Exploit for onyx-agent CVE-2024-3094

## https://sploitus.com/exploit?id=DC8DE265-190B-56E3-849F-5A54DD4833B8
# Onyx Agent v68

Multi-LLM agent framework for security testing, exploitation, and automation.
30+ free AI models, payload engine, exploit writer, auto-fallback.

## Install

```bash
pkg install python nmap git -y
pip install requests
git clone https://github.com/YOUR_USER/onyx-agent.git
cd onyx-agent
python main.py
```

## Quick Start

1. Run `python main.py`
2. Menu [3] - Set API keys (or use chat.z.ai models without keys)
3. Menu [4] - List available models
4. Menu [8] - Health check to test connectivity
5. Menu [1] - Start a task

## Models

- **GLM-5/4** (Zhipu) - free tier, generous limits
- **DeepSeek** (v3, R1, Coder) - 5M free tokens
- **Qwen** (Coder, Max, Turbo) - 1M free tokens
- **MiniMax** (M2, abab) - free tier
- **Groq** (Llama, DeepSeek-R1, Qwen) - ultra fast, generous free
- **OpenRouter** (free models) - no key needed for some
- **Gemini** (2.0 Flash) - 1500 req/day
- **chat.z.ai** (GLM) - free, no API key

## Free API Keys

| Service | URL | Free Tier |
|---------|-----|-----------|
| GLM | https://open.bigmodel.cn | generous |
| Groq | https://console.groq.com | ultra fast |
| Gemini | https://aistudio.google.com | 1500/day |
| DeepSeek | https://platform.deepseek.com | 5M tokens |
| Qwen | https://dashscope.aliyun.com | 1M tokens |
| OpenRouter | https://openrouter.ai | free models |

## Features

- 30+ AI models, switchable per task
- Auto-fallback when one model fails
- 20+ payload types (reverse shell, XSS, SQLi, LFI, RCE, SSRF, XXE...)
- 6 injection vectors (URL, header, cookie, user-agent, POST, file)
- Exploit writing with save to disk
- nmap integration
- CVE web search (DuckDuckGo)
- Session memory persistence
- Long-term target tracking
- Report export (markdown)
- Termux/phone optimized
- Back button on every screen

## Tools Available to Agent

- `shell` - execute any command
- `write_file` / `read_file` - file operations
- `web_search` - DuckDuckGo search
- `payload` - generate 20+ payload types
- `inject` - inject into URL/header/cookie/etc
- `exploit` - write exploit scripts
- `encode` - base64/url/hex
- `nmap` - network scanning
- `install` - install packages

## Task Types

- `code` - prioritize coding models (qwen, deepseek)
- `reasoning` - prioritize reasoning (deepseek-r1)
- `general` - balanced
- `fast` - prioritize speed (groq)
- `free_no_key` - only no-key models

## Usage

```bash
# Run
python main.py

# Quick task
> scan 192.168.1.1 for open ports

# Research CVE
> research CVE-2024-3094 xz backdoor and write PoC

# Generate payload
> generate reverse shell on port 9001

# Write exploit
> write python exploit for SQLi in login form
```

## File Structure

```
onyx-agent/
├── main.py              # TUI entry point
├── agent.py             # OnyxAgent core
├── llm_router.py        # 30+ model router
├── glm_web.py           # chat.z.ai bypass
├── exploit_engine.py    # Payload + exploit engine
├── fallback.py          # Auto-fallback chain
├── memory.py            # Session persistence
├── streaming.py         # Response streaming
└── payloads/            # Saved payloads
    ├── exploits/        # Saved exploits
    ├── reports/         # Pentest reports
    └── .memory/         # Session state
```

## License

For research and authorized testing only.