From 2113c7bf3862775774536b9a4f1b1aab9279a119 Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Wed, 11 Feb 2026 11:37:04 +0100 Subject: [PATCH] f --- .../workflows/ci-master-failure-codex-pr.yml | 73 ++++++++++-- .github/workflows/codex-pr-triage.yml | 105 ++++++++++++++---- .../workflows/pr-failure-codex-dispatch.yml | 73 ++++++++++-- .../13_Linux_exploit_suggester.sh | 39 ------- .../14_Linux_exploit_suggester_2.sh | 41 ------- .../2_container/6_Am_I_contained.sh | 20 ---- .../7_software_information/Leaks_git_repo.sh | 30 ----- 7 files changed, 211 insertions(+), 170 deletions(-) delete mode 100644 linPEAS/builder/linpeas_parts/1_system_information/13_Linux_exploit_suggester.sh delete mode 100644 linPEAS/builder/linpeas_parts/1_system_information/14_Linux_exploit_suggester_2.sh delete mode 100644 linPEAS/builder/linpeas_parts/2_container/6_Am_I_contained.sh delete mode 100644 linPEAS/builder/linpeas_parts/7_software_information/Leaks_git_repo.sh diff --git a/.github/workflows/ci-master-failure-codex-pr.yml b/.github/workflows/ci-master-failure-codex-pr.yml index 254252f..587aac1 100644 --- a/.github/workflows/ci-master-failure-codex-pr.yml +++ b/.github/workflows/ci-master-failure-codex-pr.yml @@ -96,14 +96,69 @@ jobs: echo "Leave the repo in a state ready to commit; changes will be committed and pushed automatically." } > codex_prompt.txt - - name: Run Codex - id: run_codex - uses: openai/codex-action@v1 + - name: Set up Python + uses: actions/setup-python@v5 with: - openai-api-key: ${{ secrets.OPENAI_API_KEY }} - prompt-file: codex_prompt.txt - sandbox: workspace-write - model: gpt-5.2-codex + python-version: "3.11" + + - name: Install chack-agent + run: | + python -m pip install --upgrade pip + python -m pip install -e chack-agent + + - name: Run Chack Agent + id: run_codex + env: + OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} + INPUT_PROVIDER: openai + INPUT_MODEL_PRIMARY: gpt-5.2-codex + INPUT_SYSTEM_PROMPT: You are an advanced research agent. + run: | + python - <<'PY' > chack_output.txt + import os + from chack_agent import ( + Chack, + ChackConfig, + ModelConfig, + AgentConfig, + SessionConfig, + ToolsConfig, + CredentialsConfig, + LoggingConfig, + ) + + with open("codex_prompt.txt", "r", encoding="utf-8") as handle: + user_prompt = handle.read() + + config = ChackConfig( + model=ModelConfig( + primary=os.environ.get("INPUT_MODEL_PRIMARY", "gpt-5.2-codex"), + provider=os.environ.get("INPUT_PROVIDER", "openai"), + ), + agent=AgentConfig( + main_action="github_action", + sub_action="run", + ), + session=SessionConfig(), + tools=ToolsConfig(exec_enabled=True), + credentials=CredentialsConfig( + openai_api_key=os.environ.get("OPENAI_API_KEY", ""), + ), + logging=LoggingConfig(level="INFO"), + system_prompt=os.environ.get("INPUT_SYSTEM_PROMPT", "You are an advanced research agent."), + env={}, + ) + + agent = Chack(config) + result = agent.run(session_id="github-action", text=user_prompt) + print(result.output) + PY + + { + echo "final-message<> "$GITHUB_OUTPUT" - name: Commit and push fix branch if changed id: push_fix @@ -114,9 +169,9 @@ jobs: exit 0 fi - rm -f codex_failure_summary.txt codex_prompt.txt codex_failed_steps_logs.txt + rm -f codex_failure_summary.txt codex_prompt.txt codex_failed_steps_logs.txt chack_output.txt git add -A - git reset -- codex_failure_summary.txt codex_prompt.txt codex_failed_steps_logs.txt + git reset -- codex_failure_summary.txt codex_prompt.txt codex_failed_steps_logs.txt chack_output.txt git commit -m "Fix CI-master failures for run #${{ github.event.workflow_run.id }}" git push origin HEAD:"$FIX_BRANCH" echo "pushed=true" >> "$GITHUB_OUTPUT" diff --git a/.github/workflows/codex-pr-triage.yml b/.github/workflows/codex-pr-triage.yml index f12fd5d..6e30f8f 100644 --- a/.github/workflows/codex-pr-triage.yml +++ b/.github/workflows/codex-pr-triage.yml @@ -80,35 +80,96 @@ jobs: ${{ steps.gate.outputs.base_ref }} \ +refs/pull/${{ steps.gate.outputs.pr_number }}/head - - name: Run Codex + - name: Set up Python + if: ${{ steps.gate.outputs.should_run == 'true' }} + uses: actions/setup-python@v5 + with: + python-version: "3.11" + + - name: Install chack-agent + if: ${{ steps.gate.outputs.should_run == 'true' }} + run: | + python -m pip install --upgrade pip + python -m pip install -e chack-agent + + - name: Run Chack Agent id: run_codex if: ${{ steps.gate.outputs.should_run == 'true' }} - uses: openai/codex-action@v1 - with: - openai-api-key: ${{ secrets.OPENAI_API_KEY }} - output-schema-file: .github/codex/pr-merge-schema.json - model: gpt-5.2-codex - prompt: | - You are reviewing PR #${{ steps.gate.outputs.pr_number }} for ${{ github.repository }}. + env: + OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} + INPUT_PROVIDER: openai + INPUT_MODEL_PRIMARY: gpt-5.2-codex + INPUT_SYSTEM_PROMPT: You are an advanced research agent. + run: | + cat <<'EOF' > chack_prompt.txt + You are reviewing PR #${{ steps.gate.outputs.pr_number }} for ${{ github.repository }}. - Decide whether to merge or comment. Merge only if all of the following are true: - - Changes are simple and safe (no DoS, no long operations, no backdoors). - - Changes follow common PEASS syntax and style without breaking anything and add useful checks or value. - - Changes simplify code or add new useful checks without breaking anything. + Decide whether to merge or comment. Merge only if all of the following are true: + - Changes are simple and safe (no DoS, no long operations, no backdoors). + - Changes follow common PEASS syntax and style without breaking anything and add useful checks or value. + - Changes simplify code or add new useful checks without breaking anything. - If you don't have any doubts, and all the previous conditions are met, decide to merge. - If you have serious doubts, choose "comment" and include your doubts or questions. - If you decide to merge, include a short rationale. + If you don't have any doubts, and all the previous conditions are met, decide to merge. + If you have serious doubts, choose "comment" and include your doubts or questions. + If you decide to merge, include a short rationale. - Pull request title and body: - ---- - ${{ steps.gate.outputs.pr_title }} - ${{ steps.gate.outputs.pr_body }} + Pull request title and body: + ---- + ${{ steps.gate.outputs.pr_title }} + ${{ steps.gate.outputs.pr_body }} - Review ONLY the changes introduced by the PR: - git log --oneline ${{ steps.gate.outputs.base_sha }}...${{ steps.gate.outputs.head_sha }} + Review ONLY the changes introduced by the PR: + git log --oneline ${{ steps.gate.outputs.base_sha }}...