Exploit for recon-arc

## https://sploitus.com/exploit?id=8317810A-AAB1-545D-983F-3FCEEA265753
# ReconARC 🔍

**Advanced Reconnaissance & Attack-path Ranking Console**

An LLM-powered enumeration agent for HackTheBox Academy labs and CTF environments. It scans both web and internal networks, identifies all potential attack vectors, and ranks them by likelihood of success — **without executing any exploit**. Instead, it provides detailed exploit suggestions and potential attack scenarios for privilege escalation and lateral movement.

## Features

- 🌐 **Full-spectrum enumeration**: Network discovery, port scanning, service fingerprinting, web app analysis, AD enumeration
- 🎯 **Attack vector ranking**: Heuristic + LLM-powered scoring of every discovered attack path
- 💡 **Exploit suggestions**: Specific commands and tools for each identified vector
- 🔒 **Exploit-free**: Never executes exploits, shells, or credential attacks — pure reconnaissance
- 🤖 **LLM-powered analysis**: Uses GLM-5.2 for strategic attack path analysis and ranking
- 📊 **Professional reports**: Generates Markdown reports with risk matrices and actionable next steps
- 💾 **Session save/resume**: Full state persistence for long-running engagements
- 🔌 **Offline mode**: `--no-llm` flag for fully heuristic-based operation

## Architecture

```
┌──────────────────────────────────────────────────────────┐
│                     enum_agent.py                         │
│                   (Entry point + Graph)                   │
├──────────┬──────────┬──────────┬──────────┬──────────────┤
│  scope   │discover  │enumerate │ analyze  │   report     │
│  (hub)   │ (nmap)   │ (deep)   │ (LLM)    │  (output)    │
├──────────┴──────────┴──────────┴──────────┴──────────────┤
│  Tools: recon │ web_enum │ ad_enum │ vuln_scan            │
├──────────────────────────────────────────────────────────┤
│  Core: state │ llm │ utils                                 │
└──────────────────────────────────────────────────────────┘
```

**Graph flow**: `scope → discover → enumerate → analyze → report`

The `scope_node` is the strategic hub. It routes to discovery, enumeration, or analysis nodes based on engagement state, then returns to itself for the next decision.

## Quick Start

```bash
# Install dependencies
pip install -r requirements.txt

# Set your GLM API key (or use --no-llm for offline mode)
export GLM_API_KEY="your-key-here"

# Run against a subnet
python3 enum_agent.py --subnet 10.10.10.0/24

# Or target specific hosts
python3 enum_agent.py --targets 10.10.10.5

# Offline mode (no LLM calls)
python3 enum_agent.py --subnet 10.10.10.0/24 --no-llm

# With engagement goals
python3 enum_agent.py --subnet 10.10.10.0/24 -g "Capture user.txt" "Get Domain Admin"

# Custom wordlist
python3 enum_agent.py --subnet 10.10.10.0/24 -w /usr/share/wordlists/dirb/big.txt

# Resume a previous session
python3 enum_agent.py --resume ~/projects/recon-arc/saves/20240101_120000.json
```

## What It Does

### Phase 1: Discovery
- Network sweep across accessible subnets (`nmap -sn`)
- Quick top-1000 port scan with version detection
- AD domain controller detection (ports 88, 389, 464, 636, 3268)

### Phase 2: Enumeration (per host)
- **Full TCP port scan** with `nmap -p- -sV -sC`
- **Service deep-dives**: SSH algorithms, SMB shares, FTP anonymous, RDP encryption, LDAP rootDSE, SMTP commands
- **Web application analysis**:
  - Technology fingerprinting (CMS, frameworks, JS libs, server)
  - Directory busting with gobuster
  - Config file exposure checks (.env, .git, wp-config, web.config, etc.)
  - Form and input field discovery
  - API endpoint discovery (Swagger/OpenAPI, GraphQL)
  - SQLi injection point identification (passive)
  - Email/username extraction
  - HTML comment analysis
  - Vhost brute-forcing
  - SSL certificate SAN extraction
- **AD enumeration** (null session only):
  - Domain user enumeration (LDAP + rpcclient + CrackMapExec)
  - Domain groups
  - Computer accounts
  - SPN discovery (Kerberoasting targets identified)
  - ADCS Certificate Authority discovery
  - SMB share enumeration
  - SMB signing status
- **ExploitDB search** (`searchsploit`) for all service versions

