hotfixing

Author: grisuno

lazyown.py

@@ -914,8 +914,10 @@ def cmd(self, line):
         if NOLOGS:
             exit_code = subprocess.call(command, shell=True)
         else:
+            safe_cmd_name = os.path.basename(cmd_name)
+            safe_domain = re.sub(r"[^A-Za-z0-9._-]", "_", domain) if domain else "unknown"
             path_command = (
-                f"{path}/sessions/logs/command_{cmd_name}output{domain}.txt"
+                f"{path}/sessions/logs/command_{safe_cmd_name}output{safe_domain}.txt"
             )
             quoted_path = shlex.quote(path_command)
             exit_code = subprocess.call(

modules/lazybotnet.py

@@ -179,6 +179,11 @@ def handle_client(conn, key, botnet_file, log_file):
         conn.close()
 
 def start_server(host, port, key, botnet_file, log_file):
+    if host in ("", "0.0.0.0", "::"):
+        raise ValueError(
+            f"Refusing to bind to wildcard address {host!r}. "
+            "Pass a specific interface IP via --host (e.g. 127.0.0.1)."
+        )
     server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     server.bind((host, port))
     server.listen(5)
@@ -192,7 +197,7 @@ def start_server(host, port, key, botnet_file, log_file):
 
 if __name__ == '__main__':
     parser = argparse.ArgumentParser(description='LazyOwnBotNet Server')
-    parser.add_argument('--host', default='0.0.0.0', help='Host to bind the server')
+    parser.add_argument('--host', default='127.0.0.1', help='Host to bind the server (use a specific interface IP, never 0.0.0.0 unless you really need to expose on all interfaces)')
     parser.add_argument('--port', type=int, default=12345, help='Port to bind the server')
     parser.add_argument('--key', required=True, help='Encryption key (hex encoded)')
     args = parser.parse_args()

modules/lazyhoneypot.py

@@ -32,7 +32,7 @@
 
 def parse_args():
     parser = argparse.ArgumentParser(description='SSH Honeypot')
-    parser.add_argument('--host', type=str, default='0.0.0.0', help='IP address to bind the honeypot')
+    parser.add_argument('--host', type=str, default='127.0.0.1', help='IP address to bind the honeypot (use a specific interface IP, never 0.0.0.0 unless you really need to expose on all interfaces)')
     parser.add_argument('--port', type=int, default=2222, help='Port to bind the honeypot')
     parser.add_argument('--downloads_dir', type=str, default='downloads', help='Directory to save downloaded files')
     parser.add_argument('--log_file', type=str, default='honeypot.log', help='Log file path')
@@ -160,6 +160,12 @@ def alert_admin(message):
 def main():
     args = parse_args()
 
+    if args.host in ("", "0.0.0.0", "::"):
+        raise ValueError(
+            f"Refusing to bind honeypot to wildcard address {args.host!r}. "
+            "Pass a specific interface IP via --host (e.g. 127.0.0.1)."
+        )
+
     setup_logging(args.log_file)
     generate_rsa_key('test_rsa.key')
     host_key = paramiko.RSAKey(filename='test_rsa.key')

modules/lazyownserver.py

@@ -107,9 +107,15 @@ def main():
     HOST = args.host
     PORT = args.port
     print(HOST)
-    print(PORT)    
+    print(PORT)
     KEY = binascii.unhexlify(args.key)
 
+    if HOST in ("", "0.0.0.0", "::"):
+        raise ValueError(
+            f"Refusing to bind RAT to wildcard address {HOST!r}. "
+            "Pass a specific interface IP via --host (e.g. 127.0.0.1)."
+        )
+
     s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     s.bind((HOST, PORT))
     s.listen(10)

requirements-ml.txt

@@ -27,7 +27,7 @@ scikit-learn==1.8.0
 scipy==1.17.1
 seaborn==0.13.2
 threadpoolctl==3.6.0
-torch==2.11.0
-torchaudio==2.11.0
-torchvision==0.26.0
+torch==2.12.1
+torchaudio==2.12.1
+torchvision==0.27.1
 triton==3.6.0

requirements.txt

@@ -49,7 +49,7 @@ commonmark==0.9.1
 construct==2.10.70
 contourpy==1.3.3
 coverage==7.13.5
-cryptography==46.0.6
+cryptography==49.0.0
 cssselect==1.4.0
 cssutils==2.15.0
 cycler==0.12.1
@@ -117,7 +117,7 @@ minikerberos==0.4.9
 more-itertools==11.0.2
 MouseInfo==0.1.3
 mpmath==1.3.0
-msgpack==1.1.2
+msgpack==1.2.1
 msldap==0.5.15
 mypy==1.20.2
 mypy_extensions==1.1.0
@@ -136,7 +136,7 @@ packageurl-python==0.17.6
 packaging==26.2
 pandas==3.0.2
 paramiko-ng==2.9.0
-paramiko==4.0.0
+paramiko==5.0.0
 parso==0.8.6
 pathspec==1.1.1
 pdf2image==1.17.0
@@ -175,10 +175,10 @@ Pygments==2.20.0
 pykeepass==4.1.1.post1
 PyMsgBox==2.0.1
 PyNaCl==1.6.2
-pyOpenSSL==26.0.0
+pyOpenSSL==26.3.0
 pyotp==2.9.0
 pyparsing==3.3.2
-pypdf==6.1.1
+pypdf==6.14.2
 pyperclip==1.11.0
 pypykatz==0.6.13
 PyRect==0.2.0