AI 驱动的后渗透综合管理平台，深度集成 LLM Agent，开箱即用。

LeoAI – AI‑augmented post‑exploitation & host‑management platform

What it is – LeoAI is an open‑source web‑based platform that combines host‑asset management, an interactive agent console, and large‑language‑model (LLM) assistance for authorized red‑team and security‑research activities. It runs a Java 17+ Spring Boot backend and supports dual runtimes: a Java agent and a lightweight PHP 5.6+ agent, both exposing the same capability‑based RPC interface.

Core capabilities

Area	What LeoAI provides
AI co‑ordination	Platform‑level AI (LangChain4j) can analyse assets, plan multi‑step operations and dispatch tasks to a Node AI that runs on a specific agent. Supports OpenAI‑compatible models (OpenAI, Claude, DeepSeek, etc.) with dynamic context‑window scaling up to 1 MiB.
Host & session management	Centralised inventory, online/offline session tracking, batch host import, SQLite‑backed persistence.
Interactive console	Web‑terminal (xterm.js), file manager, database console (MySQL, PostgreSQL, Oracle, SQLite, SQL Server), registry viewer, process/service control, Docker management, web‑runtime fingerprinting, credential extraction, scanning tools, proxy/tunnel handling.
Agent runtimes	• Java Agent – compiled components loaded on demand, uses `ProcessBuilder`/PTY.
• PHP Agent – single‑file HTTP entry, lazy‑loads components, uses `proc_open`/`popen`. Both expose the same SPI, capability contracts and RPC protocol.
Shell / web‑shell generation	Builder for in‑memory Java shells (filters, listeners, valves, interceptors, etc.) covering 24 server types (Tomcat, Jetty, JBoss, WebLogic, WebSphere, Spring MVC, Dubbo, …) and for JSP/Groovy web‑shells.
Plugin & skill system	Visual plugin manager for Java bytecode, JavaScript/Groovy/Python scripts, and pre‑packaged AI Skills that encode common post‑exploitation workflows (recon, credential dumping, privilege escalation, lateral movement, etc.).
Reporting & archiving	Automatic summarisation of reconnaissance, AI‑generated operation reports, artefact library with searchable metadata.
Team & audit	User/role management, team sharing, operation audit logs, AI interaction logs.

Architecture snapshot

graph TD
    web[Web UI] --> service[Service / AI orchestration]
    service --> core[Core SPI / Capability / RPC / Session]
    web --> java[Java Agent Runtime]
    web --> php[PHP Agent Runtime]
    core --> java
    core --> php
    service --> jmg[Java memory‑shell generator]

The platform treats Java and PHP agents as interchangeable runtimes; the upper layers work with abstract capabilities rather than a specific language.

Technology stack (as listed in the repo)

Backend: Spring Boot 3.5, MyBatis 3, SQLite (embedded), OkHttp 4, Javassist 3.30
AI layer: LangChain4j 1.16, OpenAI‑compatible LLM APIs (OpenAI, Claude, DeepSeek, Alibaba Tongyi, Ollama, etc.)
Build: Maven multi‑module
Frontend: bundled in the JAR, uses modern browsers (Chrome/Firefox/Edge) and xterm.js for the terminal
Agent runtimes: Java 17+ components + PHP 5.6+ single‑file HTTP entry

Getting started (quick‑start)

Download the JAR from the releases page – e.g. LeoAi-3.0.0.jar.
Run (Java 17+ required):
```
java --add-opens java.base/java.lang=ALL-UNNAMED -jar LeoAi-3.0.0.jar
```
The --add-opens flag is mandatory for the internal reflection used by the platform.
Open a browser at http://localhost:8082.
Log in with the default admin account admin / 54ikun and change the password immediately.

Docker alternative

git clone https://github.com/cha0upup/LeoAI.git
cd LeoAI
docker compose up -d --build

The Dockerfile pulls the JAR automatically; the container stores the SQLite DB in a Docker volume (leoai-data).
Port, encryption key, and JAR URL can be overridden via a .env file.

Configuring AI models

In the web UI go to Management → AI Configuration, add a provider with:

Name
Base URL (e.g. https://api.openai.com/v1)
API key
Model name The platform will use LangChain4j to route prompts, handle tool calls, and stream results back to the console.

Typical workflow

Add a host – supply a name, select Java or PHP runtime, and give the agent URL and secret key.
Open the console for that host – choose a tool (terminal, file manager, DB console, scanner, etc.).
Invoke the Platform AI – ask it to “enumerate web services on this host”. The AI plans the steps, calls the appropriate scanning tool, streams progress, and finally produces a concise report.
Save artefacts – generated scripts, shell payloads, or AI‑written reports are automatically archived in the Artifacts library.
Collaborate – teammates can share hosts, view audit logs, and co‑author Skills.

Who should use it?

Red‑team operators with legal permission to test internal networks.
Security researchers building or evaluating post‑exploitation tooling.
DevSecOps teams that want an AI‑assisted interface for incident response drills (provided they have appropriate licensing and consent).

License & disclaimer

Licensed under GPL v3.
The README contains a standard disclaimer: the software is intended only for authorized security testing; misuse is the user’s responsibility.

Bottom line – LeoAI is a full‑stack, AI‑enhanced red‑team platform that merges host management, a rich set of post‑exploitation tools, and LLM‑driven automation, all packaged as a single Spring Boot JAR (or Docker image) and supporting both Java and PHP agents.

cha0upup/LeoAI