shennina: Automating Host Exploitation with AI
shennina
Shennina is an automated host exploitation framework. The mission of the project is to fully automate the scanning, vulnerability scanning/analysis, and exploitation using Artificial Intelligence. Shennina is integrated with Metasploit and Nmap for performing the attacks, as well as being integrated with an in-house Command-and-Control Server for exfiltrating data from compromised machines automatically.
This was developed by Mazin Ahmed and Khalid Farah within the HITB CyberWeek 2019 AI challenge. The project is developed based on the concept of DeepExploit by Isao Takaesu.
Shennina scans a set of input targets for available network services, uses its AI engine to identify recommended exploits for the attacks, and then attempts to test and attack the targets. If the attack succeeds, Shennina proceeds with the post-exploitation phase.
The AI engine is initially trained against live targets to learn reliable exploits against remote services.
Shennina also supports a “Heuristics” mode for identifying recommended exploits.
Features
- Automated self-learning approach for finding exploits.
- High performance using managed concurrency design.
- Intelligent exploits clustering.
- Post exploitation capabilities.
- Deception detection.
- Ransomware simulation capabilities.
- Automated data exfiltration.
- Vulnerability scanning mode.
- Heuristic mode support for recommending exploits.
- Windows, Linux, and macOS support for agents.
- Scriptable attack method within the post-exploitation phase.
- Exploits suggestions for Kernel exploits.
- Out-of-Band technique testing for exploitation checks.
- Automated exfiltration of important data on compromised servers.
- Reporting capabilities.
- Coverage for 40+ TTPs within the MITRE ATT&CK Framework.
- Supports multi-input targets.