### Phase 3: Attack Path Analysis (LLM)
- GLM-5.2 analyzes all findings and generates:
  - Top 5 ranked attack paths
  - Exploit suggestions for each path
  - Privilege escalation recommendations
  - Lateral movement opportunities
  - Missing intelligence gaps

### Phase 4: Report
- Professional Markdown report with:
  - Executive summary
  - Attack path ranking table
  - Exploit suggestions with commands
  - Privilege escalation paths
  - Lateral movement opportunities
  - Risk matrix

## Attack Vector Categories

| Category | Description | Examples |
|----------|-------------|----------|
| `initial_access` | Getting the first foothold | SQLi, XSS, RCE, config exposure, anonymous FTP |
| `privesc` | Privilege escalation | SUID binaries, SeImpersonate, kernel exploits |
| `lateral` | Moving between hosts | SMB relay, RDP, WinRM, credential reuse |
| `ad_attack` | Active Directory attacks | AS-REP roasting, Kerberoasting, ADCS ESC, DCSync |

## Key Differences from a Pentest Agent

| Feature | Pentest Agent | ReconARC |
|---------|--------------|----------|
| Port scanning | ✅ | ✅ |
| Service enumeration | ✅ | ✅ |
| Exploit execution | ✅ | ❌ |
| Credential brute force | ✅ | ❌ |
| Reverse shells | ✅ | ❌ |
| Password cracking | ✅ | ❌ |
| Attack path ranking | ❌ | ✅ |
| Exploit suggestions | ❌ | ✅ |
| AD user enumeration | ✅ | ✅ (null session only) |
| Session save/resume | ✅ | ✅ |

## Configuration

### GLM API Key
```bash
# Option 1: Environment variable
export GLM_API_KEY="your-key"

# Option 2: .env file in project root
echo 'GLM_API_KEY=your-key' > .env

# Option 3: Use ~/.hermes/profiles/glm/.env (auto-detected)
```

### Wordlists
The agent uses the wordlist specified by `--wordlist` (default: `/usr/share/wordlists/dirb/common.txt`). Recommended alternatives:
- `/usr/share/wordlists/dirb/big.txt` — more thorough
- `/usr/share/wordlists/raft-small-words.txt` — good balance
- `/usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-files.txt` — comprehensive

## Required System Tools

| Tool | Purpose | Required? |
|------|---------|-----------|
| nmap | Port scanning, service enum | ✅ |
| gobuster | Directory busting | ✅ |
| curl | HTTP requests | ✅ |
| openssl | SSL cert analysis | ✅ |
| searchsploit | ExploitDB search | Recommended |
| smbclient | SMB enumeration | For AD targets |
| ldapsearch | LDAP enumeration | For AD targets |
| rpcclient | RPC enumeration | For AD targets |

Install on Kali/Parrot:
```bash
sudo apt install nmap gobuster curl openssl exploitdb smbclient ldap-utils samba-common-bin
```

## Output

Reports are saved to `output/report_.md` and include:
- Full attack surface summary
- Ranked attack vectors with scores
- Specific exploit commands
- Privilege escalation recommendations
- Credential discovery results
- Missing intelligence gaps

Session state is saved to `saves/.json` for resume capability.

## Legal & Ethical Use

This tool is designed for:
- ✅ HackTheBox Academy labs
- ✅ CTF competitions
- ✅ Authorized penetration tests
- ✅ Security education

**Only use against networks you own or have explicit written permission to test.**

## License

MIT — see [LICENSE](LICENSE)

---

Built for HTB Academy labs by [WarrantBdoesZT](https://github.com/WarrantBdoesZT)