${{ steps.gate.outputs.head_sha }} - Output JSON only, following the provided schema. + Output JSON only, following the provided schema: + .github/codex/pr-merge-schema.json + EOF + + python - <<'PY' > chack_output.txt + import os + from chack_agent import ( + Chack, + ChackConfig, + ModelConfig, + AgentConfig, + SessionConfig, + ToolsConfig, + CredentialsConfig, + LoggingConfig, + ) + + with open("chack_prompt.txt", "r", encoding="utf-8") as handle: + user_prompt = handle.read() + + config = ChackConfig( + model=ModelConfig( + primary=os.environ.get("INPUT_MODEL_PRIMARY", "gpt-5.2-codex"), + provider=os.environ.get("INPUT_PROVIDER", "openai"), + ), + agent=AgentConfig( + main_action="github_action", + sub_action="run", + ), + session=SessionConfig(), + tools=ToolsConfig(exec_enabled=True), + credentials=CredentialsConfig( + openai_api_key=os.environ.get("OPENAI_API_KEY", ""), + ), + logging=LoggingConfig(level="INFO"), + system_prompt=os.environ.get("INPUT_SYSTEM_PROMPT", "You are an advanced research agent."), + env={}, + ) + + agent = Chack(config) + result = agent.run(session_id="github-action", text=user_prompt) + print(result.output) + PY + + { + echo "final-message<> "$GITHUB_OUTPUT" - name: Parse Codex decision id: parse diff --git a/.github/workflows/pr-failure-codex-dispatch.yml b/.github/workflows/pr-failure-codex-dispatch.yml index a2be6bf..a37eda8 100644 --- a/.github/workflows/pr-failure-codex-dispatch.yml +++ b/.github/workflows/pr-failure-codex-dispatch.yml @@ -152,14 +152,69 @@ jobs: echo "Leave the repo in a state ready to commit as when you finish, it'll be automatically committed and pushed." } > codex_prompt.txt - - name: Run Codex - id: run_codex - uses: openai/codex-action@v1 + - name: Set up Python + uses: actions/setup-python@v5 with: - openai-api-key: ${{ secrets.OPENAI_API_KEY }} - prompt-file: codex_prompt.txt - sandbox: workspace-write - model: gpt-5.2-codex + python-version: "3.11" + + - name: Install chack-agent + run: | + python -m pip install --upgrade pip + python -m pip install -e chack-agent + + - name: Run Chack Agent + id: run_codex + env: + OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} + INPUT_PROVIDER: openai + INPUT_MODEL_PRIMARY: gpt-5.2-codex + INPUT_SYSTEM_PROMPT: You are an advanced research agent. + run: | + python - <<'PY' > chack_output.txt + import os + from chack_agent import ( + Chack, + ChackConfig, + ModelConfig, + AgentConfig, + SessionConfig, + ToolsConfig, + CredentialsConfig, + LoggingConfig, + ) + + with open("codex_prompt.txt", "r", encoding="utf-8") as handle: + user_prompt = handle.read() + + config = ChackConfig( + model=ModelConfig( + primary=os.environ.get("INPUT_MODEL_PRIMARY", "gpt-5.2-codex"), + provider=os.environ.get("INPUT_PROVIDER", "openai"), + ), + agent=AgentConfig( + main_action="github_action", + sub_action="run", + ), + session=SessionConfig(), + tools=ToolsConfig(exec_enabled=True), + credentials=CredentialsConfig( + openai_api_key=os.environ.get("OPENAI_API_KEY", ""), + ), + logging=LoggingConfig(level="INFO"), + system_prompt=os.environ.get("INPUT_SYSTEM_PROMPT", "You are an advanced research agent."), + env={}, + ) + + agent = Chack(config) + result = agent.run(session_id="github-action", text=user_prompt) + print(result.output) + PY + + { + echo "final-message<> "$GITHUB_OUTPUT" - name: Commit