Essentials - grisuno/LazyOwn GitHub Wiki

LazyOwn Essentials — The Commands You Actually Need

This is the 80/20 reference. 18 commands cover the majority of engagements. Everything else lives in CHEATSHEET.md and COMMANDS.md (748 commands).

The Golden Path (every engagement)

ping -> lazynmap -> auto_populate -> facts_show -> recommend_next
# Command What it does Why it matters
1 assign rhost 10.10.11.5 Set target IP Every command reads this from payload.json
2 assign lhost 10.10.14.3 Set your IP Used by beacon callbacks, C2, payloads
3 ping ICMP TTL probe TTL ~64 = Linux, ~128 = Windows. Sets os_id automatically
4 lazynmap Full port scan Writes to sessions/scan_<rhost>.nmap. Never re-run if file exists
5 auto_populate Parse scan into payload context Fills domain, os_id, services and first creds from the nmap XML into payload.json
6 facts_show Display discovered facts Quick read of what the scan found: ports, services, versions (--refresh re-parses sessions/)
7 recommend_next Ranked next steps Local engine fuses policy + recon plan + knowledge graph into the 3-5 best commands for the current phase — no API key needed

One command — engage

When you just want a shell, engage runs the whole golden path for you:

engage 10.10.11.5

It chains ping → lazynmap → auto_populate → enum → exploit-search → initial-access on the target, auto-switching to the next tool when a step fails. With auto_approve false in payload.json it pauses at gated phases for your go-ahead, so you stay in control. Useful flags:

Flag Effect
engage <ip> --background Detach into a worker; tail it with engage --status
engage --pending List phases awaiting your approval
engage --approve <id> / engage --deny <id> Resolve a pending gate

Every action is narrated to sessions/engagement.log and broadcast to connected teammates. Run the manual seven-step path above when you want to understand or control each step; reach for engage when you want speed.

One goal — orchestrate

engage walks a fixed chain. orchestrate hands a free-text goal to the autonomous backends and lets them plan the steps:

orchestrate "gain initial access and dump hashes"
Form Effect
orchestrate "<goal>" Auto-routes to the best backend (daemon, hive or swan)
orchestrate "<goal>" --mode daemon Force the objective-driven daemon (auto_loop "<goal>" is a shortcut for this)
orchestrate "<goal>" --mode hive Queen/drone swarm with shared memory
orchestrate "<goal>" --mode swan MoE+RL router, learns from outcomes

The daemon backend is fully local and works offline. LLM-backed reasoning uses api_key (Groq) when set and falls back to the local Ollama runtime when it is not — if neither is available the shell tells you at startup instead of failing silently.

By Goal — not by phase

I found a web service

Command What it does
ww whatweb fingerprint
gobuster Directory brute-force (uses rhost + dirwordlist)
ffuf Fast web fuzzer (uses rhost + url)
finalrecon All-in-one web recon
ss apache 2.4.49 Search exploits for discovered version

I found SMB / Windows

Command What it does
enum4linux SMB/LDAP enumeration
cme Crackmapexec (requires domain + start_user/start_pass)
getnpusers AS-REP roasting
secretsdump Dumps NTDS / SAM / LSA secrets (needs creds)
bloodhound AD attack path mapping (needs creds)
evil evil-winrm shell (needs creds)
psexec Remote execution (needs creds)

I found Linux / SSH

Command What it does
ssh_cmd Run command over SSH (uses rhost + start_user/start_pass)
scp File transfer over SSH
linpeas Privilege escalation auto-checker

I need a shell / payload

Command What it does
venom Generate msfvenom payload (uses lhost + lport + os_id)
msf Start metasploit handler
createrevshell Reverse shell one-liner generator
blacksandbeacon Compile C beacon with BOF support

I have credentials and want to move

Command What it does
secretsdump Extract hashes and secrets
evil WinRM shell
psexec Execute remotely
bloodhound Map AD paths

I need situational awareness

Command What it does
creds Show captured credentials (cat sessions/credentials*)
hash Show captured hashes (cat sessions/hash*)
dashboard TUI with target, phase, commands, hints
collab_join alice Team dashboard URL

The Three Rules

  1. Never write raw tool flags. lazynmap auto-injects rhost. gobuster auto-injects rhost, dirwordlist. Always use the alias.
  2. Read sessions/ before repeating work. If scan_<rhost>.nmap exists, read it. Do not re-scan.
  3. Ping first, always. OS detection determines the entire tool chain. AD tools against Linux is wasted time.

New in v0.2.158 — Commands you should know

Command What it does Why it matters
yara_marketplace list Browse 10 built-in YARA rules (ransomware, C2, webshells, privesc) Signature-based threat detection
nuclei_marketplace list Browse 500+ Nuclei templates Automated vulnerability scanning
auto_pwn Autonomous kill-chain walk Recon to exploitation without manual steps
hunt Threat-informed discovery Maps known TTPs to discovered services
yara_scan <file> Scan files/dirs with YARA rules Malware and IoC detection
nuclei Run Nuclei templates against rhost CVD/CVE vulnerability scanning
marketplace update Update all addons/plugins/tools/rules Keep your toolkit current
collab_join handle Print team dashboard URL Multi-operator collaboration
encrypt / decrypt PBKDF2HMAC + Fernet file crypto Secure session data
campaign_sitrep Full situation report Current state at a glance

Where the full lists live

Need File
50 frequent commands by goal CHEATSHEET.md
All 748 commands with descriptions COMMANDS.md (auto-generated)
All 126 aliases COMMANDS.md alias section
Full MCP tool reference (153 tools) skills/lazyown.md
Architecture and dev reference CLAUDE.md
Honest framework comparison COMPARISON.md

Generated offline by readmenator from commit bb49626e7e46. Edits here are overwritten by readmenator . --rebuild.

⚠️ **GitHub.com Fallback** ⚠️