pengu-apm.github.io/index.html at main · pengu-apm/pengu-apm.github.io · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>BloodPengu: Documentation</title>
<link rel="icon" type="image/png" href="./assets/images/pengu_logo.png">
<link rel="preconnect" href="https://fonts.googleapis.com">
<link href="https://fonts.googleapis.com/css2?family=Space+Mono:wght@400;700&family=Syne:wght@400;700;800;900&display=swap" rel="stylesheet">
<link rel="stylesheet" href="./assets/styles.css">
</head>
<body>

<div class="noise"></div>
<div class="cursor" id="cursor"></div>
<div class="cursor-ring" id="cursor-ring"></div>
<canvas id="bg-canvas"></canvas>

<nav id="navbar">
  <div class="nav-logo">
    <div class="logo-dot"></div>
    Blood<span>Pengu</span>
  </div>
  <div class="nav-links">
    <a href="#overview">Overview</a>
    <a href="#features">Features</a>
    <a href="#screenshots">Screenshots</a>
    <a href="#architecture">Architecture</a>
    <a href="https://github.com/pengu-apm/" target="_blank" class="nav-btn">GitHub</a>
  </div>
  <button class="nav-mobile-toggle" id="mobile-toggle">
    <span></span><span></span><span></span>
  </button>
</nav>

<div class="mobile-menu" id="mobile-menu">
  <a href="#overview">Overview</a>
  <a href="#features">Features</a>
  <a href="#screenshots">Screenshots</a>
  <a href="#architecture">Architecture</a>
  <a href="https://github.com/pengu-apm/" target="_blank">GitHub</a>
</div>

<section class="hero">
  <div class="hero-content">
    <div class="hero-tag">Degree Visualization of Linux ASR</div>
    <h1>Map. <em>Exploit.</em><br>Eliminate.</h1>
    <p class="hero-sub">Graph based privilege escalation modeling for modern Linux environments. Visualize attack-paths to root before your adversary.</p>
    <div class="hero-actions">
      <a href="https://github.com/pengu-apm/BloodPengu" target="_blank" class="btn-red">BloodPengu</a>
      <a href="https://github.com/pengu-apm/PyPengu" target="_blank" class="btn-ghost">PyPengu</a>
      <a href="https://pengu-apm.github.io/" target="_blank" class="btn-outline">Documentation</a>
    </div>
    <div class="hero-stats">
      <div class="stat">
        <div class="stat-n">8<span>+</span></div>
        <div class="stat-l">Core Collectors</div>
      </div>
      <div class="stat">
        <div class="stat-n">100<span>%</span></div>
        <div class="stat-l">Linux Based</div>
      </div>
      <div class="stat">
        <div class="stat-n">Go<span>+</span>JS</div>
        <div class="stat-l">Stack</div>
      </div>
      <div class="stat">
        <div class="stat-n">BSD<span>/</span>MIT</div>
        <div class="stat-l">License</div>
      </div>
    </div>
  </div>
  <div class="scroll-hint">
    <div class="scroll-line"></div>
    <span>Scroll</span>
  </div>
</section>

<div class="marquee-wrap">
  <div class="marquee-inner">
    <span>Sudo Escalation</span>
    <span>SUID Discovery</span>
    <span>Docker Escape</span>
    <span>LXD Group Abuse</span>
    <span>Kernel Exploits</span>
    <span>Writable Services</span>
    <span>Cron Hijacking</span>
    <span>Group Degree Mapping</span>
    <span>Attack Path Visualization</span>
    <span>PyPengu Collector</span>
    <span>Sudo Escalation</span>
    <span>SUID Discovery</span>
    <span>Docker Escape</span>
    <span>LXD Group Abuse</span>
    <span>Kernel Exploits</span>
    <span>Writable Services</span>
    <span>Cron Hijacking</span>
    <span>Group Degree Mapping</span>
    <span>Attack Path Visualization</span>
    <span>PyPengu Collector</span>
  </div>
</div>

