RESEARCH ARCHIVE / JUDOZI

Judozi

Overview

Judozi is a modular offensive security framework written in pure Go. It compiles to a single static binary with zero external dependencies, designed for environments where installing packages or toolchains is not an option. The framework uses a plugin-based module system where each module implements a common interface and is auto-discovered at startup.

The framework currently ships with three modules: kernel (automated privilege escalation), persistence (post-exploitation persistence mechanisms), and recon (system enumeration and reconnaissance). After successful privilege escalation, Judozi drops into an interactive shell session with full module access.

Architecture

Every module implements the Module interface: Name(), Description(), Category(), and Run(args []string). The registry auto-discovers registered modules and dispatches execution based on CLI arguments or interactive selection. After a successful kernel exploit, the framework automatically transitions into an interactive shell with access to all modules.

Module Interface

// Every Judozi module implements this interface
type Module interface {
    Name()        string
    Description() string
    Category()    string
    Run(args []string) error
}

Kernel Module: Execution Pipeline

The kernel module is the primary attack module. It automates the entire privilege escalation workflow from kernel version detection through exploit selection, compilation or binary download, and execution.

Exploit Database

The kernel module ships with a JSON-based exploit database covering 23 CVEs across kernel versions 2.6.22 through 6.7.1. Each entry includes version range constraints, architecture support, source URLs, precompiled binary URLs, compilation commands, and execution instructions.

Kernel Version Coverage

Real World Testing

Judozi has been tested in production cloud environments, including Azure Container instances running kernel 5.15.0. The binary fallback system was validated in GCC-free environments: the framework detected 10 matching exploits, automatically downloaded precompiled binaries, and executed them without requiring any compiler toolchain on the target.

nextjs@container:/tmp$ uname -r
5.15.0-1102-azure

nextjs@container:/tmp$ ./judozi kernel -auto
[*] Kernel: 5.15.0
[+] Architecture: amd64
[+] Found 10 potential exploit(s)

[!] GCC not available, using binary fallback mode
[*] Downloading CVE-2024-1086...
[+] Binary downloaded successfully (166KB)
[*] Executing exploit...
[*] creating user namespace (CLONE_NEWUSER)...
[*] creating network namespace (CLONE_NEWNET)...

Project Structure

judozi/
├── cmd/judozi/
│   └── main.go              # CLI entry, module selection, shell dispatch
├── modules/
│   ├── kernel/              # Privilege escalation module
│   │   ├── kernel.go        # Module implementation
│   │   └── pkg/
│   │       ├── exploit/     # Download, compile, execute logic
│   │       ├── kernel/      # Version detection and parsing
│   │       ├── output/      # Colored terminal output
│   │       └── vulndb/      # Exploit database (exploits.json)
│   ├── persistence/         # Post-exploitation persistence
│   │   ├── persistence.go
│   │   └── techniques/
│   └── recon/               # System reconnaissance
│       ├── recon.go
│       └── techniques/
├── pkg/
│   ├── module/              # Module interface and registry
│   ├── shell/               # Interactive shell session
│   └── ui/                  # Terminal UI framework
├── go.mod
└── judozi                   # 5.3MB static binary