cha0upup/LeoAI

LeoAI – AI‑augmented Red‑Team Platform

What it is

• An open‑source web console that combines host‑asset management, a Puppet‑style remote‑execution runtime, and large‑language‑model (LLM) assistance. It is aimed at legally‑authorized red‑team and security‑research scenarios.
• The platform runs a dual runtime: a Java‑based Puppet agent and a lightweight PHP‑based Puppet agent. Both expose the same capability contract (file, shell, database, network, etc.) and can be selected per target.
• An AI layer (built on LangChain4j) can orchestrate multi‑step post‑exploitation tasks, call the underlying tools, and generate reports.

Key components

Component	Role
Web UI (Spring Boot 3.5)	Central dashboard, host inventory, session view, team & audit management.
Service / AI	Shared business logic, task orchestration, LangChain4j‑driven agents.
Java Puppet Runtime	Executes commands, file ops, DB queries, network scans, etc., via Java APIs.
PHP Puppet Runtime	Same capabilities via a single‑file PHP entry point (requires PHP 5.6+ and relevant extensions).
SQLite DB	Stores hosts, users, audit logs, AI configuration.
Docker image	One‑click deployment; the image pulls the pre‑built JAR from the GitHub release.

What you can do with LeoAI

• Asset & session management – add hosts, view live Puppet sessions, cache offline data, share hosts across teams.
• Interactive console – xterm.js terminal, file manager, database console, registry viewer, process/service control, Docker container handling, etc.
• Network utilities – port scanner, service fingerprinting, HTTP repeater/fuzzer, SOCKS5/HTTP proxy, local/remote port forwarding, reverse tunnels.
• Credential & privilege tools – credential dumping, SUID/Capability discovery, user/account management.
• In‑memory/webshell generation – Build payloads for dozens of Java containers/middleware (Tomcat, Jetty, JBoss, WebLogic, etc.) and classic JSP/Groovy web shells.
• AI‑driven automation –
  • Platform AI analyses overall assets and delegates tasks to a Puppet AI that runs inside a specific host session.
  • Multi‑round tool calling, automatic planning, progress tracking, and result summarisation.
  • Supports OpenAI‑compatible providers (OpenAI, Alibaba Tongyi, DeepSeek, Claude, Ollama, …) with hot model switching and up to 1 M‑token context windows.
  • Over 100 built‑in AI tools (command exec, file ops, DB queries, scanning, etc.) and a Skill library of ready‑made prompt templates for recon, credential hunting, privilege escalation, lateral movement, persistence, etc.
• Team & audit features – role‑based user/team management, operation logs, AI conversation logs, exportable reports.

How to get started

1. Download the JAR (e.g., LeoAi-2.1.1.jar) from the Releases page or pull the Docker image.
2. Run:

   java --add-opens java.base/java.lang=ALL-UNNAMED -jar LeoAi-2.1.1.jar
   

   (the --add-opens flag is required for reflective access).
3. Open http://localhost:8082 (or the port you configure) and log in with the default admin / 54ikun – you’ll be forced to change the password.
4. Add a host, choose the runtime (Java or PHP), provide the target URL and a shared secret, then start a session.
5. Use the UI panels (Terminal, File Manager, DB Console, etc.) or invoke the AI assistant to let the LLM plan and run a sequence of actions.

Deployment options

• Standalone JAR – requires Java 17+, creates an SQLite file in the working directory.
• Docker Compose – docker compose up -d --build builds an image that pulls the JAR, mounts a Docker volume (leoai-data) for persistence, and exposes the web UI. Environment variables (LEOAI_PORT, LEO_PLUGIN_ENCRYPT_KEY, JAR_URL) let you customise port, encryption key, or JAR version.

Security considerations

• Intended for authorized testing only; the README includes a disclaimer and recommends internal‑network deployment, strong admin passwords, API‑key protection, and per‑project traffic‑obfuscation templates.
• The platform itself does not provide HTTPS – you should front it with Nginx/Apache or a reverse‑proxy for TLS.
• Access to the AI configuration (LLM API keys) is guarded by role‑based permissions and audit logging.

License

• Distributed under GNU GPL v3.

---

Bottom line – LeoAI is a full‑stack, AI‑enhanced red‑team framework that lets you manage compromised hosts, run a rich set of post‑exploitation tools, and automate many steps with LLM agents, all from a single web interface.