post: commit 53bb913 in bojemoi

content/posts/commits/2026-04-30-commit-53bb913.md

@@ -0,0 +1,54 @@
+---
+title: "[bojemoi] feat(borodino/uzi): SEQ1/SEQ2 architecture + C2 callback + fix pivot ShellSession"
+date: 2026-04-30T21:55:31+02:00
+draft: false
+tags: ["commit", "bojemoi", "main"]
+categories: ["Git Activity"]
+summary: "Commit 53bb913 par Betty dans bojemoi"
+author: "Betty"
+---
+
+## Commit `53bb913`
+
+| | |
+|---|---|
+| **Repository** | bojemoi |
+| **Branch** | `main` |
+| **Author** | Betty |
+| **Hash** | `53bb913032eaf510d856276051054227cde91f27` |
+
+
+### Description
+
+- Restructure main loop: SEQ1 brute force (paramiko password-only) → SEQ2 vuln search
+- SEQ1 debug: reads host_debug sequentially, forced password auth via paramiko
+  (look_for_keys=False, allow_agent=False)
+- deploy_c2_callback(): detect arch via uname -m, msfvenom ELF, SFTP to
+  /var/tmp/.update-notifier, nohup exec, cron persistence (*/20 + @reboot)
+- SEQ2: per-service exploit loop (build_targeted_exploits per service, break on session)
+- Fix exploit selection: HTTP terms always added when ports 80/443/8080/8443 open
+- Fix build_profile_filter: HTTP path patterns added when HTTP ports open
+- Fix pivot: ShellSession.run_with_output() requires end_strs positional arg —
+  branch on stype (meterpreter vs shell) for network enum calls
+- Rename faraday_ok → dojo_ok in uzi_scan_log (faraday removed, DefectDojo active)
+- Add paramiko pip install in Dockerfile.borodino-msf (after adduser, cache preserved)
+- Add dedicated uzi SEQ1/SEQ2 chapter in ARCHITECTURE.md
+
+Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
+
+### Files Changed
+
+```
+M	ARCHITECTURE.md
+M	borodino/Dockerfile.borodino-msf
+M	borodino/thearm_uzi
+```
+
+### Diff Summary
+
+```
+ ARCHITECTURE.md                  | 119 ++++++++++
+ borodino/Dockerfile.borodino-msf |   2 +
+ borodino/thearm_uzi              | 459 +++++++++++++++++++++++++++++++--------
+ 3 files changed, 487 insertions(+), 93 deletions(-)
+```