and push if changed env: @@ -170,9 +225,9 @@ jobs: echo "No changes to commit." exit 0 fi - rm -f codex_failure_summary.txt codex_prompt.txt + rm -f codex_failure_summary.txt codex_prompt.txt chack_output.txt git add -A - git reset -- codex_failure_summary.txt codex_prompt.txt + git reset -- codex_failure_summary.txt codex_prompt.txt chack_output.txt git commit -m "Fix CI failures for PR #${PR_NUMBER}" git push origin HEAD:${TARGET_BRANCH} diff --git a/linPEAS/builder/linpeas_parts/1_system_information/13_Linux_exploit_suggester.sh b/linPEAS/builder/linpeas_parts/1_system_information/13_Linux_exploit_suggester.sh deleted file mode 100644 index 4500bf8..0000000 --- a/linPEAS/builder/linpeas_parts/1_system_information/13_Linux_exploit_suggester.sh +++ /dev/null @@ -1,39 +0,0 @@ -# Title: System Information - Linux Exploit Suggester -# ID: SY_Linux_exploit_suggester -# Author: Carlos Polop -# Last Update: 07-03-2024 -# Description: Execute Linux Exploit Suggester to identify potential kernel exploits: -# - Automated kernel vulnerability detection -# - Common vulnerable scenarios: -# * Known kernel vulnerabilities -# * Unpatched kernel versions -# * Missing security patches -# - Exploitation methods: -# * Kernel exploit execution: Use suggested exploits -# * Common attack vectors: -# - Kernel memory corruption -# - Race conditions -# - Use-after-free -# - Integer overflow -# * Exploit techniques: -# - Kernel memory manipulation -# - Privilege escalation -# - Root access acquisition -# - System compromise -# License: GNU GPL -# Version: 1.0 -# Functions Used: print_2title, print_info -# Global Variables: $MACPEAS -# Initial Functions: -# Generated Global Variables: $les_b64 -# Fat linpeas: 0 -# Small linpeas: 1 - - -if [ "$(command -v bash 2>/dev/null || echo -n '')" ] && ! [ "$MACPEAS" ]; then - print_2title "Executing Linux Exploit Suggester" - print_info "https://github.com/mzet-/linux-exploit-suggester" - les_b64="peass{https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh}" - echo $les_b64 | base64 -d | bash | sed "s,$(printf '\033')\\[[0-9;]*[a-zA-Z],,g" | grep -i "\[CVE" -A 10 | grep -Ev "^\-\-$" | sed -${E} "s/\[(CVE-[0-9]+-[0-9]+,?)+\].*/${SED_RED}/g" - echo "" -fi diff --git a/linPEAS/builder/linpeas_parts/1_system_information/14_Linux_exploit_suggester_2.sh b/linPEAS/builder/linpeas_parts/1_system_information/14_Linux_exploit_suggester_2.sh deleted file mode 100644 index 1c663e1..0000000 --- a/linPEAS/builder/linpeas_parts/1_system_information/14_Linux_exploit_suggester_2.sh +++ /dev/null @@ -1,41 +0,0 @@ -# Title: System Information - Linux Exploit Suggester 2 -# ID: SY_Linux_exploit_suggester_2 -# Author: Carlos Polop -# Last Update: 07-03-2024 -# Description: Execute Linux Exploit Suggester 2 (Perl version) to identify potential kernel exploits: -# - Alternative kernel vulnerability detection -# - Perl-based exploit suggestions -# - Common vulnerable scenarios: -# * Known kernel vulnerabilities -# * Unpatched kernel versions -# * Missing security patches -# * Alternative exploit paths -# - Exploitation methods: -# * Kernel exploit execution: Use suggested exploits -# * Common attack vectors: -# - Kernel memory corruption -# - Race conditions -# - Use-after-free -# - Integer overflow -# * Exploit techniques: -# - Kernel memory manipulation -# - Privilege escalation -# - Root access acquisition -# - System compromise -# License: GNU GPL -# Version: 1.0 -# Functions Used: print_2title, print_info -# Global Variables: -# Initial Functions: -# Generated Global Variables: $les2_b64 -# Fat linpeas: 1 -# Small linpeas: 0 - - -if [ "$(command -v perl 2>/dev/null || echo -n '')" ] && ! [ "$MACPEAS" ]; then - print_2title "Executing Linux Exploit Suggester 2" - print_info "https://github.com/jondonas/linux-exploit-suggester-2" - les2_b64="peass{https://raw.githubusercontent.com/jondonas/linux-exploit-suggester-2/master/linux-exploit-suggester-2.pl}" - echo $les2_b64 | base64 -d | perl 2>/dev/null | sed "s,$(printf '\033')\\[[0-9;]*[a-zA-Z],,g" | grep -iE "CVE" -B 1 -A 10 | grep -Ev "^\-\-$" | sed -${E} "s,CVE-[0-9]+-[0-9]+,${SED_RED},g" - echo "" -fi diff --git a/linPEAS/builder/linpeas_parts/2_container/6_Am_I_contained.sh b/linPEAS/builder/linpeas_parts/2_container/6_Am_I_contained.sh deleted file mode 100644 index 989292f..0000000 --- a/linPEAS/builder/linpeas_parts/2_container/6_Am_I_contained.sh +++ /dev/null @@ -1,20 +0,0 @@ -# Title: Container - Am I Containered -# ID: CT_Am_I_contained -# Author: Carlos Polop -# Last Update: 22-08-2023 -# Description: Am I Containered tool -# License: GNU GPL -# Version: 1.0 -# Functions Used: print_2title, execBin -# Global Variables: -# Initial Functions: -# Generated Global Variables: $FAT_LINPEAS_AMICONTAINED -# Fat linpeas: 1 -# Small linpeas: 0 - - -if [ "$$FAT_LINPEAS_AMICONTAINED" ]; then - print_2title "Am I Containered?" - FAT_LINPEAS_AMICONTAINED="peass{https://github.com/genuinetools/amicontained/releases/latest/download/amicontained-linux-amd64}" - execBin "AmIContainered" "https://github.com/genuinetools/amicontained" "$FAT_LINPEAS_AMICONTAINED" -fi diff --git a/linPEAS/builder/linpeas_parts/7_software_information/Leaks_git_repo.sh b/linPEAS/builder/linpeas_parts/7_software_information/Leaks_git_repo.sh deleted file mode 100644 index ac28b70..0000000 --- a/linPEAS/builder/linpeas_parts/7_software_information/Leaks_git_repo.sh +++ /dev/null @@ -1,30 +0,0 @@ -# Title: Software Information - Checking leaks in git repositories -# ID: SI_Leaks_git_repo -# Author: Carlos Polop -# Last Update: 22-08-2023 -# Description: Checking leaks in git repositories -# License: GNU GPL -# Version: 1.0 -# Functions Used: execBin, print_2title -# Global Variables: $MACPEAS, $TIMEOUT -# Initial Functions: -# Generated Global Variables: $git_dirname, $FAT_LINPEAS_GITLEAKS -# Fat linpeas: 1 -# Small linpeas: 0 - - -if ! [ "$FAST" ] && ! [ "$SUPERFAST" ] && [ "$TIMEOUT" ]; then - print_2title "Checking leaks in git repositories" - printf "%s\n" "$PSTORAGE_GITHUB" | while read f; do - if echo "$f" | grep -Eq ".git$"; then - git_dirname=$(dirname "$f") - if [ "$MACPEAS" ]; then - FAT_LINPEAS_GITLEAKS="peass{https://github.com/gitleaks/gitleaks/releases/download/v8.17.0/gitleaks_8.17.0_darwin_arm64.tar.gz}" - else - FAT_LINPEAS_GITLEAKS="peass{https://github.com/gitleaks/gitleaks/releases/download/v8.17.0/gitleaks_8.17.0_linux_x64.tar.gz}" - fi - execBin "GitLeaks (checking $git_dirname)" "https://github.com/zricethezav/gitleaks" "$FAT_LINPEAS_GITLEAKS" "detect -s '$git_dirname' -v | grep -E 'Description|Match|Secret|Message|Date'" - fi - done - echo "" -fi \ No newline at end of file