<section id="overview" class="section overview-section">
  <div class="overview-grid">
    <div class="overview-left reveal-left">
      <div class="section-tag">What is BloodPengu</div>
      <h2>Attack path management<br>for Linux infrastructure</h2>
      <p>Identify Hundreds, even Thousands of Attack-paths. BloodPengu brings graph-based ASR to Linux/Unix environments.</p>
      <p>Collects Data with PyPengu on target, enumerating privilege vectors, mapping group relationships, and surfacing escalation paths. BloodPengu ingests JSON's data and renders it as an interactive attack graph.</p>
      <p>Security can identify the shortest path to root in seconds. Defenders can map and close attack paths before they are exploited.</p>
    </div>
    <div class="overview-right reveal-right">
      <div class="code-panel">
        <div class="code-topbar">
          <div class="code-dots">
            <div class="cdot red"></div>
            <div class="cdot yellow"></div>
            <div class="cdot green"></div>
          </div>
          <div class="code-title">pypengu-output.json</div>
        </div>
        <div class="code-body">
          <div class="code-line"><span class="ct">{"host":</span> <span class="cs">"vulnerable.corp"</span><span class="ct">,</span></div>
          <div class="code-line"><span class="ct">"os":</span> <span class="cs">"Ubuntu 20.04 LTS"</span><span class="ct">,</span></div>
          <div class="code-line"><span class="ct">"kernel":</span> <span class="cs">"5.4.0-42-generic"</span><span class="ct">,</span></div>
          <div class="code-line"><span class="ct">"user":</span> <span class="cs">"tony"</span><span class="ct">,</span></div>
          <div class="code-line"><span class="ct">"nodes":</span> <span class="ck">[</span></div>
          <div class="code-line pl">{<span class="ct">"id":</span> <span class="cs">"tony"</span><span class="ct">, "type":</span> <span class="cn">"USER"</span>}<span class="ct">,</span></div>
          <div class="code-line pl">{<span class="ct">"id":</span> <span class="cs">"lxd"</span><span class="ct">, "type":</span> <span class="cn">"GROUP"</span>}<span class="ct">,</span></div>
          <div class="code-line pl">{<span class="ct">"id":</span> <span class="cs">"root"</span><span class="ct">, "type":</span> <span class="cn">"USER"</span>}</div>
          <div class="code-line"><span class="ck">]</span><span class="ct">,</span></div>
          <div class="code-line"><span class="ct">"edges":</span> <span class="ck">[</span></div>
          <div class="code-line pl">{<span class="ct">"from":</span> <span class="cs">"tony"</span><span class="ct">, "to":</span> <span class="cs">"lxd"</span><span class="ct">,</span></div>
          <div class="code-line pl2"><span class="ct">"type":</span> <span class="cn">"MemberOf"</span><span class="ct">, "risk":</span> <span class="cv">"HIGH"</span>}<span class="ct">,</span></div>
          <div class="code-line pl">{<span class="ct">"from":</span> <span class="cs">"lxd"</span><span class="ct">, "to":</span> <span class="cs">"root"</span><span class="ct">,</span></div>
          <div class="code-line pl2"><span class="ct">"type":</span> <span class="cn">"LXDGroupEscape"</span><span class="ct">, "risk":</span> <span class="cr">"CRITICAL"</span>}</div>
          <div class="code-line"><span class="ck">]</span></div>
        </div>
      </div>
    </div>
  </div>
</section>

