smueller/Mace-AIO-Discord-Bot---With-Dashboard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update project configuration files, and API routes accordingly. Add SQLite runtime file ignores to .gitignore for better file management.
Some checks failed
CI / Bot (Python) (push) Failing after 49s
Details
CI / Dashboard (Next.js) (push) Failing after 11s
Details

Browse Source
This commit is contained in:
TheOnlyMace
2026-07-21 17:11:38 +02:00
parent 5f34db4f3b
commit b4110c3d66
297 changed files with 2657 additions and 2768 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
PROJEKT_ANALYSE.md
View File

@@ -3,8 +3,8 @@
| Field | Value |
|-------|-------|
| **Report ID** | ZYROX-SEC-2026-001 |
| **Target** | ZyroX CV2 AIO Discord Bot with Dashboard |
| **Repository** | `ZyroX-CV2-AIO-With-Dashboard-main` |
| **Target** | HexaHost CV2 AIO Discord Bot with Dashboard |
| **Repository** | `HexaHost-CV2-AIO-With-Dashboard-main` |
| **Assessment Date** | 2026-07-21 |
| **Report Version** | 1.0 |
| **Classification** | Internal — Distribution Restricted |
@@ -34,7 +34,7 @@
## 1. Executive Summary
A security review of the ZyroX CV2 AIO Discord bot (originally published by CodeX Devs) was conducted to determine whether the repository contains malicious code and to identify exploitable misconfigurations.
A security review of the HexaHost CV2 AIO Discord bot (originally published by HexaHost) was conducted to determine whether the repository contains malicious code and to identify exploitable misconfigurations.
### 1.1 Malware Classification
@@ -69,7 +69,7 @@ A security review of the ZyroX CV2 AIO Discord bot (originally published by Code
```
┌─────────────────────────────────────┐
│ Trust Boundary │
Discord Users ───►│ discord.py Gateway (bot/CodeX.py) │
Discord Users ───►│ discord.py Gateway (bot/HexaHost.py) │
│ │ │ │
│ ▼ ▼ │
│ SQLite (bot/db/) FastAPI :8000 │
@@ -153,7 +153,7 @@ OWNER_IDS: list[int] = _parse_ids("OWNER_IDS", [870179991462236170])
| **CVSS 3.1 (est.)** | 9.8 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) |
| **Status at review** | Open → Remediated (#2) |
**Affected component:** `bot/CodeX.py` (~L345)
**Affected component:** `bot/HexaHost.py` (~L345)
```python
await client.load_extension("jishaku")
@@ -176,7 +176,7 @@ await client.load_extension("jishaku")
| **CVSS 3.1 (est.)** | 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) |
| **Status at review** | Open → Remediated (#3) |
**Affected component:** `bot/CodeX.py` → `on_command_completion`
**Affected component:** `bot/HexaHost.py` → `on_command_completion`
**Description:** Non-owner command invocations are POSTed to `CMD_WEBHOOK_URL` with command text, user ID, guild name/ID, and channel ID. Owner commands are explicitly excluded from logging.
@@ -198,9 +198,9 @@ await client.load_extension("jishaku")
| File | Channel ID | Function |
|------|------------|----------|
| `bot/CodeX.py` | `1396794297386532978` | Guild join notifications |
| `bot/CodeX.py` | `1419729255977189467` | Server count display |
| `bot/CodeX.py` | `1419729283861184632` | Member count display |
| `bot/HexaHost.py` | `1396794297386532978` | Guild join notifications |
| `bot/HexaHost.py` | `1419729255977189467` | Server count display |
| `bot/HexaHost.py` | `1419729283861184632` | Member count display |
| `bot/cogs/events/on_guild.py` | `1396794297386532978` | Join/leave detail logs |
| `bot/cogs/commands/np.py` | `1396794297386532978` | No-prefix command audit |
@@ -218,7 +218,7 @@ await client.load_extension("jishaku")
| **CWE** | [CWE-284](https://cwe.mitre.org/data/definitions/284.html) — Improper Access Control |
| **Status at review** | Open → Partially remediated (#5, #10) |
**Affected components:** `bot/api/server.py`, `bot/utils/tunnel.py`, `bot/CodeX.py`
**Affected components:** `bot/api/server.py`, `bot/utils/tunnel.py`, `bot/HexaHost.py`
**Description:** API listens on `0.0.0.0:8000` by default. Cloudflare tunnel can expose localhost to the public internet. Authentication is a single shared bearer token without per-guild Discord authorization (pre-fix).
@@ -324,7 +324,7 @@ const API_KEY = process.env.NEXT_PUBLIC_DASHBOARD_API_KEY;
| **Severity** | Low / Informational |
| **Status at review** | Acknowledged — no code change required |
**Description:** >100 files contain CodeX branding headers (`discord.gg/codexdev`). Commented `autoblacklist` cog references external support channel. Help footers link to developer Discord.
**Description:** >100 files contain legacy branding headers (`discord.gg/hexahost`). Commented `autoblacklist` cog references external support channel. Help footers link to developer Discord.
**Impact:** No direct exploitation path; increases fingerprinting and social-trust surface.
@@ -388,8 +388,8 @@ const API_KEY = process.env.NEXT_PUBLIC_DASHBOARD_API_KEY;
| Component | Role |
|-----------|------|
| `CodeX.py` | Process entry: bot, API thread, optional tunnel |
| `core/zyrox.py` | `AutoShardedBot` subclass, prefix resolution |
| `HexaHost.py` | Process entry: bot, API thread, optional tunnel |
| `core/hexahost.py` | `AutoShardedBot` subclass, prefix resolution |
| `utils/config.py` | Centralized environment configuration |
| `api/` | FastAPI REST layer for dashboard |
| `cogs/` | Feature modules (~80+ extensions) |
@@ -454,7 +454,7 @@ All databases are local SQLite files under `bot/db/`. No encryption at rest obse
## Appendix D — Startup Sequence
```
python bot/CodeX.py
python bot/HexaHost.py
├─ load_dotenv()
├─ FastAPI thread (if API_ENABLED)
├─ Cloudflare tunnel (if TUNNEL_ENABLED)
@@ -473,7 +473,7 @@ npm run dev (dashboard/)
## 6. Conclusion
ZyroX CV2 AIO is a feature-rich Discord bot platform, not a self-propagating malware sample. The primary security concern is **deployment-time trust delegation**: unchanged defaults effectively assign operational control and observability to the original publisher.
HexaHost CV2 AIO is a feature-rich Discord bot platform, not a self-propagating malware sample. The primary security concern is **deployment-time trust delegation**: unchanged defaults effectively assign operational control and observability to the original publisher.
Operators treating this as production software must treat initial configuration as a **security-critical step**, equivalent to key ceremony for any SaaS deployment.