Sploitus

Exploit for HermesPentBox

githubexploit Β· 2026-08-09

Exploit Code

README105 lines
## https://sploitus.com/exploit?id=5EC26B7C-2309-5747-8F37-41B8DA43BA5C
# HermesPentBox β€” AI Pentest Workbench

> **Language**: English | [δΈ­ζ–‡ζ–‡ζ‘£](README_cn.md)

An Electron-based desktop penetration testing workbench: built-in MITM traffic proxy, browser control (Chrome CDP / Firefox), and a swarm of parallel sub-agents for traffic analysis and targeted API exploitation β€” all local, zero-config integration with the Hermes agent.

> For **authorized** testing only (client contracts / SRC bug bounty / self-hosted labs). You are responsible for having legal authorization for every target.

---

## Features

- **MITM traffic proxy** (default port 8899): HTTP/HTTPS transparent proxy with built-in CA (`PentBox MITM Root CA`), WebSocket frame-level capture
- **Browser control**: Chrome CDP (port 9334) / Firefox one-click takeover, browser traffic auto-merges into the traffic panel
- **Sub-agent swarm analysis**: 10 parallel agent slots, traffic load-balanced for vuln detection / sensitive-info extraction / Nday hints
- **Penetration advice cards**: sub-agents push advice cards; clicking "θΏ›θ‘ŒζΈ—ι€" adopts the advice for that **single API** (strict single-URL scope, no site-wide expansion)
- **Execution via local Hermes Gateway**: official `api_server` (`POST /v1/runs` β†’ SSE aggregation β†’ `POST /v1/runs/{id}/stop` graceful cancel, no process killing)
- **Vulnerability library**: penetration results auto-written as structured VULNDOC (title / severity / reproduction / raw request-response); result card replaces the advice card and persists
- **Global intelligence**: analysis conclusions / pentest results / cancel records aggregated and injected into subsequent sub-agents (dedup: Host + full path + method)
- **Repeater**: HTTP/HTTPS/WS auto protocol detection, multi-tab, Burp-style UX
- **Site map**: aggregated traffic view grouped by domain/path
- **Per-agent chat window**: talk to an individual sub-agent to inspect details

## Architecture

```
Browser (Chrome CDP / Firefox)
   β”‚ traffic
   β–Ό
MITM Proxy (8899) ──► Traffic panel / Site map
   β”‚ analysis queue
   β–Ό
10 Γ— Sub-agents (hermes chat -q, load-balanced)
   β”‚ advice (SSE)
   β–Ό
Advice card β”€β”€γ€ŒθΏ›θ‘ŒζΈ—ι€γ€β”€β”€β–Ί Local Hermes Gateway (8642 api_server)
   β”‚                            POST /v1/runs + SSE events + POST stop
   β–Ό
Vulnerability library (VULNDOC) / Global intelligence digest
```

- **Main API**: 8877 (HTTP + SSE event stream)
- **Terminal WS**: 8878
- **Hermes Gateway**: `hermes gateway run` (auto-started, api_server platform, `API_SERVER_KEY` auth)

## Quick Start

### Requirements

- Node.js 24 (LTS)
- Hermes CLI (`hermes` on PATH) with a configured model provider

### Install & Run

```bash
npm install
npm run build     # esbuild bundle electron/main.ts β†’ out/main.cjs
npm start         # build + launch
# or directly:
npx electron .
```

First launch auto-starts: MITM proxy (8899), CA certificate generation, local Hermes Gateway (8642).

### Tests

```bash
node node_modules/tsx/dist/cli.mjs core/proxy.test.ts
node node_modules/tsx/dist/cli.mjs core/api.test.ts
```

> Tests bind ports (e.g. 8899) β€” quit the running app first.

## Configuration

| Item | Default | Description |
|---|---|---|
| API port | 8877 | Main HTTP API + SSE |
| Proxy port | 8899 | MITM proxy |
| CDP port | 9334 | Chrome remote debugging |
| Terminal WS | 8878 | Terminal panel |
| Gateway port | 8642 | Local Hermes api_server (auto-started) |
| Upstream proxy | 7890 | Optional (CN network) |
| Agent slots | 10 | Parallel analysis concurrency |

## Directory Structure

```
electron/main.ts       app entry (Electron main process)
core/proxy.ts          MITM proxy engine (CA generation/injection)
core/api.ts            main API server (traffic/analysis/pentest/vuln-lib/SSE)
core/browser.ts        Chrome CDP control
core/firefox.ts        Firefox control
core/ssh.ts            SSH terminal
core/persona.ts        sub-agent persona & prompts
ui/app.js              frontend (traffic panel / advice cards / vuln lib / repeater)
assets/                static assets & skill packs
```

## FAQ

- **EADDRINUSE**: leftover process holding a port β€” `taskkill /F /IM electron.exe`, clean PIDs per port, then relaunch
- **curl can't go through the proxy**: Windows schannel is incompatible with MITM β€” use `python urllib` + trust the PentBox CA
- **Sub-agent spinning for a long time**: penetration is a long-running task (multi-step verification is normal); if it looks stuck, click cancel (graceful stop via Gateway `POST /v1/runs/{id}/stop`)