Exploit for autopenx

## https://sploitus.com/exploit?id=3401ECFA-1BF5-560B-BA4E-CECDE5B4E76E
# AutoPenX – A fully automated CTF-solving & penetration testing system powered by LLMs

> **Three-phase hybrid solving architecture**: Deterministic multi-agent route state machine → Parallel LLM computation → Sequential ReAct reasoning, achieving zero API overhead for fast problem-solving + deep LLM reasoning for robustness. ---

## System Architecture Overview

```
┌─────────────────────────────────────────────────────────────┐
│  CTFReActAgent.solve(multi_agent=True)                      │
│                                                             │
│  Phase 1: MultiAgentOrchestrator (Deterministic, 0 API overhead)       │
│  ┌─────────────────────────────────────────────────────┐    │
│  │ ReconAgent → Finger recognition → Route evidence collection     │    │
│  │ CoordinatorAgent → Selection of optimal route             │    │
│  │ ExploitAgent → RouteStateMachine → Flag?                   │    │
│  │ CriticAgent → Repetitive detection + route switching           │    │
│  │ KnowledgeLearner → Matching known patterns                   │    │
│  └─────────────────────────────────────────────────────┘    │
│                                                             │
│  Phase 2: Parallel LLM Racing (3 workers × 5 turns)         │
│  ┌─────────────────────────────────────────────────────┐    │
│  │ Worker 1 (DeepSeek): SQLi + authentication direction     │    │
│  │ Worker 2 (OpenAI): LFI + SSTI direction                    │    │
│  │ Worker 3 (Claude): CMDi + upload direction                │    │
│  │ The first worker to find a flag wins → Disqualification of others   │    │
│  └─────────────────────────────────────────────────────┘    │
│                                                             │
│  Phase 3: Sequential LLM ReAct (Remaining budget)                   │
│  ┌─────────────────────────────────────────────────────┐    │
│  │ Complete set of tools: http_request, run_python,                 │    │
│  │ repl_execute, scan_flag, file_analyze, etc.              │    │
│  │ Multiple rounds of reasoning + response analysis            │    │
│  └─────────────────────────────────────────────────────┘    │
└─────────────────────────────────────────────────────┘
```

---

## ✨ Key Features

- **Three-phase hybrid solving**: Phase 1: Deterministic route finding (zero API overhead) → Phase 2: Parallel LLM computation → Phase 3: Sequential ReAct reasoning
- **15 route state machines**: source_leak, lfi, ssti, sqli, cmdi, jwt, upload, php_pop, ssrf, idor, xss, graphql, websocket, xxe, auth_logic
- **Multi-agent collaboration**: Four roles – Coordinator, Recon, Exploit, Critic – sharing state via Blackboard
- **12 LLM tools**: http_request, run_python, repl_execute, scan_flag, decode_data, file_analyze, recon_scan, ctf_knowledge_search, write_tool_script, run_tool_script, install_python_package, download_tool_url

--- **Self-Evolution Knowledge Base**: Automatically extracts patterns after solving problems, allowing direct access to similar questions next time.  
--- **Multi-Model Support**: Parallel competition between DeepSeek, OpenAI, and Claude; stops as soon as a flag is detected.  
--- **Flag Detection Pipeline**: Regularization → Heuristic → AI Verification; three-level filtering reduces false positives.  
--- **Web UI**: FastAPI + SSE for real-time display of problem-solving processes.  
--- **30 Real CTF Challenges**: Based on classic BUUCTF challenges for local reproduction.  
--- **12 Strict Benchmark Tests**: Covering all major types of vulnerabilities.  

