drjones/linux-c2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: correct gap analysis — results pipelines work, frontend lacks Loot viewer

Browse Source
This commit is contained in:
root
2026-08-03 13:44:51 +00:00
parent 4444dd6aa5
commit 53d65f7a76
1 changed files with 27 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
PLAN.md
View File

@@ -6,16 +6,15 @@ Rule: remove no features. Only add and fix.
## PHASE 1 — FIX (make everything that exists actually work) ## PHASE 1 — FIX (make everything that exists actually work)
### 1.1 Screenshot pipeline (currently dead) ### 1.1 Screenshot/Exfil/Harvest results viewer (the real gap — pipelines WORK, results invisible)
- **server.js**: add `POST /api/agent/screenshot-result` — receives base64 PNG, stores in `exfiltratedFiles` map with `mime: image/png`, marks command completed, broadcasts. Verified: screenshot → `/api/agent/file-result` → `exfiltratedFiles` → `/api/files` ✅
- Add `GET /api/screenshots` + `GET /api/screenshots/:id` (thumbnail/full). Verified: harvest → `/api/agent/harvest-result` → `/api/credentials` ✅
- **Frontend**: new "Screenshots" section — grid of thumbnails, click to expand, per-node filter, download button. **The frontend has the trigger buttons (Exfil & Harvest tab) but NEVER fetches `/api/files` or `/api/credentials`.** Data lands server-side and goes invisible.
- Verify agent's `screenshot` action posts to the new endpoint; fix the URL in agent.py if it points at the wrong path. - New **Loot** section in the dashboard: two tabs (Files / Credentials).
- Files: table (node, filename, mime, size, time, download btn). Images (screenshots) get inline thumbnails + lightbox.
### 1.2 Files & Credentials UI (backend exists, zero UI) - Credentials: grouped by node+type, masked by default, click-to-reveal, copy button, CSV export (endpoint exists).
- New **Files** section: table of exfiltrated files (node, filename, size, time, download). Per-node filter. - Live-update both via the existing WebSocket broadcast (add files/creds summary counts to `NODES_UPDATE` payload, or poll on event).
- New **Credentials** section: grouped by node + type, redact-by-default with click-to-reveal, CSV export (endpoint already exists). - "Loot received" toast when a new file/cred batch arrives.
- Wire both into the existing WebSocket `NODES_UPDATE` payload so they live-refresh.
### 1.3 Dashboard auth (currently wide open) ### 1.3 Dashboard auth (currently wide open)
- Add session-token middleware to server.js: `NEXUS_AUTH_TOKEN` env var; on first load the UI asks for the token once, stores in localStorage, sends as `Authorization: Bearer`. - Add session-token middleware to server.js: `NEXUS_AUTH_TOKEN` env var; on first load the UI asks for the token once, stores in localStorage, sends as `Authorization: Bearer`.
@@ -81,9 +80,8 @@ Rule: remove no features. Only add and fix.
### 3.1 Scheduled commands ### 3.1 Scheduled commands
- `node-cron` in server: schedule raw/structured commands per node/tag on cron expressions. UI: simple scheduler panel (time picker + action + target). Persisted in SQLite. - `node-cron` in server: schedule raw/structured commands per node/tag on cron expressions. UI: simple scheduler panel (time picker + action + target). Persisted in SQLite.
### 3.2 Screenshot gallery + live view ### 3.2 Screenshot watch mode
- Gallery view (all nodes, timestamped thumbnails). - "Watch" mode: request screenshot every N seconds from one node, stream into the drawer (pseudo-live). Gallery itself ships with the Loot viewer in 1.1.
- "Watch" mode: request screenshot every N seconds from one node, stream into the drawer (pseudo-live).
### 3.3 Webhook alerts ### 3.3 Webhook alerts
- Config panel: webhook URL (n8n on .236 / Discord / generic). - Config panel: webhook URL (n8n on .236 / Discord / generic).
@@ -114,22 +112,21 @@ Rule: remove no features. Only add and fix.
|---|------|-------|--------| |---|------|-------|--------|
| 1 | Server + tunnel systemd units | 1.4 | 15 min | | 1 | Server + tunnel systemd units | 1.4 | 15 min |
| 2 | Dashboard auth token | 1.3 | 45 min | | 2 | Dashboard auth token | 1.3 | 45 min |
| 3 | Screenshot endpoint + UI | 1.1 | 1.5 h | | 3 | Loot viewer (files + creds + screenshot gallery) | 1.1 | 2 h |
| 4 | Files & Credentials UI | 1.2 | 1.5 h | | 4 | WebSocket reconnect | 1.6 | 30 min |
| 5 | WebSocket reconnect | 1.6 | 30 min | | 5 | Empty state + QR install | 1.8 | 45 min |
| 6 | Empty state + QR install | 1.8 | 45 min | | 6 | Atomic saves → SQLite | 1.5 | 2 h |
| 7 | Atomic saves → SQLite | 1.5 | 2 h | | 7 | Agent version + capability reporting | 1.7 | 1 h |
| 8 | Agent version + capability reporting | 1.7 | 1 h | | 8 | Design system + node cards + drawer | 2.1–2.2 | 3 h |
| 9 | Design system + node cards + drawer | 2.1–2.2 | 3 h | | 9 | Command builder + bulk targeting | 2.3 | 2 h |
| 10 | Command builder + bulk targeting | 2.3 | 2 h | | 10 | Shortcuts, toasts, skeletons, mobile | 2.4 | 2 h |
| 11 | Shortcuts, toasts, skeletons, mobile | 2.4 | 2 h | | 11 | Scheduled commands | 3.1 | 1.5 h |
| 12 | Scheduled commands | 3.1 | 1.5 h | | 12 | Webhook alerts | 3.3 | 1 h |
| 13 | Webhook alerts | 3.3 | 1 h | | 13 | Screenshot watch mode (live refresh in drawer) | 3.2 | 1 h |
| 14 | Screenshot gallery/watch | 3.2 | 1 h | | 14 | Tags/groups UI | 3.5 | 1.5 h |
| 15 | Tags/groups UI | 3.5 | 1.5 h | | 15 | Cross-platform binaries | 3.4 | 3 h |
| 16 | Cross-platform binaries | 3.4 | 3 h | | 16 | Audit/export upgrades | 3.6 | 1 h |
| 17 | Audit/export upgrades | 3.6 | 1 h | | 17 | Self-watchdog | 3.7 | 30 min |
| 18 | Self-watchdog | 3.7 | 30 min |
**Ship gate after Phase 1:** every existing feature demonstrably works end-to-end (screenshot round-trip, file exfil → download, creds → UI, auth on, services survive reboot). **Ship gate after Phase 1:** every existing feature demonstrably works end-to-end (screenshot → visible in Loot, exfil → download, creds → UI, auth on, services survive reboot).
**Ship gate after Phase 2:** a stranger could run the dashboard without asking how anything works. **Ship gate after Phase 2:** a stranger could run the dashboard without asking how anything works.