<section id="features" class="section features-section">
  <div class="section-header reveal-up">
    <div class="section-tag">Core Capabilities</div>
    <h2>Multiplex vectors. One graph.</h2>
    <p>BloodPengu maps every privilege escalation path across your Linux attack surface into a unified, queryable graph.</p>
  </div>
  <div class="features-grid">
    <div class="feat-card reveal-up" data-delay="0">
      <div class="feat-num">01</div>
      <div class="feat-icon">
        <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M17 21v-2a4 4 0 0 0-4-4H5a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M23 21v-2a4 4 0 0 0-3-3.87"/><path d="M16 3.13a4 4 0 0 1 0 7.75"/></svg>
      </div>
      <h3>Group Degree Mapping</h3>
      <p>Visualizes group membership depth and privileged inheritance. Surfaces dangerous groups like docker, lxd, disk, and sudo with full escalation impact.</p>
      <div class="feat-badge">Groups</div>
    </div>
    <div class="feat-card reveal-up" data-delay="80">
      <div class="feat-num">02</div>
      <div class="feat-icon">
        <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
      </div>
      <h3>Sudo Escalation Graph</h3>
      <p>Parses sudo/root access output and NOPASSWD rules. Maps direct and indirect escalation paths through sudoers misconfigurations and dangerous binary configurations.</p>
      <div class="feat-badge">Sudo</div>
    </div>
    <div class="feat-card reveal-up" data-delay="160">
      <div class="feat-num">03</div>
      <div class="feat-icon">
        <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><rect x="2" y="2" width="20" height="8" rx="2"/><rect x="2" y="14" width="20" height="8" rx="2"/><line x1="6" y1="6" x2="6.01" y2="6"/><line x1="6" y1="18" x2="6.01" y2="18"/></svg>
      </div>
      <h3>Service Exposure Modeling</h3>
      <p>Identifies writable systemd service unit files and scripts executed with elevated privileges that can be hijacked across user boundaries.</p>
      <div class="feat-badge">Services</div>
    </div>
    <div class="feat-card reveal-up" data-delay="240">
      <div class="feat-num">04</div>
      <div class="feat-icon">
        <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/></svg>
      </div>
      <h3>Kernel Surface Awareness</h3>
      <p>Captures kernel version and cross-references known CVEs. Maps KernelExploit edges including DirtyPipe, DirtyCow, and overlayfs privilege chains.</p>
      <div class="feat-badge">Kernel</div>
    </div>
    <div class="feat-card reveal-up" data-delay="320">
      <div class="feat-num">05</div>
      <div class="feat-icon">
        <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><circle cx="11" cy="11" r="8"/><line x1="21" y1="21" x2="16.65" y2="16.65"/></svg>
      </div>
      <h3>SUID Binary Discovery</h3>
      <p>Enumerates all SUID and SGID binaries across the filesystem. Cross-references against GTFOBins-style exploitable binaries to surface immediate escalation vectors.</p>
      <div class="feat-badge">SUID</div>
    </div>
    <div class="feat-card reveal-up" data-delay="400">
      <div class="feat-num">06</div>
      <div class="feat-icon">
        <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><rect x="2" y="7" width="20" height="14" rx="2"/><path d="M16 21V5a2 2 0 0 0-2-2h-4a2 2 0 0 0-2 2v16"/></svg>
      </div>
      <h3>Container Based Escape</h3>
      <p>Detects container group membership and maps container escape paths. Identifies LXDGroupEscape and DockerEscape vectors with full graph visualization.</p>
      <div class="feat-badge">Docker</div>
    </div>
  </div>
</section>

