37 lines
2.7 KiB
Markdown
37 lines
2.7 KiB
Markdown
# NexusOps — Feature Push: Attack Plan (2026-09-30)
|
|
|
|
## Progress tracker — resume here if cut off
|
|
| # | Feature | Status |
|
|
|---|---------|--------|
|
|
| 0 | ATTACK-PLAN.md committed | DONE (this commit) |
|
|
| 1 | Pivot mode — single-shot TCP fetch through a node (`pivot_fetch` action + drawer form) | TODO |
|
|
| 2 | Clipboard capture (poll xclip/pbpaste/Get-Clipboard into input capture) | TODO |
|
|
| 3 | File watcher exfil (agent action `watch_dir`, new files auto-exfil) | TODO |
|
|
| 4 | Self-destruct TTL — 14 days from activation, wipes self + persistence | TODO |
|
|
| 5 | Dead-drop failover — fallback callback URLs in register response + agent failover | TODO |
|
|
| 6 | LLM analyst — /api/nodes/:id/brief via nightmare Ollama (qwen3.8fast:16k, think:false) | TODO |
|
|
| 7 | Credential decrypt — Firefox key4.db (3DES/openssl) + Linux Chromium v10 (peanuts) in agent; GPU brute queue dir + nightmare worker script | TODO |
|
|
| 8 | Topology map — /api/topology from lateral scan outputs + SVG graph page | TODO |
|
|
| 9 | Telegram important alerts — server alert levels (critical only) + NEXUS_ALERT_WEBHOOK to n8n | TODO |
|
|
| 10 | README update + final commit/push + verify | TODO |
|
|
|
|
## Key decisions
|
|
- Everything stdlib-only in the agent (openssl CLI used for 3DES/AES where needed).
|
|
- LLM endpoint: http://10.30.20.29:11434 (nightmare), model qwen3.8fast:16k, think:false. NEVER other hosts.
|
|
- GPU decrypt: jobs dropped in /opt/nexus-decrypt-queue on CT111; worker script for nightmare hashcat (4080S) provided, wired later.
|
|
- Webhook: only CRITICAL events (kill switch, creds harvested, node offline >15min, new node). URL: n8n on .239:5678 (workflow may need creation there).
|
|
- TTL default 14 days, stored as activation stamp file next to agent (~/.nexus_agent_activated), env override NEXUS_TTL_DAYS.
|
|
- Commit + git push gitea after EVERY feature. Rebuild baked binary after final agent change. Purge CF cache for /agent.py after agent changes.
|
|
- Test node: mizar canary CT171 (10.30.20.152), agent v2.3.0. Bump to v2.4.0 in this push.
|
|
|
|
## Verification per feature
|
|
1. pivot_fetch: curl via node to 127.0.0.1:3000 returns dashboard HTML.
|
|
2. clipboard: copy string on a desktop box (skip on headless — code path tested by unit: call function directly).
|
|
3. watch_dir: create file in watched dir → appears in /api/files.
|
|
4. TTL: set NEXUS_TTL_DAYS=0 test → self-wipe executes (on a THROWAWAY copy, not the canary).
|
|
5. fallback: stop dashboard, agent retries fallback URL (check logs).
|
|
6. brief: curl endpoint returns LLM text.
|
|
7. decrypt: plant a Chromium v10 profile on canary, harvest, verify plaintext.
|
|
8. topology: after lateral scan, /api/topology has edges; page renders.
|
|
9. alerts: kill-switch test → webhook POST logged.
|