smueller/Mace-AIO-Discord-Bot---With-Dashboard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor project branding from HexaHost to Axiom across all configurations, documentation, and code files. Update environment variables, Docker setup, and README to reflect the new brand name. Ensure consistency in naming conventions and improve clarity in setup instructions.
Some checks failed
CI / Bot (Python) (push) Failing after 12s
Details
CI / Dashboard (Next.js) (push) Failing after 9s
Details

Browse Source
This commit is contained in:
TheOnlyMace
2026-07-21 19:45:07 +02:00
parent 03c8f2ec2c
commit daf3338382
84 changed files with 238 additions and 236 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
PROJEKT_ANALYSE.md
View File

@@ -3,8 +3,8 @@
| Field | Value |
|-------|-------|
| **Report ID** | ZYROX-SEC-2026-001 |
| **Target** | HexaHost CV2 AIO Discord Bot with Dashboard |
| **Repository** | `HexaHost-CV2-AIO-With-Dashboard-main` |
| **Target** | Axiom CV2 AIO Discord Bot with Dashboard |
| **Repository** | `Axiom-CV2-AIO-With-Dashboard-main` |
| **Assessment Date** | 2026-07-21 |
| **Report Version** | 1.0 |
| **Classification** | Internal — Distribution Restricted |
@@ -34,7 +34,7 @@
## 1. Executive Summary
A security review of the HexaHost CV2 AIO Discord bot (originally published by HexaHost) was conducted to determine whether the repository contains malicious code and to identify exploitable misconfigurations.
A security review of the Axiom CV2 AIO Discord bot (originally published by HexaHost) was conducted to determine whether the repository contains malicious code and to identify exploitable misconfigurations.
### 1.1 Malware Classification
@@ -69,7 +69,7 @@ A security review of the HexaHost CV2 AIO Discord bot (originally published by H
```
┌─────────────────────────────────────┐
│ Trust Boundary │
Discord Users ───►│ discord.py Gateway (bot/HexaHost.py) │
Discord Users ───►│ discord.py Gateway (bot/Axiom.py) │
│ │ │ │
│ ▼ ▼ │
│ SQLite (bot/db/) FastAPI :8000 │
@@ -153,7 +153,7 @@ OWNER_IDS: list[int] = _parse_ids("OWNER_IDS", [870179991462236170])
| **CVSS 3.1 (est.)** | 9.8 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) |
| **Status at review** | Open → Remediated (#2) |
**Affected component:** `bot/HexaHost.py` (~L345)
**Affected component:** `bot/Axiom.py` (~L345)
```python
await client.load_extension("jishaku")
@@ -176,7 +176,7 @@ await client.load_extension("jishaku")
| **CVSS 3.1 (est.)** | 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) |
| **Status at review** | Open → Remediated (#3) |
**Affected component:** `bot/HexaHost.py` → `on_command_completion`
**Affected component:** `bot/Axiom.py` → `on_command_completion`
**Description:** Non-owner command invocations are POSTed to `CMD_WEBHOOK_URL` with command text, user ID, guild name/ID, and channel ID. Owner commands are explicitly excluded from logging.
@@ -198,9 +198,9 @@ await client.load_extension("jishaku")
| File | Channel ID | Function |
|------|------------|----------|
| `bot/HexaHost.py` | `1396794297386532978` | Guild join notifications |
| `bot/HexaHost.py` | `1419729255977189467` | Server count display |
| `bot/HexaHost.py` | `1419729283861184632` | Member count display |
| `bot/Axiom.py` | `1396794297386532978` | Guild join notifications |
| `bot/Axiom.py` | `1419729255977189467` | Server count display |
| `bot/Axiom.py` | `1419729283861184632` | Member count display |
| `bot/cogs/events/on_guild.py` | `1396794297386532978` | Join/leave detail logs |
| `bot/cogs/commands/np.py` | `1396794297386532978` | No-prefix command audit |
@@ -218,7 +218,7 @@ await client.load_extension("jishaku")
| **CWE** | [CWE-284](https://cwe.mitre.org/data/definitions/284.html) — Improper Access Control |
| **Status at review** | Open → Partially remediated (#5, #10) |
**Affected components:** `bot/api/server.py`, `bot/utils/tunnel.py`, `bot/HexaHost.py`
**Affected components:** `bot/api/server.py`, `bot/utils/tunnel.py`, `bot/Axiom.py`
**Description:** API listens on `0.0.0.0:8000` by default. Cloudflare tunnel can expose localhost to the public internet. Authentication is a single shared bearer token without per-guild Discord authorization (pre-fix).
@@ -388,8 +388,8 @@ const API_KEY = process.env.NEXT_PUBLIC_DASHBOARD_API_KEY;
| Component | Role |
|-----------|------|
| `HexaHost.py` | Process entry: bot, API thread, optional tunnel |
| `core/hexahost.py` | `AutoShardedBot` subclass, prefix resolution |
| `Axiom.py` | Process entry: bot, API thread, optional tunnel |
| `core/axiom.py` | `AutoShardedBot` subclass, prefix resolution |
| `utils/config.py` | Centralized environment configuration |
| `api/` | FastAPI REST layer for dashboard |
| `cogs/` | Feature modules (~80+ extensions) |
@@ -454,7 +454,7 @@ All databases are local SQLite files under `bot/db/`. No encryption at rest obse
## Appendix D — Startup Sequence
```
python bot/HexaHost.py
python bot/Axiom.py
├─ load_dotenv()
├─ FastAPI thread (if API_ENABLED)
├─ Cloudflare tunnel (if TUNNEL_ENABLED)
@@ -473,7 +473,7 @@ npm run dev (dashboard/)
## 6. Conclusion
HexaHost CV2 AIO is a feature-rich Discord bot platform, not a self-propagating malware sample. The primary security concern is **deployment-time trust delegation**: unchanged defaults effectively assign operational control and observability to the original publisher.
Axiom CV2 AIO is a feature-rich Discord bot platform, not a self-propagating malware sample. The primary security concern is **deployment-time trust delegation**: unchanged defaults effectively assign operational control and observability to the original publisher.
Operators treating this as production software must treat initial configuration as a **security-critical step**, equivalent to key ceremony for any SaaS deployment.