SPECTER FOUNDRY — Technical Reference

Architecture

SPECTER FOUNDRY is a 10-subsystem autonomous exploit code generation engine targeting AI inference infrastructure. Sessions are identified by FND-{hex12} IDs and persisted in SQLite WAL-mode — meaning a machine reboot during a long fuzzing or R1 reasoning session does not lose progress.

The pipeline is: FINGERPRINT → FUZZ → SEARCH → REASON → GENERATE → TEST → (ADAPT loop ≤5) → CHAIN → EXECUTE. Each stage stores its output in SQLite and passes the result to the next. Any stage can be invoked independently via CLI.

Requirements

Installation

cd red-specter-specter-foundry
pip install -e .
specter-foundry --help

FINGERPRINT-TARGET

Gate: OPEN. No authentication required.

Probes 11 AI service ports via TCP connect + HTTP GET. Known ports: Ollama:11434, vLLM:8000, LiteLLM:8080, MLflow:5000, Ray dashboard:8265, Gradio:7860, Flowise:3000, Qdrant:6333, Triton:8001, llama.cpp:8080, Streamlit:8501. Builds a TargetProfile with service name, version (extracted from banner/HTTP response), CVE matches, and a defence profile (ASLR/NX/stack canary/PIE defaults to True).

specter-foundry fingerprint --target 192.168.1.100 --port 11434

FUZZ-TARGET

Gate: INJECT. Requires FOUNDRY_INJECT_KEY.

Sends boundary inputs, format strings, and protocol mutations to the target service. If the afl-fuzz binary is present, launches AFL++ instrumented fuzzing against binary targets. Crash types detected: segfault, heap overflow, null pointer dereference, stack overflow, format string, integer overflow. Exploitability rated EXPLOITABLE / PROBABLY_EXPLOITABLE / UNKNOWN based on crash type and crash count.

export FOUNDRY_INJECT_KEY=your-key
specter-foundry fuzz --target 192.168.1.100 --port 11434 --session-id FND-ABC123

SEARCH-EXPLOITS

Gate: OPEN.

Three search paths run in order. First: ARMORY DB keyword search (path from ARMORY_DB_PATH env var). Second: NVD CVE API lookup for each known_cve in the target profile. Third: local filesystem scan for matching exploit files. Confidence scoring: NVD CVSS 9.8 → confidence 0.99, local file found → 0.9. Returns highest-confidence result.

REASON-EXPLOIT

Gate: GENERATE. Requires FOUNDRY_GENERATE_KEY.

Selects a named CVE template from the 6 AI inference templates based on target service name and known CVE match. Builds a prompt from the TargetProfile + FuzzResult + ExploitSearchResult and submits to DeepSeek R1:32b via Ollama (localhost:11434, POST /api/generate). Strips <think>...</think> tags from the reasoning output. GPU thermal guard: queries nvidia-smi; warns at 85°C, pauses at 90°C (raises RuntimeError until temperature drops).

GENERATE-VARIANTS

Gate: GENERATE.

Generates N exploit variants from the base ExploitCode, applying one of 5 mutation strategies: alternate_encoding, rop_chain_variant, different_injection_technique, syscall_direct, heap_spray. Each variant runs through the full AV/EDR evasion pipeline before being stored.

Shellcode encoding

Windows injection techniques

Linux injection techniques

TEST-EXPLOIT

Gate: INJECT.

Builds a Dockerfile from target OS name / OS version / libraries / services / defences and provisions a Docker container. Runs the exploit code as a subprocess inside the container (or directly if Docker is unavailable). Success indicators: uid=0, root@, /etc/shadow, got shell, rce confirmed, whoami. Returns ExploitTestResult with success/stdout/stderr/sandbox_image.

ADAPT-EXPLOIT

Gate: GENERATE.

Takes the list of failed variants and their test results, feeds them back to R1:32b with a failure analysis prompt, and generates new adapted variants. MAX_ADAPTATION_BUDGET = 5 iterations. budget_exhausted = True when iteration exceeds budget. Each adaptation cycle logs its reasoning trace in the AdaptationLog.

CHAIN-EXPLOITS

Gate: INJECT.

Executes one of 5 named multi-stage exploit chains. JWT none-alg tokens forged via the litellm_jwt_to_corruption chain (alg:none, empty signature, exp:9999999999). Per-step privilege tracking from user through root or cloud_iam. Returns ChainReport with CHN-{hex12} ID and full step sequence.

EXECUTE-EXPLOIT

Gate: UNLEASHED. Requires FOUNDRY_UNLEASHED_KEY + ROE file.

Writes the exploit code to a temp file and executes via subprocess (60s timeout). Privilege detection: uid=0 / root@ / id=0 → "root"; AccessKeyId / cloud_iam → "cloud_iam". Returns ExecutionReport with EXE-{hex12} ID.

ROE file must contain the exact phrase: autonomous exploit generation authorised

REPORT-GENERATOR

Gate: OPEN.

Assembles FoundryReport from all SQLite-stored subsystem outputs. Dual-signs with Ed25519 (from FOUNDRY_SIGNING_KEY env var, base64-encoded 32-byte seed) and ML-DSA-65 (via liboqs). Falls back to HMAC-SHA3-256 with "SIM-" prefix if liboqs is not installed. Writes JSON to /tmp/{report_id}.json by default.

Gate Architecture

Session Schema

SQLite database at $FOUNDRY_SESSION_DIR/{session_id}.db (default: /tmp/foundry_sessions/). WAL journal mode. 10 tables: sessions, target_profiles, fuzz_results, exploit_search_results, exploit_codes, variant_sets, exploit_test_results, adaptation_logs, chain_reports, execution_reports.

AV/EDR Evasion Pipeline

Applied during GENERATE-VARIANTS. Each variant receives: null-byte removal (XOR key search smallest 1–255), selected encoding (XOR/AES-CTR/AES-CBC), injection technique template, and optional ETW patch + AMSI bypass stubs prepended to the payload code.

ETW patch byte: 0xC3 (RET). AMSI patch: \xB8\x57\x00\x07\x80\xC3 (mov eax,0x80070057;ret). Direct syscall SSNs are for Win10 21H2 — patch for other Windows versions by overriding alloc_ssn/write_ssn/thread_ssn.

CVE Templates

Exploit Chains

Reports

Report IDs use the FND-{hex12} prefix (same as session IDs — make_report_id() generates a fresh one). Signing structure: sha256 of report JSON (before signing field), Ed25519 signature (base64), ML-DSA-65 signature (base64 or "SIM-"+HMAC-SHA3-256). Algorithm field: "Ed25519+ML-DSA-65" or "Ed25519+HMAC-SHA3-256-SIM".

Verify a report: specter-foundry report --verify /tmp/FND-XXXXXX.json

MITRE Mapping