--- **🚀 Quick Start**  
--- **Environment Requirements**  
Python 3.10+  
Windows/Linux/MacOS  
--- **Installation**  
`powershell`  
  - Clone the project: `cd C:\Users\86181\Desktop\AutoPenX`  
  - Create a virtual environment: `python -m venv .venv`.  
  - Activate the virtual environment: `source .venv/bin/activate` (Windows PowerShell) / `cp .env.example .env` and edit it to include `DEEPSEEK_API_KEY`.  
--- **Windows One-Click Script**  
  - `InstallDependencies.bat` – Initializes the virtual environment and installs dependencies.  
  - `One-ClickStartUI.bat` – Starts the Web UI and opens a browser automatically.  
  - `One-ClickScan.bat` – Scans in command-line mode.  
--- **Running CTF Challenges**  
  ```powershell
  # Multi-Agent Mode (Recommended)
  python run_ctf_solve.py
  # Or specify a target directly
  python -c"
    import asyncio
    from autopnex.ctf.react_agent import CTFReActAgent
    from configSettings import settings

    agent = CTFReActAgent(
        target='http://target-url:port',
        challenge_type='web',
        max_iterations=30,
        multi_agent=True,
        runtime_config=settings.snapshot(),
    )
    result = asyncio.run(agent.solve())
    print(f'Flag: {result.get("flag")}')
  "`
--- **Starting the Web UI**  
  ```powershell
  .venv\Scripts\python -m uvicorn autopnex.web.api:app --reload --host 127.0.0.1 --port 8000
  ```
  Open a browser and visit http://127.0.0.1:8000/
--- **Traditional Penetration Testing**  
  ```powershell
  # LLM Mode
  python autopnex.py --target http://testphp.vulnweb.com
  # Offline Rule Mode (No API Key Required)
  python autopnex.py --target http://testphp.vulnweb.com --mock --yes
--- **Running Benchmark Tests**  
  ```powershell
  # Strict 12-Benchmark Test (Deterministic Approach, No API Key Required)
  pytest tests/benchmark/test_web_benchmark.py -v
  # 30 Real CTF Benchmarks
  pytest tests/benchmark/test_real_ctf.py -v
  # Exploratory Mode (21 Challenges, Testing Route Coverage)
  pytest tests/benchmark/test_web_benchmark_explore.py -v
  # All Unit Tests
  pytest tests/ -v --ignore=tests/benchmark
  # Smoke Tests (Quickly Verifying Core Features)
  pytest tests/benchmark/test_web_benchmark_smoke.py -v
--- **Project Structure**  
  `AutoPenX/`
  │   ├── autopnex/
  │   │   ├── ctf/                          # CTF-solving core engine
  │   │   ├── multi_agent.py              # Multi-agent orchestrator + 4 agents
  │   │   ├── route_state_machine.py     # 13 route state machines + factory
  │   │   ├── routes/                    # Modular route packages (15 route files)
  │   │   │   ├── source_leak.py           # Source leak routes
  │   │   │   ├── lfi.py                  # Local file inclusion
  │   │   │   ├── ssti.py                 # Template injection
  │   │   │   ├── sqli.py                 # SQL injection

│   │   │   ├── cmdi.py               # Command injection  
│   │   │   ├── jwt.py                # JWT spoofing  
│   │   │   ├── upload.py             # File upload  
│   │   │   ├── php_pop.py            # PHP deserialization  
│   │   │   ├── ssrf.py               # SSRF  
│   │   │   ├── idor.py               # Privilege escalation  
│   │   │   ├── xss.py                # XSS  
│   │   │   ├── graphql.py            # GraphQL injection  
│   │   │   ├── websocket.py          # WebSocket bypass  
│   │   │   ├── xxe.py                # XXE injection  
│   │   │   └── auth_logic.py         # Authentication logic bypass  
│   │   ├── react_agent.py            # CTFReActAgent (LLM ReAct loop)  
│   │   ├── tool_router.py            # Tool definition + execution gateway  
│   │   ├── web_state_blackboard.py   # Shared state board  
│   │   ├── knowledge_learner.py      # Self-evolving knowledge learner  
│   │   ├── flag_engine.py            # Flag detection engine  
│   │   ├── prompt_compiler.py        # Prompt compiler  
│   │   ├── workers.py                # Parallel LLM Workers  
│   │   └── ... │   ├── orchestrator/                 # LLM client layer  
│   │   ├── llm_client.py             # DeepSeek/OpenAI compatible client  
│   │   ├── mock_brain.py             # Offline rule engine  
│   │   └── orchestrator.py           # Traditional penetration orchestrator  
│   ├── tools/                        # Toolset  
│   │   ├── recon/                    # Reconnaissance tools  
│   │   ├── scan/                     # Scanning tools  
│   │   ├── vuln/                     # Vulnerability detection  
│   │   ├── exploit/                  # Exploitation tools  
│   │   ├── ctf_web/                  # CTF Web-specific tools  
│   │   └── ctf_crypto/              # CTF Crypto tools  
│   ├── web/                          # Web UI  
│   │   ├── api.py                    # FastAPI backend + SSE  
│   │   └── static/                   # Front-end static files  
│   ├── state_machine/                # PTES state machine  
│   ├── evasion/                      # WAF bypass engine  
│   └── knowledge_base/               # Vulnerability fingerprint/payload library  
├── tests/  
│   ├── benchmark/  
│   │   ├── test_web_benchmark.py     # Strict 12 target benchmark  
│   │   ├── test_real_ctf.py          # 30 real CTF targets  
│   │   ├── challenges.py             # Battlefield implementations  
│   │   └── real_ctf_targets.py       # Real CTF targets registered  
│   └── ctf/                          # CTF engine unit tests  
├── config/  
│   └── settings.py                   # Configuration management  
├── run_ctf_solve.py                  # CTF solving CLI entry  
│   ├── autopnex.py                       # Traditional penetration CLI entry  
│   ├── ctf_knowledge.json                # Self-evolving knowledge library  
│   ├── .env                              # Environment variable configuration  
│   └── requirements.txt                  # Python dependencies

---

## ⚙️ Configuration Instructions

### `.env` Environment Variables

