)
    • fuse_routing_decisions (function, line 285) def fuse_routing_decisions(task_id)
    • export_spans (function, line 324) def export_spans(task_id, out)
  • Depends on: core/config.py, modules/lazy_cli_bridge.py, modules/lazy_loop.py, modules/world_model.py, utils.py
  • Imported by: modules/atomic_exploit_bridge.py, modules/lazy_loop.py, modules/lazy_orchestrator_feedback.py, tests/test_loop_supervision.py

Next: KB_modules_p7.md