---
title: "[bojemoi] feat(borodino/uzi): SEQ1/SEQ2 architecture + C2 callback + fix pivot ShellSession"
date: 2026-04-30T21:55:31+02:00
draft: false
tags: ["commit", "bojemoi", "main"]
categories: ["Git Activity"]
summary: "Commit 53bb913 par Betty dans bojemoi"
author: "Betty"
---

## Commit `53bb913`

| | |
|---|---|
| **Repository** | bojemoi |
| **Branch** | `main` |
| **Author** | Betty |
| **Hash** | `53bb913032eaf510d856276051054227cde91f27` |


### Description

- Restructure main loop: SEQ1 brute force (paramiko password-only) → SEQ2 vuln search
- SEQ1 debug: reads host_debug sequentially, forced password auth via paramiko
  (look_for_keys=False, allow_agent=False)
- deploy_c2_callback(): detect arch via uname -m, msfvenom ELF, SFTP to
  /var/tmp/.update-notifier, nohup exec, cron persistence (*/20 + @reboot)
- SEQ2: per-service exploit loop (build_targeted_exploits per service, break on session)
- Fix exploit selection: HTTP terms always added when ports 80/443/8080/8443 open
- Fix build_profile_filter: HTTP path patterns added when HTTP ports open
- Fix pivot: ShellSession.run_with_output() requires end_strs positional arg —
  branch on stype (meterpreter vs shell) for network enum calls
- Rename faraday_ok → dojo_ok in uzi_scan_log (faraday removed, DefectDojo active)
- Add paramiko pip install in Dockerfile.borodino-msf (after adduser, cache preserved)
- Add dedicated uzi SEQ1/SEQ2 chapter in ARCHITECTURE.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

### Files Changed

```
M	ARCHITECTURE.md
M	borodino/Dockerfile.borodino-msf
M	borodino/thearm_uzi
```

### Diff Summary

```
 ARCHITECTURE.md                  | 119 ++++++++++
 borodino/Dockerfile.borodino-msf |   2 +
 borodino/thearm_uzi              | 459 +++++++++++++++++++++++++++++++--------
 3 files changed, 487 insertions(+), 93 deletions(-)
```