Anvil
How It Works
⚠️ Authorized Testing Only
This tool interacts with live systems and must only be used for testing that has been explicitly authorized by the asset owner. Unauthorized use of this tool to probe, scan, exploit, or otherwise interact with systems you do not have written permission to test is illegal under computer fraud and abuse laws (CFAA, CMA, and international equivalents). pr0t31n does not condone or recommend any unauthorized use. Always obtain a signed Rules of Engagement (RoE) or Statement of Work (SoW) before beginning any assessment.
Anvil performs a Process State Sweep (PSS) — a point-in-time snapshot of the local host's running state for security assessment purposes. It inventories all running processes with their command lines, user IDs, and working directories; maps all listening network sockets to their owning processes; enumerates loaded kernel modules (Linux) or kernel extensions (macOS); and flags suspicious indicators that may warrant further investigation during a penetration test.
The tool runs directly on the target host and produces a comprehensive security-relevant inventory in the universal pr0t31n output schema (findings.json, findings.csv, meta.json, summary.json). It detects anomalies such as setuid binaries owned by non-root users, unsigned binaries on macOS, processes running as root that listen on high-risk ports, and unexpected kernel modules that could indicate rootkit activity or unauthorized drivers.
Anvil operates in both standalone CLI mode and as a managed tool under the Vantage/Crucible management console. When managed (ANVIL_MANAGED=1), it emits __VANTAGE_LOG__, __VANTAGE_ERR__, __VANTAGE_STATUS__, and __VANTAGE_FINDING__ protocol tokens for real-time progress monitoring and finding collection through the management UI. All findings are written to disk using the universal schema with run-dir-relative evidence paths.
Phase Pipeline
- Phase 1 — Configuration Loading
- Phase 2 — Target Scanning
- Phase 3 — Process Auditing
Security
CLI tool. Requires root/sudo for full process enumeration, kernel module listing, and setuid binary scanning. Operates locally — no network access.
Features
Binary Analysis
Detection
Kernel Analysis
Network Analysis
Output
Process Analysis
Security
Use Cases
Post-Exploitation Host Assessment
After gaining access to a target host, run Anvil to quickly inventory all running processes, listening services, and kernel state to identify lateral movement opportunities and persistence mechanisms.
Privilege Escalation Reconnaissance
Identify setuid binaries, world-writable process working directories, and root-owned services listening on high ports that may provide privilege escalation paths.
Rootkit Detection Screening
Enumerate loaded kernel modules to detect suspicious or unsigned modules that could indicate rootkit activity on a compromised host.
Baseline Security Audit
Capture a comprehensive snapshot of the host's running state as a security baseline, identifying unnecessary services, overprivileged processes, and exposed network interfaces.
Incident Response Triage
Quickly assess a potentially compromised host by inventorying processes, network connections, and kernel state to identify indicators of compromise.
CLI Reference
Command Examples
Full Process State Sweep
Run all analysis modules — processes, sockets, kernel modules, setuid binaries.
Third-Party Tool Invocations
Commands and flags used when this tool invokes third-party dependencies during operation.
Finding Nomenclature
Anvil findings document security-relevant observations from the process state sweep. Findings are categorized by the type of anomaly detected:
- Setuid Binary (MEDIUM/HIGH) — A setuid binary owned by a non-root user was found, representing a potential privilege escalation vector.
- Unsigned Binary (MEDIUM) — On macOS, a running process is executing an unsigned binary that bypasses Gatekeeper code-signing enforcement.
- Root Service on High Port (LOW/INFO) — A root-owned process is listening on a non-standard high port, which may indicate a backdoor or misconfigured service.
- Suspicious Kernel Module (HIGH) — An unexpected or unsigned kernel module is loaded that does not match known legitimate drivers for the system.
- World-Writable Process Directory (MEDIUM) — A process is executing from a world-writable directory, making it susceptible to binary replacement attacks.
All findings include the affected process details (PID, user, command line) and the evidence file path within the run directory.
Action Items
Anvil generates action items for suspicious findings that need manual investigation — e.g., "Investigate unknown setuid binary at /usr/local/bin/x", "Examine root process listening on non-standard port 4444", "Review unsigned kernel module 'custom_driver'".
Output Files
| File | Format | Description |
|---|---|---|
meta.json |
JSON | Tool identity and engagement metadata |
findings.json |
JSON | Universal findings array v1.1 |
findings.csv |
CSV | CSV mirror of findings |
summary.json |
JSON | Aggregated statistics |
scan.log |
TXT | Human-readable timestamped log |
scan.log.json |
JSONL | Machine-readable JSON log events |
errors.log |
TXT | ERROR-level entries only |
Invocation Methods
| Method | Usage |
|---|---|
| CLI — Direct |
cd /opt/pr0t31n/Anvil && python3 anvil.py [OPTIONS]
Run directly with command-line arguments. |
Integration
Metadata
| Name | Anvil |
| Category | Exploitation |
| Version | 0.3.1 |
| Install Path | /opt/pr0t31n/Anvil |
| Main File | anvil.py |
| GitHub | https://github.com/pr0t31n/Anvil.git |