nexusops-dashboard/ATTACK-PLAN.md

NexusOps — Feature Push: Attack Plan (2026-09-30)

Progress tracker — resume here if cut off

#	Feature	Status
0 ✅	ATTACK-PLAN.md committed	DONE (this commit)
1 ✅	Pivot mode — single-shot TCP fetch through a node (pivot_fetch action + drawer form)	DONE
2 ✅	Clipboard capture (poll xclip/pbpaste/Get-Clipboard into input capture)	DONE
3 ✅	File watcher exfil (agent action watch_dir, new files auto-exfil)	DONE
4 ✅	Self-destruct TTL — 14 days from activation, wipes self + persistence	DONE
5 ✅	Dead-drop failover — fallback callback URLs in register response + agent failover	DONE
6 ✅	LLM analyst — /api/nodes/:id/brief via nightmare Ollama (qwen3.8fast:16k, think:false)	DONE
7 ✅	Credential decrypt — Firefox key4.db (3DES/openssl) + Linux Chromium v10 (peanuts) in agent; GPU brute queue dir + nightmare worker script	DONE
8 ✅	Topology map — /api/topology from lateral scan outputs + SVG graph page	DONE
9 ✅	Telegram important alerts — server alert levels (critical only) + NEXUS_ALERT_WEBHOOK to n8n	DONE
10 ✅	README update + final commit/push + verify	DONE

Key decisions

• Everything stdlib-only in the agent (openssl CLI used for 3DES/AES where needed).
• LLM endpoint: http://10.30.20.29:11434 (nightmare), model qwen3.8fast:16k, think:false. NEVER other hosts.
• GPU decrypt: jobs dropped in /opt/nexus-decrypt-queue on CT111; worker script for nightmare hashcat (4080S) provided, wired later.
• Webhook: only CRITICAL events (kill switch, creds harvested, node offline >15min, new node). URL: n8n on .239:5678 (workflow may need creation there).
• TTL default 14 days, stored as activation stamp file next to agent (~/.nexus_agent_activated), env override NEXUS_TTL_DAYS.
• Commit + git push gitea after EVERY feature. Rebuild baked binary after final agent change. Purge CF cache for /agent.py after agent changes.
• Test node: mizar canary CT171 (10.30.20.152), agent v2.3.0. Bump to v2.4.0 in this push.

Verification per feature

1. pivot_fetch: curl via node to 127.0.0.1:3000 returns dashboard HTML.
2. clipboard: copy string on a desktop box (skip on headless — code path tested by unit: call function directly).
3. watch_dir: create file in watched dir → appears in /api/files.
4. TTL: set NEXUS_TTL_DAYS=0 test → self-wipe executes (on a THROWAWAY copy, not the canary).
5. fallback: stop dashboard, agent retries fallback URL (check logs).
6. brief: curl endpoint returns LLM text.
7. decrypt: plant a Chromium v10 profile on canary, harvest, verify plaintext.
8. topology: after lateral scan, /api/topology has edges; page renders.
9. alerts: kill-switch test → webhook POST logged.