<section id="screenshots" class="section screenshots-section">
  <div class="section-header reveal-up">
    <div class="section-tag">Screenshots</div>
    <h2>BloodPengu in action.</h2>
    <p>Real attack paths. Real Linux environments. Every node clickable. Every edge labeled.</p>
  </div>
  <div class="screenshots-track" id="screenshots-track">
    <div class="shot-card scroll-card" data-dir="left">
      <div class="shot-img">
        <img src="./assets/images/bloodpengu-photo-1.jpeg" alt="Attack path overview" onerror="this.parentElement.classList.add('img-placeholder')">
        <div class="shot-overlay">
          <div class="shot-badge critical">Critical</div>
        </div>
      </div>
      <div class="shot-info">
        <div class="shot-title">Attack Path Overview</div>
        <div class="shot-desc">Full graph view showing all privilege escalation paths from low-privilege user to root. Edges colored by risk severity across the entire attack surface.</div>
      </div>
    </div>
    <div class="shot-card scroll-card" data-dir="right">
      <div class="shot-img">
        <img src="./assets/images/bloodpengu-photo-2.jpeg" alt="LXD group escape" onerror="this.parentElement.classList.add('img-placeholder')">
        <div class="shot-overlay">
          <div class="shot-badge critical">Critical</div>
        </div>
      </div>
      <div class="shot-info">
        <div class="shot-title">Container Group Escape</div>
        <div class="shot-desc">Vuln-User is a member of the lxd group. BloodPengu maps the LXDGroupEscape edge directly to root, exposing the single-hop privilege escalation chain.</div>
      </div>
    </div>
    <div class="shot-card scroll-card" data-dir="left">
      <div class="shot-img">
        <img src="./assets/images/bloodpengu-photo-3.jpeg" alt="Dense attack graph" onerror="this.parentElement.classList.add('img-placeholder')">
        <div class="shot-overlay">
          <div class="shot-badge high">183 Critical</div>
        </div>
      </div>
      <div class="shot-info">
        <div class="shot-title">Dense Attack Surface</div>
        <div class="shot-desc">Hundreds nodes, hundreds edges, hundreds of critical paths rendered in one graph. SUID binaries fanning out from a single user, each one a direct path to root privilege.</div>
      </div>
    </div>
    <div class="shot-card scroll-card" data-dir="right">
      <div class="shot-img">
        <img src="./assets/images/bloodpengu-photo-1.jpeg" alt="SudoNoPasswd path" onerror="this.parentElement.classList.add('img-placeholder')">
        <div class="shot-overlay">
          <div class="shot-badge critical">Critical</div>
        </div>
      </div>
      <div class="shot-info">
        <div class="shot-title">SudoNoPasswd Path</div>
        <div class="shot-desc">Shortest path query result from Vuln-User to root via SudoNoPasswd. The curved edge shows a single-step escalation requiring no password. Remediation is immediate.</div>
      </div>
    </div>
    <div class="shot-card scroll-card" data-dir="left">
      <div class="shot-img">
        <img src="./assets/images/bloodpengu-photo-5.jpeg" alt="Kernel exploit path" onerror="this.parentElement.classList.add('img-placeholder')">
        <div class="shot-overlay">
          <div class="shot-badge critical">Critical</div>
        </div>
      </div>
      <div class="shot-info">
        <div class="shot-title">Kernel Exploit Path</div>
        <div class="shot-desc">KernelExploit edge from Vuln-User to root. PyPengu detected a vulnerable kernel version and BloodPengu surfaces the CVE-based escalation as a critical attack path.</div>
      </div>
    </div>
    <div class="shot-card scroll-card" data-dir="right">
      <div class="shot-img">
        <img src="./assets/images/bloodpengu-photo-4.jpeg" alt="Multi-edge connections" onerror="this.parentElement.classList.add('img-placeholder')">
        <div class="shot-overlay">
          <div class="shot-badge high">11 Paths</div>
        </div>
      </div>
      <div class="shot-info">
        <div class="shot-title">Multi-Edge Connections</div>
        <div class="shot-desc">All paths from Vuln-User to root rendered simultaneously. KernelExploit and ten SudoNoPasswd edges shown as a fan between two nodes with risk labels on each arc.</div>
      </div>
    </div>
  </div>
</section>