```bash
# ---- Required: Main LLM ----
DEEPSEEK_API_KEY=sk-xxx              # DeepSeek API Key
DEEPSEEK_BASE_URL=https://api.deepseek.com
DEEPSEEK_MODEL=deepseek-chat

# ---- Optional: Multiple models in parallel ----
OPENAI_API_KEY=                       # OpenAI API Key (Worker 2)
OPENAI_BASE_URL=https://api.openai.com/v1
OPENAI_MODEL=gpt-4o
CLAUDE_API_KEY=                       # Claude API Key (Worker 3)
CLAUDE_BASE_URL=https://api.anthropic.com/v1
CLAUDE_MODEL=claude-sonnet-4-20250514

# ---- Runtime Configuration ----
AUTOPENX_SCAN_MODE=active             # passive | active
AUTOPENX_MAX_ITER_PER_STATE=6         # Maximum iterations per state
AUTOPENX_HTTP_TIMEOUT=8               # HTTP timeout seconds
AUTOPENX_REQUEST_DELAY=0.0            # Request interval (seconds)

# ---- WAF Bypass ----
AUTOPENX_EVASION_ENABLED=false        # Enable bypass engine
AUTOPENX_WAF_BYPASS_LEVEL=none        # none | light | aggressive

# ---- CTF Tool Management ----
AUTOPENX_CTF_AUTO_TOOLING_ENABLED=true   # Allow LLM to write scripts
AUTOPENX_CTF_TOOL_INSTALL_ENABLED=true   # Allow pip install
AUTOPENX_CTF_WORKSPACE_DIR=ctf_workspace # Working directory
```

---

## 🔧 How to Extend

### Adding New Routes

1. Create a new file under `autopnex/ctf/routes/` (e.g., `nosql.py`).
2. Inherit from `RouteStateMachine` and implement `preconditions_met()`, `get_probes()`, `score_evidence()`, and `get_exploit_steps()`.
3. Register it in `autopnex/ctf/routes/registry.py`.
4. Add a priority in `CoordinatorAgent.ROUTE_PRIORITY`.

### Adding New CTF Targets

1. Add a new Target class in `tests/benchmark/real_ctf_targets.py` (or `_real_ctf_extra.py`).
2. Implement properties like `start()`, `stop()`, `url`, `flag`, `name`, and `category`.
3. Register it in the `REAL_CTF_TARGETS` dictionary.

### Adding New LLM Tools

1. Add an OpenAI function schema in the `TOOL_DEFINITIONS` list of `autopnex/ctf/tool_router.py`.
2. Add corresponding execution branches in the `ToolRouter.execute()` method.
3. Add the tool name to the `CORE_TOOL_NAMES` collection.

---

## 📊 Current Capabilities

| Metric | Value |
|-------|-------|
| Strict benchmark success rate | 12/12 (100%) |
| Real CTF success rate | 30/30 (100%) |
| Number of supported routes | 15 |
| Number of LLM tools | 12 |
| Average number of attempts | ~5 attempts |
| Average time to solve | ~1.5s (local targets) |

### Vulnerability Types Covered

SQL injection, File Inclusion (LFI), Template Injection (SSTI), Command Injection (CMDi), JWT Forgery, File Uploading, PHP Deserialization, SSRF, IDOR Elevation, XSS, GraphQL Injection, WebSocket Bypass, XXE Injection, Authentication Bypass, Source Code Leakage

---

## 🛠️ Technology Stack

| Level | Technologies |
|------|-------|
| Language | Python 3.12 |
| LLM | DeepSeek V3 / GPT-4o / Claude (OpenAI-compatible protocol) |
| Web Framework | FastAPI + Uvicorn |
| HTTP Client | requests + aiohttp |
| Testing Framework | pytest + hypothesis |
| Frontend | Native HTML/JS + SSE |
| Configuration | python-dotenv |
| Templates | Jinja2 |

---

## ⚠️ Laws and Permissions

This tool is intended only for educational purposes, CTF competitions, and authorized penetration testing. Unauthorized use of systems is illegal, and any consequences are the responsibility of the user.