blog/content/posts/commits/2026-04-30-commit-53bb913.md

title, date, draft, tags, categories, summary, author

title	date	draft	tags	categories	summary	author
[bojemoi] feat(borodino/uzi): SEQ1/SEQ2 architecture + C2 callback + fix pivot ShellSession	2026-04-30T21:55:31+02:00	false	commit bojemoi main	Git Activity	Commit 53bb913 par Betty dans bojemoi	Betty

Commit 53bb913

Repository	bojemoi
Branch	main
Author	Betty
Hash	53bb913032eaf510d856276051054227cde91f27

Description

• Restructure main loop: SEQ1 brute force (paramiko password-only) → SEQ2 vuln search
• SEQ1 debug: reads host_debug sequentially, forced password auth via paramiko (look_for_keys=False, allow_agent=False)
• deploy_c2_callback(): detect arch via uname -m, msfvenom ELF, SFTP to /var/tmp/.update-notifier, nohup exec, cron persistence (*/20 + @reboot)
• SEQ2: per-service exploit loop (build_targeted_exploits per service, break on session)
• Fix exploit selection: HTTP terms always added when ports 80/443/8080/8443 open
• Fix build_profile_filter: HTTP path patterns added when HTTP ports open
• Fix pivot: ShellSession.run_with_output() requires end_strs positional arg — branch on stype (meterpreter vs shell) for network enum calls
• Rename faraday_ok → dojo_ok in uzi_scan_log (faraday removed, DefectDojo active)
• Add paramiko pip install in Dockerfile.borodino-msf (after adduser, cache preserved)
• Add dedicated uzi SEQ1/SEQ2 chapter in ARCHITECTURE.md

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

Files Changed

M	ARCHITECTURE.md
M	borodino/Dockerfile.borodino-msf
M	borodino/thearm_uzi

Diff Summary

 ARCHITECTURE.md                  | 119 ++++++++++
 borodino/Dockerfile.borodino-msf |   2 +
 borodino/thearm_uzi              | 459 +++++++++++++++++++++++++++++++--------
 3 files changed, 487 insertions(+), 93 deletions(-)