<section id="architecture" class="section arch-section">
  <div class="arch-grid">
    <div class="arch-left reveal-left">
      <div class="section-tag">Architecture</div>
      <h2>Collect. Transform.<br>Visualize.</h2>
      <p>A two-component pipeline. PyPengu runs locally on the target and enumerates the attack surface. BloodPengu ingests that JSON and renders an interactive attack graph.</p>
      <div class="arch-steps">
        <div class="arch-step">
          <div class="step-num">01</div>
          <div class="step-body">
            <h4>Deploy PyPengu</h4>
            <p>Run the static Go binary on target. No dependencies. Supports x86_64, ARM64, x86. Outputs pypengu-output.json.</p>
          </div>
        </div>
        <div class="arch-step">
          <div class="step-num">02</div>
          <div class="step-body">
            <h4>Enumerate Attack Surface</h4>
            <p>8 core collectors run in parallel across sudo, SUID, docker, services, cron, kernel, groups, and users. All findings serialized to JSON.</p>
          </div>
        </div>
        <div class="arch-step">
          <div class="step-num">03</div>
          <div class="step-body">
            <h4>Import to BloodPengu</h4>
            <p>Drop the JSON into BloodPengu via the Import JSON interface. The graph auto-populates with nodes, edges, and risk levels.</p>
          </div>
        </div>
        <div class="arch-step">
          <div class="step-num">04</div>
          <div class="step-body">
            <h4>Query Attack Paths</h4>
            <p>Run pre-built queries: Shortest to Root, All Paths to Root, Sudo Misconfigs, SUID Binaries, Kernel Exploits, and more.</p>
          </div>
        </div>
      </div>
    </div>
    <div class="arch-right reveal-right">
      <div class="section-tag">PyPengu Collectors Examples</div>
      <div class="collectors-grid">
        <div class="collector reveal-up" data-delay="0">
          <div class="col-name">Sudo</div>
          <div class="col-cmd">sudo -l</div>
          <div class="col-desc">NOPASSWD rules and dangerous binaries</div>
          <div class="col-badge badge-crit">Critical</div>
        </div>
        <div class="collector reveal-up" data-delay="60">
          <div class="col-name">SUID</div>
          <div class="col-cmd">find / -perm -4000</div>
          <div class="col-desc">GTFOBins cross-reference</div>
          <div class="col-badge badge-crit">Critical</div>
        </div>
        <div class="collector reveal-up" data-delay="120">
          <div class="col-name">Docker</div>
          <div class="col-cmd">id / groups</div>
          <div class="col-desc">Container group membership</div>
          <div class="col-badge badge-high">High</div>
        </div>
        <div class="collector reveal-up" data-delay="180">
          <div class="col-name">Services</div>
          <div class="col-cmd">systemctl list-units</div>
          <div class="col-desc">Writable unit file detection</div>
          <div class="col-badge badge-high">High</div>
        </div>
        <div class="collector reveal-up" data-delay="240">
          <div class="col-name">Cron</div>
          <div class="col-cmd">/etc/cron*</div>
          <div class="col-desc">Hijackable cron scripts</div>
          <div class="col-badge badge-high">High</div>
        </div>
        <div class="collector reveal-up" data-delay="300">
          <div class="col-name">Kernel</div>
          <div class="col-cmd">uname -r</div>
          <div class="col-desc">CVE version matching</div>
          <div class="col-badge badge-crit">Critical</div>
        </div>
        <div class="collector reveal-up" data-delay="360">
          <div class="col-name">Groups</div>
          <div class="col-cmd">/etc/group</div>
          <div class="col-desc">Privileged group enumeration</div>
          <div class="col-badge badge-med">Medium</div>
        </div>
        <div class="collector reveal-up" data-delay="420">
          <div class="col-name">Users</div>
          <div class="col-cmd">/etc/passwd</div>
          <div class="col-desc">User privilege mapping</div>
          <div class="col-badge badge-med">Medium</div>
        </div>
      </div>
    </div>
  </div>
</section>

<section class="cta-section">
  <div class="cta-inner reveal-up">
    <h2>Stop being the last<br><span>to know.</span></h2>
    <p>Run PyPengu. Import the Digested Data. See every path to root before your adversary does.</p>
    <div class="cta-btns">
      <a href="https://github.com/pengu-apm/BloodPengu" target="_blank" class="btn-red">Get BloodPengu</a>
      <a href="https://github.com/pengu-apm/PyPengu" target="_blank" class="btn-ghost">Get PyPengu</a>
    </div>
    <div class="cta-note">BSD-3-Clause and MIT Licensed -- Open Source -- Built by AdverXarial</div>
  </div>
</section>

<footer>
  <div class="footer-inner">
    <div class="footer-logo">Blood<span>Pengu</span></div>
    <div class="footer-links">
      <a href="https://github.com/pengu-apm/BloodPengu" target="_blank">GitHub</a>
      <a href="https://pengu-apm.github.io/" target="_blank">Documentation</a>
      <a href="https://github.com/pengu-apm/PyPengu" target="_blank">PyPengu</a>
      <a href="mailto:byt3n33dl3@pm.me">Contact</a>
    </div>
    <div class="footer-copy">2026 AdverXarial. All rights reserved.</div>
  </div>
</footer>

<script src="./assets/script.js"></script>
</body>
</html>